Lockdown & Kiosk: Android Enterprise

Enter a name that identifies this configuration.

Select the type of lockdown settings you want to configure:

• Work Profile
• Work Managed Devices (Device Owner and kiosk mode settings)
• Managed Device with Work Profile/Work Profile on Company Owned Device Lockdown Settings

  Work Profile on Company Owned Device Lockdown Settings is applicable only for Android 11+ devices.
  
  

Only one type is allowed per configuration. The options displayed depend on the type you select.

if a Work Managed Device (Device Owner) and a Managed Device with Work Profile on Company Owned Device configuration is distributed to the same device, the Managed Device with Work Profile takes precedence.

• Android 5.0+

• Android 5.0+

• Android 5.0+

• Android 5.0+

• Android 5.0+

• Android 5.0+

• Android 5.0+

• Android 6.0+

• Android 7.0+

• Android 8.0+

• Android 9.0+

• Android 11.0+

Select to turn off access to wireless LANs.

Select to turn off camera access.

Select to turn off access to Bluetooth settings.

Select to mute master volume.

Select to prevent a user from configuring user credentials.

Select to turn off access to mobile networks.

This cannot be disabled if Wi-Fi is disabled.

Select to turn off VPN connections.

Select to allow users from returning the device to factory defaults.

You can optionally specify a list of authorized Google account IDs (an integer value) that can provision the device after factory reset or hover over the help icon to view help for retrieving authorized account IDs.

Select to prevent a user from using NFC to transfer app data.

Select to prevent a user from rebooting a device into safe boot mode.

Select to disable debugging features on devices. By default, this option is turned on.

Select to prevent a user from sending and receiving SMS  messages.

Select to prevent a user from enabling automatic time changes.

Select to allow devices to sync time with the Ivanti Neurons for MDM servers first time on registration and thereafter once every 24 hours after each check-in. This option will be available only if the Disable Auto-Time is selected.

Select to turn off data exchange while the device is roaming.

Select to restrict Allowlisted IME package names by designating a list of Allowlisted package names via the Package Name field. The devices will have both Allowlisted package input methods and the default system input methods available to use.

The user can switch between default system input methods and Allowlisted packages input methods.

For Android 10+, Allowlisting is applicable for IME apps on the device side only. For older Android versions, Allowlisting is applicable for IME apps device wide.

Select to disable USB file transfer.

Select to disable the keyguard. This option has no effect if a password, PIN, or pattern is currently set.

If a password, PIN or pattern is set after the keyguard is diabled, the keyguard stops being disabled.

Select to prevent apps from displaying certain types of overlay windows, such as alerts and toasts.

Select to disallow user from installing apps from unknown sources.

Select to set brightness of your device's screen.

• Manual - Select to enter a number manually (0 to 255) 
• Adaptive - Select to allow the device to set the brightness

It is recommended to enable the "Disallow config brightness" option before setting the screen brightness of your device.

Select to set screen orientation. You can set the screen orientation to 0, 90, 180, or 270 degrees from the drop down list.

By default, this option is not selected. For Go app 89 and later versions, you must select this option and set the value to 0 to keep the device in Portrait mode in Kiosk.

Android 8.0+

Select to disallow the user from sharing outgoing bluetooth on the device.

Android 9.0+

Select to disable airplane mode on the entire device.

Select to disallow the user from configuring the brightness.

It is recommended to define the "Set screen brightness mode" mode before selecting this option.

Select to disallow the user from disabling location providers.

Android 12.0+

Android 13.0+

Kiosk Mode Settings: Kiosk mode applies additional restrictions to the devices including limited access to apps via a customized launcher.

Select to enable lock task mode on Android devices. When enabled, the devices can display keyguard, status bar and safe mode. This option is disabled by default.

The following are the additional settings displayed when lock task mode is enabled for Android 9 or supported newer versions:

Settings icon - Allows apps to have access to system functions that are dependent on the Device Settings app. Allowing Device Settings helps to avoid the Lock Task Mode violations in scenarios such as Bluetooth pairing from an app. It is recommended to keep this setting enabled for specific apps.

System Info- Displays the date/time, connectivity, battery, and vibration mode on the status bar. This option is disabled by default.

Keyguard(Enabled by default) - Enables the keyguard during lock task mode.

Global Actions(Enabled by default) - Enables the menu that is displayed when the user long-presses the power button. If this option is disabled, the user may not be able to power off the device.

Home button- Enables the home button. This option is disabled by default. When enabled, the following sub-options are displayed:

• Overview Button(Disabled by default) - Enables the Overview button and the Overview screen during lock task mode
• Notifications(Disabled by default) - Enables notifications during lock task mode. This includes notification icons on the status bar, heads-up notifications, and the expandable notification shade.

If Home Button option is not enabled, the user will not be able to use the multi window feature.

Select to disable Quick Settings in kiosk mode for devices running on Android 5.

Select to allow a  user to change Wi-Fi settings and access preferred wireless networks.

Select to allow a user access to the location settings.

Select to allow a user to access date and time settings.

Select to allow the user to access language settings.

Select this option to use the FIDO-authentication for users when using the shared kiosk. Allow users to use FIDO-Keys for logging into the device.

Google Chrome is the only supported browser and it must be available on the device for FIDO-authentication to be available in shared kiosk.

Select to allow the display of more than one app at the same time with Samsung devices(Device Owner kiosk).

To allow multi window in lock task mode, the following lock task mode options should also be enabled:

• Home Button
• Overview Button

Enter the 6-digit PIN that the user must type to exit the Kiosk mode. The PIN must have a minimum of 6 digits and a maximum of 10 digits. This PIN applies to all the devices in kiosk mode.

Previously, the Kiosk PIN length was 4 digits. The user can continue to use the 4-digit PIN even after upgrading from a previous version to Ivanti Neurons for MDM 82. However, if there are any configuration changes, the PIN length must be set as per the new requirement (i.e., min 6 digits and max 10 digits).

The Go app will protect the device against brute force attacks. For more information, see Go for Android documentation.

Click +Add to include listed native apps in the group of apps allowed in kiosk mode.

Under settings for the Kiosk Mode Allowed Apps, the following options are available:

• Clear app user data: Enabling this option lets all the application data to be automatically cleared without any prompts when the user logs out of the kiosk.
  
  Select Enable Shared Device in the Kiosk mode settings for this option to be available with the applications.

  • App data is not cleared for Google Chrome and webview package even if they are added in the app Allowlist with clear user data enabled. This is because Kiosk might crash if app data is cleared for these 2 packages.

  • App data is not cleared for System apps for which app launcher is not available (both inside and outside kiosk).

• Make hidden: Enabling this option lets the application to be accessible by other apps but is not available in the Kiosk launcher.

If you have disabled Dialer or Camera in Lockdown settings above, they cannot be added to the Allowed Apps list.

Click +Add to include the package name of an app that is not available on the Google Play Store.

For Samsung devices, admins should Allowlist the following dialer/system packages to make them functional in Kiosk mode for enabling dialer functionality in Kiosk mode.

• Call – com.samsung.android.incallui
• Phone – com.samsung.android.dialer (should be Allowlisted and the admin should select hide option for this package to avoid issues with two dialer options for the user)
• Call – com.sec.phone
• Call Setting – com.samsung.android.app.telephonyui

• Assisted Dialing – com.sec.providers.assisteddialing
• Call Log Backup / Restore – com.android.calllogbackup
• Dialer Storage – com.android.providers.telephony
• Phone – com.android.server.telecom
• Phone – com.android.phone
• Smart Call – com.samsung.android.smartcallprovider
• WiFi Calling – com.sec.unifiedwfc

Managed Device Lockdown Settings

Select to turn off access to wireless settings.

Select to turn off Bluetooth features.

Use caution when using this option. Ivanti recommends against disabling audio because hands-free Bluetooth access is disabled. Legal requirements for hands-free use of devices while driving is becoming more widespread.

Select to mute master volume. (Not applicable to Android 11+ devices)

Select to turn off access to mobile networks.

This cannot be disabled if Wi-Fi is disabled.

Select to turn off VPN connections. (Not applicable to Android 11+ devices)

Select to allow users to return the device to factory defaults.

You can optionally specify a list of authorized Google account IDs (an integer value) that can provision the device after factory reset or hover over the help icon to view help for retrieving authorized account IDs.

Select to prevent a user from rebooting a device into safe boot mode.

Select to allow application verification features on devices. By default, this option is turned on.

When this option is turned off, the device goes back to its default behavior which may vary from device to device.

Select to prevent a user from unmuting the device's microphone.

Select to prevent a user from enabling automatic device time adjustment with time zone changes.

Select to allow devices to sync time with the Ivanti Neurons for MDM servers first time on registration and thereafter once every 24 hours after each check-in. This option will be available only if the Disable Auto-Time is selected.

Select to keep Wi-Fi on while the device is in Sleep mode. (Not applicable to Android 11+ devices)

Select to restrict accessibility services for work apps by designating a list of Allowlisted package names via the Package Name field. If there are no Allowlisted packages, then only system accessibility services will be allowed.

In Android 10+, the input methods are restricted to Work Apps only, else they are restricted to the entire device.

Select to disable external media.

Select to set the lock screen message to be displayed on the device. Type the lock screen message (maximum of 256 characters) in the text field. By enabling this option, the user is blocked from setting the message in Settings and the message that is set by the admin is displayed to the user.

If the admin does not provide any lock screen message after enabling 'Set lock screen message', the user is blocked from setting the message in Settings, but no message is displayed to the user.

Select to set screen timeout duration (in seconds).

It is recommended to enable the "Disallow config screen timeout" option before setting the screen brightness of your device.

If the user is allowed to make changes, these settings will be reset to the admin defined settings on next check-in.

This setting is not supported on devices with Android 11 and later versions for Work Profile on Company Owned Device mode.

Select to disallow auto fill. (Not applicable to Android 11+ devices)

Select to disable the backup service. (Not applicable to Android 11+ devices)

Select to disable airplane mode on the entire device.

Select to disallow the user from configuring the brightness (Not applicable to Android 11+ devices).

It is recommended to define the "Set screen brightness mode" before selecting this option.

Select to disallow the user from disabling location providers.

Select to disallow system error dialogs.(Not applicable to Android 11+ devices)

Android 12.0+

Android 13.0+

Work Profile Lockdown Settings

Select to prevent a user from modifying applications in Settings or launchers.

Select to prevent copy/paste of information between profiles.

Select to prevent a user from using NFC to transfer app data.

Select to disable debugging features on devices. By default, this option is turned on.

Select to disallow download from unknown sources within the work profile.

Sets whether caller ID information from the work profile will be shown in the device for incoming calls.

Select to prevent the users from searching for work contacts from the personal phone dialer.

Select to restrict work profile notifications.

Select to prevent users from sharing personal data into a work profile on the device.

Select any of the following options to allow all apps or select a set of apps on the personal side to access the calendar information present in the work profile :

• All Apps on Personal Profile- allow all apps to access calendar information present in the work profile

• Only the following apps on Personal Profile- In the text field below, enter the bundle IDs of the apps separated by a comma. Only these selected apps on the personal side will be allowed to access the calendar information present in the work profile.

The app on the personal side should implement specific APIs to be able to access shared calendar.

Select to set a maximum time window the work profile can be turned off before Ivanti Neurons for MDM suspends personal apps on the device. You can set a time between 72 and 8760 hours. 8760 hours is one year of time.

Default value is set to 72 hrs if the option is selected.

The device user sees a message prompting to turn on the work profile to enable suspended apps. Available for Android 11+ devices in Work Profile on Company Owned Device.