Lockdown policy fields for Samsung Knox devices in Device Admin mode

These lockdown options are applied to Samsung Knox devices in Device Admin mode.

Table 1. Lockdown policy fields: Samsung(Device Admin mode)

Item

Description

Default Policy Setting

Android Browser

Enable or disable access to the Android browser.

Enable

Email Account Creation

Enable or disable the device user’s ability to configure an email account on the device.

Enable

Cellular Data

Enable or disable the ability for users to use cellular data.

If you disable both cellular data and Wi-Fi on a device, Core can no longer communicate with the device. The device may need a factory reset to restore functionality.

Enable

Factory Reset

Enable or disable the ability for users to reset the device to factory defaults.

Enable

Google Backup

Enable or disable backup to Google servers.

Enable

Google Play

Enable or disable access to Google Play.

Enable

Incoming MMS

Enable or disable incoming MMS messages.

The user is not informed if MMS is blocked.

Enable

Incoming SMS

Enable or disable incoming SMS messages.

The user is not informed if SMS is blocked.

Enable

Make Passwords Visible

Select Enable to allow users to change the “Make Passwords Visible” setting on their device. Select Disable to prevent users from changing this setting and make password characters not visible.

Enable

Developer options

Enable or disable this option to make USB debugging available to developers on Samsung Knox devices.

Enable

Management Removal

Enable or disable the device user’s ability to remove the Samsung DM Agent from Android devices.

Enable

OTA Upgrade

Enable or disable over-the-air upgrades of the device firmware.

Over-the-air upgrades require the device to be in recovery mode. Therefore, for devices to perform an over-the-air upgrade, enable both Recovery Mode and OTA Upgrade in the lockdown policy.

WARNING:

Do not disable Setting Changes in the lockdown policy if OTA Upgrade is enabled. Disabling Setting Changes when OTA Upgrade is enabled can result in a non-functional device because setting changes are required for upgrade.

Enable

Outgoing MMS

Enable or disable outgoing MMS messages.

Enable

Outgoing SMS

Enable or disable outgoing SMS messages.

Enable

Recovery Mode

Enable or disable the device from entering Recovery Mode. Caution: use Disable with care. Disabling recovery mode on a device may make the device unrecoverable if there is an issue with the device’s operating system.

Enable

Roaming Voice Calls

Enable or disable voice calls while roaming.

Enable

Safe Mode

Enable or disable the user’s ability to reboot a Samsung Knox device into Safe Mode.

A device running in Safe mode is not protected by MobileIron, because only system apps run in Safe mode.

Enable

Setting Changes

Enable or disable the device user access to the settings app.

WARNING:

Do not disable Setting Changes if OTA Upgrade is enabled. Disabling Setting Changes when OTA Upgrade is enabled can result in a non-functional device because setting changes are required for upgrade.

Enable

Tethering - Bluetooth

Enable or disable Bluetooth tethering.

Refer to “Bluetooth lockdown for Samsung Knox devices” in the Core Device Management Guidefor Android Devices.

Enable

Tethering - USB

Enable or disable USB tethering.

Enable

Tethering - Wi-Fi

Enable or disable Wi-Fi tethering.

Enable

Unknown Sources

Enable or disable installation of apps from sources other than Google Play.

Enable

USB Media Player

Enable or disable the USB media player.

Enable

YouTube App

Enable or disable access to YouTube App.

Enable

Manual Date Time Change

Enable or disable the ability to manually change the date and time.

Enable

Certificate Revocation Status (CRL) Check

Enable or disable the Certificate Revocation List (CRL) check for revocation of the server-certificate chain during the SSL mutual authentication process.

Disable

Google Crash

Report

An administrator can use this API to enable or disable sending a crash report to Google. If disabled, all possible Google crash reports are blocked.

Enable

Google Accounts Auto-sync

Enable or disable Google accounts auto-sync.

Enable

Multi-user mode

Enable or disable the Multi-user mode

Enable

New admin installation

Enable or disable new admin installation

Enable

Allow USB HID Protocol

Enable or disable the USB Human Interface Device (HID) protocol.

Enable

Restricted Apps

List apps that you want to prevent from being installed or run on Samsung Knox devices.

Click + to add an application identifier (app ID) for the app. The app ID is case-sensitive. You can use the wild card character * to cover a set of apps, such as all apps from a particular vendor.

For example, com.abcdef.* restricts all application IDs beginning with com.abcdef.

However, to ensure that pre-existing apps get restricted, provide the complete app ID. Do not use a wild card character.

(empty)

Allowed Apps

List the apps that you that are exceptions to the apps covered by a wild card character in the Restricted Apps section.

Click + to add an application identifier (app ID) for the app. The app ID is case-sensitive.

(empty)

Turn Off Wi-Fi for these SSIDs

Prevent Samsung Knox devices from accessing the Wi-Fi SSIDs listed in this section.

Click + to add an SSID. The SSID is case-sensitive.

Do not restrict Wi-Fi SSIDs that are configured for the device.

In Mobile@Work 9.0.0.0 for Android, connection to SSIDs listed in this section can occur if the SSID is managed and Always Connect Device to Managed Wi-Fi is enabled.

(empty)