Lockdown policy fields for Android Enterprise devices in Work Managed Device mode and Managed Device with Work Profile mode

Allow master volume un-mute

Allows the user to un-mute master volume. Note: volume is not muted by default.

Allow automatic date & time

If checked, the user can change date and time.
If unchecked, user can make changes but system will reset the date and time automatically.

Allow safe boot of the device

Allows user to reboot the device into safe mode.

Allow the user to mount physical external media

Allows the user to mount external media such as SD cards or external drives.

Allow use of USB storage

Allows data to be stored on USB drives.

Allow Keyguard (no effect if password or PIN is set)

Allows a keyguard, or lockscreen, on the device under the condition that the device has not been enabled using a PIN, password, or pattern.

Allow install from unknown sources on the device

Allows administrator to enable installation of apps from unknown sources to device. Unless this field is selected, the work profile never allows installation of apps from unknown sources.

Configure Private DNS settings

Private DNS allows more privacy for device users than using public DNS servers. It provides a way for enterprises to secure device user activity and enterprise hostnames from being learnt by unwanted DNS servers. Private DNS allows devices to discover DNS over TLS and provide specific DNS server hostnames to prevent leaking of DNS resolution.

Devices will use DNS-over-TLS prior to attempting name resolution in cleartext. Selecting this box expands to display:

• Off - Private DNS cannot be disabled from the Admin Portal. Device user can disable private DNS setting, if allowed to change the settings.

• Opportunistic - The device will attempt to find a server that supports private DNS. If it cannot find one, it will fall back to non-private DNS (cleartext).

• Use Specific DNS Server - enter the hostname of server that implements DNS over TLS (RFCC7858). This value cannot be empty. Once added, it can only be updated.

Applicable to: Android 10+ devices in Work Managed Device mode.

Set Minimum Required Wi-Fi Security (Android 13+)

Use this option to set minimum required Wi-Fi security. This means the device's Wi-Fi must be set at the chosen level or higher. Below is the security hierarchy:

1. No minimum security required - (default) allows all types of Wi-Fi networks.

2. Personal Network Based Security - allows personal Wi-Fi network such as WEP, WPA/WPA2/WPA3, and more secure networks.

3. Enterprise EAP Network Based Security - allows EAP protocol-based Wi-Fi network and more secure networks.

4. Enterprise 192 Network Based Security - allows enterprise 192 protocol based Wi-Fi networks.

All the existing devices that do not meet the minimum criteria will be disconnected.

When this check box is disabled, no action is taken by the client. When enabled, the client sets the correct choice. If, after being enabled, the check box was disabled, then the client will return to the last known setting before the change was made.

To find out about existing Wi-Fi security level usage, use "Wi-Fi Security Level" in Device Details >Advanced Search. The security level is also listed under "Required Wi-Fi Security Level" in the Device Details page > Device tab.

Set screen brightness

Select to set brightness of your device's screen.

• Manual - Select to enter a number manually (0 to 255)

• Adaptive - Select to allow the device to set the brightness

If the user is allowed to make changes, these settings will be reset to the administrator-defined settings on next check-in.

Applicable to:

• Work Managed Device mode

• Managed Device with Work Profile mode

• Work Managed Device non-GMS mode (AOSP)

Set screen orientation

Select to set screen orientation. You can set the screen orientation to 0, 90, 180, or 270 degrees from the drop down list.

Applicable to:

• Work Managed Device mode

• Managed Device with Work Profile mode

• Work Managed Device non-GMS mode (AOSP)

Allow SMS

Allow the user to send and receive SMS messages.

Allow data roaming

Allow the use of data while user is traveling outside of data plan area. Note: the user can re-enable this feature from settings.

Allow Wi-Fi to be configured

Allows the user to configure Wi-Fi.

Allow Bluetooth

If Allow Bluetooth is:

• enabled (default), the device user can turn Bluetooth on or off
• not enabled, the device user cannot turn Bluetooth on

Allow Bluetooth Outbound Sharing

Allows the user to share files using Bluetooth on managed devices running Android 8.0 through the most recently released versions as supported by Ivanti.

Allow mobile network to be configured

Allows the user to configure the mobile network.

Allow VPN to be configured

Allows the user to configure VPN.

This setting must be enabled to allow the application of a managed VPN. As a workaround, enable Always-on VPN in Android Enterprise settings and select Tunnel as the App Identifier.

Android 11:

Enable Common Criteria (CC) mode

Select to enable Common Criteria mode for Android 11 + devices.

If Common Criteria mode is turned off after being enabled previously, all existing Wi-Fi configurations will be lost.

Applicable to Managed Device with Work Profile mode and Work Profile on Company Owned Device mode.