Restrictions Payload

Encrypts the personal information saved on the device. This includes accounts, settings, apps, media, and other data saved to the internal phone storage media. This does not encrypt removable storage media such as an SD card. Enabling this option prompts the user to encrypt the device, but does not force encryption. The user is required to set a passcode before encrypting the device, because the passcode is used to decrypt the information each time the device is unlocked. Depending on the device, encryption may not be a reversible action.

Allows the user to access and change the Android device settings.

Allows the user to install apps. Removing the check for this option does not prevent users from deleting apps on the device. Avalanche cannot prevent the removal of apps at the device level.

Allows the user to launch the camera application.

Allows the user to launch a web browser.

Allows the user to launch the default web browser.

Allows the user to launch email applications.

Allows the user to use the Google Search application.

Allows you to restrict specific actions on a Samsung SAFE device. When the payload is sent to devices, these options are applied only on Samsung SAFE devices.

Allows the user to uninstall apps.

Allows the user to dial using voice commands.

Allows the user to access the Google Play Store.

Allows the user to encrypt external SD cards on Samsung SAFE devices. The encryption process must be performed by users at the device level.

To encrypt an external SD card on a device after deploying a restrictions payload with this option selected, launch the Settings app and navigate to Security > Encrypt external SD card. Tap Set screen lock type >Password and then set and confirm a password. This password is used to access data on the SD card, as well as decrypt the card. After setting the password, you are returned to the Encrypt external SD card screen and you must tap Continue and then enter the password to start the encryption process. When fully encrypted, a notification appears at the top of the screen.

To decrypt an external SD card, this option must be deactivated in Avalanche and synced to the device. Once synced, launch the Settings app and navigate to the Encrypt external SD card screen. Tap Turn off and enter the password you set previously. Tap Apply and then wait for the SD card to be decrypted. A notification appears at the top of the screen when complete.

Allows you to create a list of specific applications and assign restrictions or allowances to each individual app.

To add a specific app for management, type the name and package details in the text boxes and click Add App. For example, in order to add restrictions to the Gmail app, type: Gmail com.google.android.gm

Set restrictions on an app by selecting the app in the list and clicking the Set Restrictions icon. You can only set restrictions for a single app at a time. Options selected here will only apply to the app you selected. If an app requires use of an option you've restricted, the app will automatically close when launched and display an error message. If an open app asks for permission to access a restricted setting and the device user gives permission, this will also force the app to close.

Factory reset protection requires an authorized account to sign in on the device after a factory reset. The authorized account is an account that was on the device before the factory reset. Using a corporate account on a device with factory reset protection provides another layer of device security by ensuring the company will retain control over the device, even after a factory reset. Factory reset protection is enabled by default. Select this option to disable it.

Prevents the user from factory resetting the device from the settings app.

Disable Google Smart Lock options, including staying unlocked when in a trusted location or when paired to a trusted device.

Prevents the user from uninstalling managed apps that have been pushed to the device.

Disables opening the camera from the lock screen.

Allow access to developer options to enable USB debugging.

Prevent the user from adding a personal Google account to the device. This restriction must be set during provisioning to ensure the user does not add personal accounts before the restriction is in place. Setting this restriction will not remove accounts already on the device.

Puts fully managed devices into lock task mode. This mode locks the device to the launchpad included in the Android Enterprise enabler. Only apps whitelisted in this payload will be accessible through the launchpad.

Enable System Info in the Status Bar. Shows time, battery, and Wi-Fi information in the status bar.

Create a whitelist to lock the device to approved apps. Apps in the list will appear in the enabler launchpad.

To add a specific app to the white list, search for apps in the Google Play Store by clicking the Browse icon. You can also add apps manually by typing the friendly name for the app in the App Name field and the Android package name in the App package field. For example, in order to add a Gmail app, type: Gmail com.google.android.gm

Factory reset protection requires an authorized account to sign in on the device after a factory reset. The authorized account is an account that was on the device before the factory reset. Using a corporate account on a device with factory reset protection provides another layer of device security by ensuring the company will retain control over the device, even after a factory reset. Factory reset protection is enabled by default. Select this option to disable it.

Prevents the user from factory resetting the device from the settings app.

Disable Google smart lock options, including staying unlocked when in a trusted location or when paired to a trusted device.

Prevents the user from uninstalling apps installed from the managed enterprise Play Store.

Disables opening the camera from the lock screen.

Prevent the user from logging into enterprise apps with personal accounts. This restriction must be set during provisioning to ensure the user does not add personal accounts. Setting this restriction will not remove accounts already on the device.

Allows the user to install apps. Removing the check for this option does not prevent users from deleting apps on the device. Avalanche cannot prevent the removal of apps at the device level.

Allows the user to launch the camera application.

Allows the user to place or receive FaceTime calls.

Allows the user to save a screenshot of the display.

Allows the device to sync accounts automatically, even when the device is roaming.

Allows the user to use Siri voice commands or dictation.

Allows the user to use Siri without entering a passcode when the device is locked.

Allows the user access to content in Siri added by other users.

Allows the user to dial using a voice command.

Allows the device to display Passbook notifications while the device is locked.

Allows the user to make purchases through installed apps.

Forces the user to type in their iTunes Store account password each time they make a purchase.

Allows the user to play multiplayer games in the Game Center.

Allows the user to add friends in the Game Center.

Allows the user to swipe up to view the Control Center even when the device is locked.

Allows the user to view notifications even when the device is locked.

Allows the user to swipe down to see the Today view even when the device is locked.

Allows the user to access the iBooks Store.

Allows the user to access AirDrop.

Allows the user to change account settings.

Allows the user to access the iTunes Store.

Allows the user to open the YouTube app.

Allows the user to use Google Search.

Allows the user to launch Safari. When this option is disabled, the user will not be able to launch Safari, but will still be able to launch other web browsers, such as Chrome.

Allows the user to turn on Safari's auto-fill feature.

Prevents the device's ID from being used for advertisement tracking.

When the user visits a fraudulent or compromised website, Safari displays a warning.

Allows web pages that the user accesses using Safari to run JavaScript.

Sets Safari to block pop-up messages.

Allows Safari to accept all cookies, reject all cookies, or accept cookies only from sites that are directly accessed.

Allows the user to see explicit music or video content in the iTunes Store. Explicit content is flagged by content providers.

The media region with the rating system the device should use in allowing content.

When kiosk mode is enabled, the device will only launch the app specified and will block other apps. To specify the app for kiosk mode, use the app's Apple ID. To exit kiosk mode, an administrator must modify the payload to turn off kiosk mode and update the device. Kiosk mode is only available for devices that are in Supervised mode. For more information, see your Apple documentation.

Prevents the device from locking automatically.

Disables the display from changing orientation when the device is rotated.

Disables any functionality associated with the ringer switch.

Disables any functionality associated with the sleep/wake button.

Disables the touch functionality of the screen.

Disables any functionality of the volume button.

Allows the user to use Assistive Touch features to make the device more accessible. This option is for users who have problems touching the screen or pressing buttons.

Allows the user to configure Assistive Touch options.

Allows the user to invert the colors on the screen.

Allows the user to configure color inversion options.

Allows the user to switch the audio output to mono.

Allows the user to select text and use the Speak Selection feature for text-to-speech.

Allows the user to use VoiceOver features to make the device more accessible. This option is for users who need audible presentation of screen materials or menus.

Allows the user to configure VoiceOver options.

Allows the user to use zoom features.

Allows the user to change the zoom settings.

Allows the user to back up the device using iCloud.

Allows the user to store documents in iCloud.

Allows the user to use Photo Stream. If Photo Stream is disabled after the device user has shared photos using Photo Stream, photos already shared will be removed.

Allows the user to use Touch ID to unlock the device.

Allows the device to pair with computers other than the computer used to put the device in Supervised mode.

Allows the device to send diagnostic data to Apple.

Allows the user to accept TLS certificates that can't be verified. This setting is enforced for Safari, Mail, Contacts, and Calendar.

Allows the user to switch to unmanaged applications or accounts from a managed app or account. For example, if the email app is managed but the browser app is not, the user would be allowed to click on a link in an email that launches the browser.

Allows the user to switch to managed applications or accounts from an unmanaged app or account. For example, if the email app is managed but the browser app is not, the user would be allowed to click on a link on a web page that launches the email app.

Allows public key infrastructure updates. If this option is not enabled, you may experience issues with any application that depends on certificates, including internet browsers.

Allows the administrator to send down configuration profiles silently, without user interaction.