Apply or remove function restrictions

Last updated January 28th, 2026

To use this feature, you must be enrolled in the Device Financing domain and have a Knox Guard Advanced license.

If you want to restrict the functionality of your devices (for example, deny camera access or force the device to continuously reboot), you can apply a function restriction policy from the Devices page.

Function restrictions can only be applied to devices with hardened security architecture.

Apply function restrictions

Apply function restrictions device action.

To apply function restrictions to a select device:

  1. On the Devices page, select one or more devices.

  2. Click ACTIONS > Manage policy > Apply function restrictions.

  3. Select the functions you’d like to restrict. Device users receive a notification when the restrictions are applied.

    • Deny camera access
    • Degrade performance
      • Weak: The device’s performance degrades within an hour and will reboot every two hours.
      • Strong: The device’s performance degrades within 30 minutes and will reboot every hour.
  4. Click APPLY.

Remove function restrictions

To remove function restrictions for select devices:

  1. On the Devices page, select one or more devices.

  2. Click ACTIONS > Manage policy > Remove function restrictions.

  3. On the Remove function restrictions pop-up, click REMOVE.

Apply or remove function restrictions in bulk

You can select devices in bulk by entering their IMEIs or serial numbers into a standardized template. The maximum number of devices you can select in one action is 10,000.

To apply or remove function restrictions for devices in bulk:

  1. Select BULK ACTIONS in the bottom of the left navigation pane.

  2. To download a standard template, click Download CSV template.

    For more information on how to create a properly formatted CSV file for bulk device acceptance, select Instructions for all bulk actions from the bottom left-hand side of the Bulk actions screen.

  3. In the ADVANCED CONTROLS section of the Bulk actions screen, click MANAGE FUNCTION RESTRICTIONS.

  4. On the Manage function restrictions page, select one of the following and upload your CSV file containing the device IDs:

    • Apply function restrictions — Refer to the Apply function restrictions section to configure your restriction settings.
    • Remove function restrictions
  5. Click SAVE.

Is this page helpful?