Apply or remove function restrictions
Last updated January 28th, 2026
To use this feature, you must be enrolled in the Device Financing domain and have a Knox Guard Advanced license.
If you want to restrict the functionality of your devices (for example, deny camera access or force the device to continuously reboot), you can apply a function restriction policy from the Devices page.
Function restrictions can only be applied to devices with hardened security architecture.
Apply function restrictions

To apply function restrictions to a select device:
-
On the Devices page, select one or more devices.
-
Click ACTIONS > Manage policy > Apply function restrictions.
-
Select the functions you’d like to restrict. Device users receive a notification when the restrictions are applied.
- Deny camera access
- Degrade performance
- Weak: The device’s performance degrades within an hour and will reboot every two hours.
- Strong: The device’s performance degrades within 30 minutes and will reboot every hour.
-
Click APPLY.
Remove function restrictions
To remove function restrictions for select devices:
-
On the Devices page, select one or more devices.
-
Click ACTIONS > Manage policy > Remove function restrictions.
-
On the Remove function restrictions pop-up, click REMOVE.
Apply or remove function restrictions in bulk
You can select devices in bulk by entering their IMEIs or serial numbers into a standardized template. The maximum number of devices you can select in one action is 10,000.
To apply or remove function restrictions for devices in bulk:
-
Select BULK ACTIONS in the bottom of the left navigation pane.
-
To download a standard template, click Download CSV template.
For more information on how to create a properly formatted CSV file for bulk device acceptance, select Instructions for all bulk actions from the bottom left-hand side of the Bulk actions screen.
-
In the ADVANCED CONTROLS section of the Bulk actions screen, click MANAGE FUNCTION RESTRICTIONS.
-
On the Manage function restrictions page, select one of the following and upload your CSV file containing the device IDs:
- Apply function restrictions — Refer to the Apply function restrictions section to configure your restriction settings.
- Remove function restrictions
-
Click SAVE.
On this page
Is this page helpful?