How to restrict a user from sharing or accessing device data to prevent security breaches

Environment

• Knox Manage
• Android Enterprise
• Fully managed devices

Overview

This article provides information on how to restrict a user from sharing or accessing device data. This information can be helpful to address a variety of security concerns, for example:

• Users sharing device data via various apps.
• Stolen or lost devices with sensitive information on SD cards.
• Users attempting to export data through printing.

How can I restrict the access and sharing of device data?

There are multiple ways a user can share device data to a PC or other devices. You can restrict a user and secure the device so others can’t access or read stolen data.

To restrict a user from accessing or sharing device data:

1. On the Knox Manage console, go to Profile and select the profile policy you’d like to modify.

2. In the Android Enterprise policy drawer, you can apply the following policies:

   Group	Setting	Value	Purpose
   System	Set Encryption for Device Storage	Apply	If the device is stolen, encrypt the external SD card to make its data inaccessible if inserted in another device.
   	Storage Encryption	External SD Card
   Connectivity	Use Printer	Disallow	Prevent users from printing any content. For example, PDF files, Word documents, images, etc.
   Connectivity	Send and Receive Files through Bluetooth	Disallow	Prevent data sharing to other devices through Bluetooth.
   Connectivity	Use Wi-Fi	Allow	Prevent data sharing to other devices through Wi-Fi Direct.
   	Wi-Fi Direct	Disallow
   Connectivity	Transfer files through USB	Disallow	Prevent users from connecting the device to a PC to access storage if the device is stolen.

3. In the Samsung Knox (Android Enterprise) policy drawer, you can apply the following policies:

   Group	Setting	Value	Purpose
   System	Share via Apps	Disallow	Prevent users from using the Share via feature in any app.
   DeX	DeX Mode	Disallow	Prevent users from sharing and controlling the enrolled device through DeX.

Additional information

To learn more about Knox Manage policies, see Configure profile policies by device platform.