Android Enterprise policies

Allows the device user and apps to operate the camera.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user and apps to take screenshots.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user to factory reset the device.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to toggle developer mode.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows using a mock location for development or test purposes.

Android 12 and higher

Fully managed

Allows limiting background processes on the device.

Android 12 and higher

Fully managed

Allows closing all apps when the device user signs out of the device

Android 12 and higher

Fully managed

Allows use of the Safe Mode on the device.

Android 12 and higher

Fully managed

Determines the schedule for firmware updates on the device.

Values

• Automatically install updates when available (default). The device will perform firmware updates as soon as they become available.
• Postpone updates for 30 days after it becomes available. For each firmware update, the device will wait 30 days before applying it.

• Set a time period. The device will perform firmware updates during a specified period in the day. If set, you must also define the start and end of the period:

  • From. Specifies the start of the update period, in 24-hour time format.
  • To. Specifies the end of the update period, in 24-hour time format.

Additionally, you can schedule one or more freeze periods, which are stretches of time where the device won't apply any firmware updates, on top of whichever update setting you select. These periods will recur every year. You can configure as many freeze periods as you need.

• Start date. Specifies the month and day to begin the firmware freeze period.
• End date. Specifies the month and day to end the firmware freeze period.

Click ADD ANOTHER PERIOD to schedule an additional freeze period.

Android 12 and higher

Fully managed

Specifies start time and end time to install updates.

Android 12 and higher

Fully managed

Specifies dates on which to block installation of updates.

Android 12 and higher

Fully managed

Allows backup of device data.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to adjust the clock and current date.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to change the screen brightness setting.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to run the Android Easter egg game on the device.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to change the language.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the always on display feature that displays information on the lock screen.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to set a certificate.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user to expand the status bar.

Values

• Allow
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to power off the device.

If this policy is disallowed, the use cannot turn off the device and cannot perform factory reset. The device command from an administrator for factory reset is also blocked.

Android 12 and higher

Fully managed

Allows the device user to copy and paste with the clipboard between the personal and work areas.

Values

• Allow
• Don't allow

Android 12 and higher

Work profile

Work profile on company-owned device

Specifies a time period during which the device user is allowed to turn off the work profile. Set a period in days (three to 30 days) or hours (72 to 720 hours).

Android 12 and higher

Work profile

Work profile on company-owned device

Allows both the device user and apps to change the wallpaper.

Values

• Allow
• Don't allow

Android 12 and higher

Fully managed

Applies a custom wallpaper on the device.

Values

• Set for home and lock screen (default)
• Set for home screen only
• Set for Lock screen only

Android 12 and higher

Fully managed

Specifies a custom wallpaper to apply to the home screen. Only available if the Set custom wallpaper policy is set for both the home and lock screens.

Values

1. To add custom images, click Browse. The image file can be in BMP, GIF, ICO, JPG, JPEG, or PNG format and can't exceed 10 MB in size.
2. Select Portrait or Landscape to specify the display orientation.

Android 12 and higher

Fully managed

Specifies a custom wallpaper to apply to the lock screen. Only available if the Set custom wallpaper policy is set for both the home and lock screens.

Values

1. To add custom images, click Browse. The image file can be in BMP, GIF, ICO, JPG, JPEG, or PNG format and can't exceed 10 MB in size.
2. Select Portrait or Landscape to specify the display orientation.

Android 12 and higher

Fully managed

Specifies a custom wallpaper to apply to the home or lock screen. Only available if the Set custom wallpaper policy is set for home screen or lock screen.

Values

1. To add custom images, click Browse. The image file can be in BMP, GIF, ICO, JPG, JPEG, or PNG format and can't exceed 10 MB in size.
2. Select Portrait or Landscape to specify the display orientation.

Android 12 and higher

Fully managed

Allows display of notification messages on the device.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the display of notifications related to app crashes.

Values

• Allow
• Don't allow

Android 12 and higher

Fully managed

Allows display of custom messages on the device. A default message is displayed if you don't set a custom message.

Values

• Set custom short message. The short message shows in a dialog on the device.
• Set custom long message. The long message displays when device users view more details.

Android 12 and higher

Fully managed

Allows the display of notification messages on the device's lock screen.

Values

• Write message. The maximum length is 65 characters.

Android 12 and higher

Fully managed

Android 12 and higher

Work profile

Work profile on company-owned device

Allows the use of the device's microphone.

Values

• Allow (default)
• Don't allow

Allows recording with the microphone.

Values

• Allow (default)
• Don't allow

Allows the adjustment of volume

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Select at least one of the hardware keys below.

Values

• Home
• Back
• Volume up
• Volume down
• Power
• Camera
• Menu
• Search
• Task manager
• Bixby

Android 12 and higher

Fully managed

Allows the use of voice calls on non-Samsung devices.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows users to send text messages on non-Samsung devices.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows devices to receive emergency alerts from carriers.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows you to upload contact lists using a downloadable template.

Select BULK UPLOAD. On the page that opens, you can download a Microsoft Excel template or upload your contact list.

Android 12 and higher

Work profile

Work profile on company-owned device

Configures an animation to play when the device boots up.

Android 12 and higher

Fully managed

Upload the animation file to play while the device boots.

Upload the loop file to play while the device boots.

Upload the sound file to play while the device boots.

Configures an animation to play when the device shuts down.

Android 12 and higher

Fully managed

Upload the animation file to play while the device shuts down.

Upload the sound file to play while the device shuts down.

Select a measure to take when a compromised OS is detected.

Values

• Lock device (default) — Locks the device.
• Factory reset — Resets the user device but not the SD card.
• Factory reset and initialize SD Card — Factory resets the user device and the SD card.

Android 12 and higher

Fully managed

Enables factory reset protection. When this security measure is enabled, if the device undergoes a factory reset it can't be reactivated without the previous user's Google Account.

Values

• Allow — (default) Enables factory reset protection for all devices that use this profile.
• Don't Allow — Disables factory reset protection.

To enable factory reset protection:

1. Set the value to Allow.
2. For the Google users field, enter the email address of the Google Account that will protect devices using this profile. This account must be appropriate for use by support providers.

3. Use the people.get method from the Google People API to get your Google ID. You can use the Google API reference's in-built API explorer to call the API. In the request parameters set:
   • resourceName field — people/me
   • personalFields field — metadata
4. Execute the API request and copy the value of the ID field in the response.
5. Back on the Knox Manage console, paste the copied ID value in the Google User ID field.

If factory reset protection is configured to allow specific accounts, you may be required to verify those accounts by entering them on screen upon factory-resetting the device. This requirement depends on the device management type and the factory reset method you used:

• For fully managed devices, only factory reset actions performed using device commands from the Knox Manage console require account verification. The verification step is not triggered if the factory reset is initiated through device settings.
• For work profiles on company-owned devices, initiating a factory reset from both device commands and device settings triggers the account verification process.

Android 12 and higher

Work profile

Work profile on company-owned device

Email address and User ID of the Google Account that will protect the devices that use this profile.

Android 12 and higher

Fully managed

Specifies the encryption of the device's internal storage or the external SD card.

Values

Select the storage to encrypt.

• System storage
• External SD card

Android 8 to 10

Fully managed

Enables multifactor authentication (2FA) that unlocks a device only after two authentication methods are provided, including one lock screen method, such as PIN, password, or pattern, and fingerprint, and one biometric input, such as fingerprint or facial recognition.

Android 12 and higher

Fully managed

Enables factory reset protection, meaning that if the device undergoes a factory reset it can't be reactivated without the previous user's Google Account.

Values

• Allow --- (default) Enables factory reset protection for all devices that use this profile.
• Don't Allow --- Disables factory reset protection.

To enable factory reset protection:

1. Set the value to Allow.
2. For the Google users fields, enter the Google account ID of a current device user.

As the Google account ID might be shared with support providers, do not use your Google Account associated with Android Enterprise.

3. Use the people.get method from the Google People API to get your Google ID. You can use the Google API reference's API explorer to call the API. In the request parameters set:
   • resourceName field --- people/me
   • personalFields field --- metadata
4. Execute the API request and copy the value of the ID field in the response.
5. Back on the Knox Manage console, paste the copied ID value.

If factory reset protection is configured to allow specific accounts, you may be required to verify those accounts by entering them on screen upon factory-resetting the device. This requirement depends on the device management type and the factory reset method you used:

• For fully managed devices, only factory reset actions performed using device commands from the Knox Manage console require account verification. The verification step is not triggered if the factory reset is initiated through device settings.
• For work profiles on company-owned devices, initiating a factory reset from both device commands and device settings triggers the account verification process.

Android 12 and higher

Work profile on company-owned device

Sets the type of lock screen allowed on a device.

Values

• Set Default Lock Screen. Users must use the password you set to unlock their device.
• Set Custom Lock Screen. Users can set their own password according to the specifications you set.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Sets the default password users must use to unlock their devices. Only available if the Screen lock policies is set to Set Default Lock Screen.

Values

Enter a password between 4 and 10 characters. Only alphanumeric characters are allowed.

Android 12 and higher

Fully managed

Enforces the minimum complexity for the device's lock. There are three complexity levels, each pre-defined by the Android API. The device user must set a lock that meets or exceeds the minimum level.

You can enable this setting and the Set minimum strength at the same time. If you do so, this setting will apply to any assigned devices that are running Android 12 and higher, while Set minimum strength will apply to any devices running Android 8 to 11.

Only available if the Screen lock policies is set to Set Custom Lock Screen.

Values

• Low. The lock must be a pattern or PIN. Repeating (4444) and ordered (1234, 4321, 2468) sequences are allowed.
• Medium. The lock must be A PIN without repeating (4444) or ordered (1234, 4321, 2468) sequences. Or, it must be a password with 4 or more characters.
• High. The lock must be a PIN with 8 or more characters, without repeating (4444) or ordered (1234, 4321, 2468) sequences. Or, it must be a password with 6 or more characters.

Android 12 and higher

Fully managed

Enforces the minimum strength for the device's lock. Each strength level uses a lock type with minimum strength requirements. For PINs and passwords, you can further define the minimum length and complexity requirements across multiple parameters. The device user must set a lock that meets or exceeds the minimum strength.

The password strength increases in the following descending order of the available values, with Weak Biometric being the weakest, and Complex being the strongest.

You can enable this setting and the Set minimum complexity at the same time. If you do so, this setting will apply to any assigned devices that are running Android 8 to 11, while Set minimum complexity will apply to any devices running Android 12 and higher.

Only available if the Screen lock policies is set to Set Custom Lock Screen.

Values

• Weak Biometric. A biometric recognition method.
• Pattern. A pattern.

• Numeric. A PIN.

• Numeric Complex. A pin with no repeating (4444) or ordered (1234, 4321, 2468) sequences.
• Alphabetic. A password with letter characters.
• Alphanumeric. A password with alphanumeric characters.
• Complex. A password with alphanumeric and special characters.

Depending on the value selected above, you must also set the parameters of the password strength:

• Minimum length (default is 4 for most strengths, and 6 for Complex). Specifies the minimum allowed length of the PIN. This value can be between 4 and 16 for most strengths, but is between 6 and 16 for Complex.

  Required if the password strength is set to Numeric, Numeric Complex, Alphabetic, Alphanumeric, or Complex.

• Minimum letters (default is 4). Specifies the minimum number of letters that the password must have.

  Required if the password strength is set to Complex.

• Minimum non-letters (default is 2). Specifies the minimum number of numbers and special characters that the password must have.

  Required if the password strength is set to Complex.

• Minimum lowercase letters (default is 3). Specifies the minimum number of lowercase letters that the password must have.

  Required if the password strength is set to Complex.

• Minimum capital letters (default is 1). Specifies the minimum number of capital letters that the password must have.

  Required if the password strength is set to Complex.

• Minimum special characters (default is 1). Specifies the minimum number of special characters that the password must have.

  Required if the password strength is set to Complex.

• Maximum sequential numbers (default is 10). Specifies the maximum length that any sequence of repeated numbers (such as 4444) can be in the PIN. Leave as 1 to disallow repeated sequences entirely.

  Required if the password strength is set to Numeric, Numeric Complex, Alphabetic, Alphanumeric, or Complex.

  Only takes effect on Samsung devices secured by Knox.

• Maximum sequential characters (default is 10). Specifies the maximum length that any sequence of repeated letters (such as aaaa) can be in the PIN. Leave as 1 to disallow repeated sequences entirely.

  Required if the password strength is set to Alphabetic, Alphanumeric, or Complex.

  Only takes effect on Samsung devices secured by Knox.

Android 8 to 11

Fully managed

Specifies how long the lock will remain active before the device user must change it.

Only available if Set minimum complexity is turned on, or Set minimum strength is set to Pattern, Numeric, Numeric Complex, Alphabetic, Alphanumeric, or Complex.

Values

Enter the number of days, between 1 and 365. Default is 30.

You can also set:

• Notify users about expiring passwords (default off). Pushes a notification to the device that alerts the device user that the password will expire soon. Additionally, select how soon before expiration to send the notification:

  • 1 day before (default)
  • 3 day before
  • 5 day before
  • 7 day before

Android 12 and higher

Fully managed

Specifies how many times someone can fail to unlock the device in a row before the device takes action to protect itself.

Only available if Set minimum complexity is turned on, or Set minimum strength is set to Pattern, Numeric, Numeric Complex, Alphabetic, Alphanumeric, or Complex.

Values

Enter the number of failed unlock attempts are tolerated, between 1 and 10. Default is 1.

You can also set:

• Take action if attempts are exceeded (default off). Controls which action the device takes when the unlock attempt limit is reached. You can select from the following actions:

  • Lock device (default)
  • Factory reset + initialize SD card
  • Factory reset

Android 12 and higher

Fully managed

If the lock complexity is low or its strength is weak, specifies how long after the device is unlocked that it relocks.

Values

Enter the number of hours, between 1 and 72. Default is 1.

Android 12 and higher

Fully managed

Specifies the minimum number of new locks that must be registered before a user can reuse a previous lock.

Values

Enter the minimum number of locks, between 1 and 10. Default is 1.

Android 12 and higher

Fully managed

Specifies what happens if the device user sets a lock that violates the minimum complexity or strength requirements.

Values

• Lock device
• Do nothing (default)

Android 12 and higher

Fully managed

Choose which features to block when the screen is locked.

Values

• Trust agent
• Fingerprint (default)
• Iris (default)
• Face (default)
• Camera (default)
• Previews in pop-ups (default)
• Notification (default)

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specify whether to allow a device user to control the screen lock time setting.

Values

• Allow
• Don't allow

Android 12 and higher

Fully managed

Specifies the longest duration that the device user can set for automatic screen timeout and lock.

Values

• 15 sec
• 30 sec
• 1 min
• 2 min
• 5 min
• 10 min (default)

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Enter a description for the certificate.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specify where the certificate should be installed.

Values

• Device

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specify what category of certificate you want to use.

Values

• EMM management certificate. Register an external certificate on the Knox Manage server for each network setting, and then verify each network setting using that certificate. All users share the same certificate.
• > Root
• > User
• Issuing external CA. Register a certificate obtained from an external certificate authority to Advanced > Certificate > Certificate Template. Then, you register a certificate template for each network setting, and verify it as a user certificate.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Add apps to grant them silent privileged access to use the certificate while running.

Values

Click SELECT APPS > select an app > CONFIRM.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows tethering.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to transfer files between the device and other devices through USB. Charging through the USB connector isn't affected.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device user to mount storage media connected through the SD card slot.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Controls Bluetooth availability.

Values

• Allow (default). The device user can turn Bluetooth on and off.
• Force off

Android 12 and higher

Fully managed

Allows a PC to connect with the user's device using Bluetooth.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the device to search for Bluetooth devices..

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows Bluetooth sharing.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows device users to control Bluetooth settings on their device.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Controls Wi-Fi availability.

Values

• Allow (default). The device user can turn Wi-Fi on and off.
• Force on
• Force off

Android 12 and higher

Fully managed

Controls the use of Wi-Fi Direct connection for Samsung devices.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the use of airplane mode.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the use of VPN on a device.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows the selected VPN app to always run on the device. To ensure the policy can't be modified by the device user, set the Use VPN policy to Don't allow.

Android 12 and higher

Fully managed

Allows the device to send print commands to connected printers.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows device users to reset network usage.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows device users to configure the mobile network settings.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows transfer of data using NFC.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Allows a cellular data connection while using roaming service.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Enables 5G network slicing, which lets you allocate a single 5G connection as multiple distinct virtual connections.

Values

• Allow --- Allows 5G slicing for the device.
• Allow per app --- Lets you allocate slices for specific apps.
  • Allow certain apps to connect to 5G network slices --- Select apps to allow.
  • Block certain apps from connecting to 5G network slices --- Select apps to block.
• Don't allow --- Prevents 5G slicing for the entire device.

This policy has been verified for standalone mode (SA) for 5G slicing. The carrier must support 5G slicing by enterprises.

Android 12 and higher

Fully managed

Allows the user to change the Wi-Fi settings.

Android 12 and higher

Fully managed

Creates a SSID allowlist and blocklist.

Values

• Allowlist --- Devices can only connect to the Wi-Fi APs added.
• Blocklist --- Device can't connect to the Wi-Fi APs added.

Android 12 and higher

Fully managed

Allows the device user to share contacts to the connected device using Bluetooth. Before you use this policy, set the Send and receive files through Bluetooth policy to Allow.

Work profile

Work profile on company-owned device

Allows the device user to enable USB debugging.

Work profile

Work profile on company-owned device

Determines the name of the policy.

Values

Enter a unique name for the policy. The name must:

• Be at least 3 characters long
• Contain only ASCII alphanumeric characters, and underscores (_)
• Not contain a space at the start or the end

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Determines the name of the policy.

Values

Enter a name.

So that Knox Manage can correctly process and store the name, it must:

• Be between 3 and 50 characters long
• Contain only ASCII alphanumeric characters, and underscores (_)
• Not contain a space at the start or the end

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specifies a description for the policy that is displayed on the Knox Manage console.

Values

Enter a description up to 1,000 characters long.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

The security protocol of the Wi-Fi network. This value must match the actual security protocol that the network uses.

Values

• None
• WPA/WPA2-PSK (default)
• 802.1xEAP

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

The password of the Wi-Fi network. This value must match the actual password that the network uses.

Only available if Security type is set to WPA/WPA2-PSK.

Values

Enter the password.

So that Knox Manage can correctly process and store the password, it must:

• Be between 8 and 30 characters long
• Contain at least one ASCII letter
• Not contain spaces

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

The Wi-Fi network's proxy. This value must match the actual proxy settings that the network uses.

Values

• None (default).

• Manual. The proxy settings are determined individually.

  • Proxy host name. The name of the proxy server.

    So that Knox Manage can correctly process and store the host name, it must:

    • Contain ASCII alphanumeric characters, colons (:), periods (.), dashes (-), underscores (_), and forward slashes (/).
  • Proxy port. The port of the proxy server. Must be a number between 1 and 5 digits long.

  • Proxy exception. A URL that isn't routed through the proxy.

    So that Knox Manage can correctly process and store the host name, it must:

    • Contain ASCII alphanumeric characters, colons (:), periods (.), dashes (-), and forward slashes (/).

    Click ADD ANOTHER EXCEPTION to create extra exceptions.

• Proxy automatic configuration. The proxy settings are loaded by an external file.

  • PAC Web address. The URL where the proxy auto-config (PAC) file is stored.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Assigns extra settings that control how the device interacts with the Wi-Fi network.

Values

• Automatically connect to Wi-Fi (default off). If in range of the network, the device will connect to it.
• Allow user to remove network from Knox Manage agent configuration (default on). Allows the user to remove the Wi-Fi policy from the Knox Manage agent. This setting has no effect on the network's entry Android Wi-Fi manager.
• Hide Wi-Fi (SSID) (default off). Hides the the network from the Android Wi-Fi manager. This setting has no effect on the Wi-Fi policy in the Knox Manage agent.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specifies the description of the APN policy.

Android 12 and higher

Fully managed

Specifies the name of the APN policy. Each configuration name must be unique.

Android 12 and higher

Fully managed

Specifies which connection services to allow for this APN policy.

Values

• Default — Allows all services.
• MMS — (Multimedia Messaging Service).
• Supl — (Secure User Plane Location service).
• DUN — (Dial-Up Networking)
• HIPRI — (High Priority).
• FOTA — (Firmware Over-The-Air).
• IMS — (IP Multimedia Subsystem).
• CBS — (Cell Broadcast Service).
• IA — (Internet Access).
• EMERGENCY — (Emergency Access).
• MCX — (Mission Critical Services).
• XCAP — (XML Configuration Access Protocol).
• BIP — (Binary Object Store Access).
• VSIM — (Virtual SIM).
• ENTERPRISE — (Enterprise Access).
• RCS — (Rich Communication Services).

Android 12 and higher

Fully managed

Specifies the MCC of the APN.

Values

Enter a 3-digit MCC. Click INSERT LOOKUP to browse and select available lookup items to include in the MCC.

Android 12 and higher

Fully managed

Specifies the carrier's MNC for the APN.

Values

Enter a 2 or 3-digit MNC.

Click INSERT LOOKUP to browse and select available lookup items to include in the MNC.

Android 12 and higher

Fully managed

Specifies the address of the carrier's MMS server.

Values

Enter a URL.

Android 12 and higher

Fully managed

Specifies the address of the carrier's MMS proxy server.

Values

Enter an IP or domain.

Android 12 and higher

Fully managed

Specifies the port of the carrier's MMS proxy server.

Values

Enter a port.

Android 12 and higher

Fully managed

Specifies the address of the carrier's WAN proxy server.

Values

Enter a URL.

Android 12 and higher

Fully managed

Specifies the port of the carrier's WAN proxy server.

Values

Enter a port.

Android 12 and higher

Fully managed

Specifies the account username to use when connecting to the APN.

Values

Enter a username. By default, the field contains the ${UserName} lookup item, which substitutes for the username associated with the device in Knox Manage.

Android 12 and higher

Fully managed

Specifies the account password to use when connecting to the APN.

Values

Enter a password.

Android 12 and higher

Fully managed

Specifies the protocol to use when authenticating with the APN.

Values

• None — Disables authentication.
• PAP — Uses the Password Authentication Protocol (PAP), which requires a username and password.
• CHAP — Uses the Challenge-Handshake Authentication Protocol (CHAP), which implements challenge messages to validate identities.
• PAP or CHAP — Uses either the PAP or CHAP method, depending on which is available.

Android 12 and higher

Fully managed

Specifies the communications protocol to use when connecting to the APN.

Values

• None
• IPV4
• IPV6
• IPV4/IPV6
• PPP

Android 12 and higher

Fully managed

Specifies the communications protocol to use when connecting to the APN while the device is roaming.

Values

• IPV4
• IPV6
• IPV4/IPV6
• PPP

Android 12 and higher

Fully managed

Specifies the type of identifier used by the APN's mobile virtual network operator (MVNO).

Values

• None
• SPN
• IMSI
• GID
• ICCID

Android 12 and higher

Fully managed

Specifies which wireless broadcast standards can be used when connecting to the APN.

Values

• LTE
• HSPAP
• HSPA
• HSUPA
• HSDPA
• UMTS
• EDGE
• GPRS
• eHRPD
• NR
• EVDO_B
• EVDO_A
• EVDO_0
• 1xRTT
• CDMA
• TD_SCDMA
• IDEN
• GSM
• IWLAN

Android 12 and higher

Fully managed

Allows a device user to delete APN settings.

Values

• None
• Allow
• Disallow

Android 12 and higher

Fully managed

Controls the services that track the device's physical location.

Values

• Allow user to configure (default). Allows the device user to toggle location services.

• Allow user to configure and prompt for location accuracy. Turns on high-precision tracking for location services.

  When turned on, every app that requires location permissions asks the device user to choose a preferred precision.

• Force on. Requires Android 12 and higher.
• Force off

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specifies if collection of data requires user consent.

Values

• Automatic (default)
• Upon user consent

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specifies the time period after which location data must be collected.

Values

• 30 minutes (default)
• 1 hour
• 2 hours
• 4 hours
• 12 hours
• 24 hours

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user to install Android apps from untrusted sources. This setting doesn't apply to apps on Google Play.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specifies a list of apps that can't be installed on the device.

If an app is already installed, it's automatically uninstalled from the device once hidden.

Values

Select one or more apps from the app library.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Determines if device users can modify app settings.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user to uninstall apps.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user to install apps.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specify whether to allow the setting of app runtime permissions in all areas.

The admin can grant or deny app runtime permissions without a user's intervention.

Values

• Grant(default). Allows all apps to run on a device.
• Deny. Blocks all apps from running on a device.
• Prompt. Device users are required to grant permission to apps to run.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows device users to skip the tutorials available for apps.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specify apps with delegation scope enabled. Each configuration targets an app with a profile in the Knox Manage tenant and assigns scopes to it. You can only manage one delegation configuration per app.

Click Set App Delegation, then select an app and click NEXT.

On the App delegation scope page, select one or more of the below delegation scopes:

1. Managed configurations management
2. Blocking uninstallation
3. Enabling system apps
4. Install existing packages
5. Management of uninstalled packages
6. Package access state
7. Permission policy and permission grant state
8. Cerificate installation and management
9. Selection of key chain certificates
10. Network logging
11. Security logging

Once you select your delegation scopes, click either SET DELEGATION SCOPE or CONFIRM AND SET ANOTHER to confirm the configuration and set another one.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Blocks a component, such as an activity, receiver, service, or provider, from running on a selected app. See the Android developer guide to learn more about components. Select an app or apps, then enter components to block on it.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specify whether selected apps can communicate with themselves across the work profile and personal profile, subject to user consent.

Android 12 and higher

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Specify measures to take if integrity check fails during enrollment.

• Admin Alert — Sends an alert to the administrator.
• Unenrollment (Factory Reset) (for DO only) — Unenrolls the device and performs a factory reset.

Android 12 and higher

Fully managed

Specify measures to take if integrity check fails after enrollment.

• Admin Alert — Sends an alert to the administrator.
• Lock device — Locks the device.
• Unenrollment ( Factory Reset ) — Unenrolls the device and performs a factory reset.

Android 12 and higher

Fully managed

Allows app verification using Google Play Protect.

Values

• Allow (default)
• Force on

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Determines whether the Knox Browser app automatically updates. If enabled, the browser also updates when the profile is pushed to the device.

Values

• Allow — Enables automatic Knox Browser updates.
• Don't allow — Disables automatic Knox Browser updates.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specify whether the Knox Browser restricts access to URLs as an allowlist or blocklist.

Values

• Allowlist — Knox Browser only allows access to listed URLs.
• Blocklist — Knox Browser blocks access to listed URLs.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Hides the address bar.

Values

• Allow — Hides the address bar. Prevents access to websites other than the default Homepage URL, and blocks file downloads.
• Don't allow (default) — Displays the URL address bar.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Enables URLs with web intents, which, when opened, can download and launch apps on Android. Knox Browser supports intent schemes like the following:

• intent://... — Launches the app package specified in the URL scheme.
• market://... — Downloads the specified app package from Managed Google Play.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Enables file downloads on Knox Browser.

Values

• Allow (default)
• Don't allow Blocks downloads. If you set the Hide URL policy to Allow, file downloads are blocked automatically.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user to take screenshots of web pages on Knox Browser.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user to upload files to web pages on Knox Browser.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows cookies in the Android browser.

If cookies are not allowed, you can't access websites that authenticate users with cookies.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Allows the device user to copy text from web pages viewed on Knox Browser.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Forces changing the text size on web pages on Knox Browser.

Values

• Allow — Adjusts the text size to the scale set by the Text Scaling > Ratio policy.
• Don't allow — The text size defaults to 100%, and the user can't change it.

If this value is unset, then the text size defaults to 100%, and the device user can change it.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Forces changing the zoom level of web pages on Knox Browser.

Values

• Allow (default) — Adjusts the zoom level to the scale set by the Force Enable Zoom > Ratio policy.
• Don't allow — The zoom level defaults to 100%, and the user can't change it.

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Allows auto-completion of information that you enter on websites in the Android browser.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Android 12 and higher

Fully managed

Android 12 and higher

Fully managed

Android 12 and higher

Fully managed

Sets the kiosk mode for devices.

Values

• Multi-app mode. Allows you to customize multiple apps and widgets for your device with the kiosk builder. Click START BUILDING to open the kiosk builder.
• Single-app mode. Specifies the app you want to lock the device down to. Click SELECT APP to choose an app.
• Web mode. Sets a URL that device opens on launch.
• Kiosk package name. This value is fixed at com.sds.emm.singleweb — Knox Browser — and can't be changed.
• Default URL. Enter a URL.

Android 12 and higher

Fully managed

Specifies the home page of the Kiosk Browser (web mode only).

Values

Enter a fully-formed URL.

You can insert lookup codes for string substitution.

Android 12 and higher

Fully managed

Controls settings related to core kiosk behavior. Available settings may depend on the kiosk mode set.

Values

• Hide info icon (default off). Hides the info button in the interface, which normally lets the device user exit kiosk mode and view the license. If the button is hidden and the device isn't connected to a network, the device can't exit kiosk mode.
• Automatic app updates (default off, web mode only). Controls whether apps can automatically update.
• File uploads (default off, web mode only). Allows the device user to upload files through Kiosk Browser.
• Copy text (default off, web mode only). Allows the device user to copy text in Kiosk Browser.

• Session timeout (default off, web mode only). Controls if the kiosk session terminates following user inactivity for a specific number of seconds. If this setting is selected, the default timeout period is 1800 seconds. Cookies and other session information are automatically deleted, and Kiosk Browser redirects to the default URL.

  • Screen saver. Allows you to set a screen saver to display while the device is charging and upon session timeout.
  • Images (up to 10 images, max 5 MB per image). Specifies the images to use as a screen saver. PNG, JPG, JPEG, and non-animated GIF file formats are supported.
  • Video (max 50 MB). Specifies the video to use as a screen saver. MP4 and MKV file formats are supported.
• Screen saver (multi-app and single-app mode only) — Set a screen saver to display when the device is being charged and when the session times out.
  • Images (up to 10 images, max 5 MB per image). Specifies the images to use as a screen saver. PNG, JPG, JPEG, and non-animated GIF file formats are supported.
  • Video (max 50 MB). Specifies the video to use as a screen saver. MP4 and MKV file formats are supported.
• Run JavaScript (default on, web mode only). Controls whether Kiosk Browser can run JavaScript on web pages.
• Exit Kiosk mode attempt limit (default off). Prevents exiting Kiosk mode following a maximum number of invalid attempts. If this setting is selected, the default maximum is five attempts.
  • Take action if attempts are exceeded (default off). Lets you prevent the user from re-entering a kiosk mode exit code for a certain period of time upon exceeding the maximum number of invalid attempts. Options are:
    • Prevent re-entering code for 10 min (default)
    • Prevent re-entering code for 30 min

Android 12 and higher

Fully managed

Multi-app mode — fully managed: Android 12 and higher

Single-app mode — fully managed Samsung devices: Android 12 and higher

Single-app mode — fully managed non-Samsung devices: Android 12 and higher

Controls settings related to OS behavior in the kiosk.

Values

• System status bar (default off). Enables the system status bar.
• Notification bar (default off). Enables notifications.
• Power off (default off). Enables the power off button.
• Home button (default off). Enables the home button.
• Recent apps (default off). Enables the recent app button, also known as the Recents button.
• Keyguard (default off). Allows the Lock screen policy to apply to the device. If turned off, the device doesn't won't be protected by a lock screen, and the device user can access the device without first unlocking it.

Android 12 and higher

Fully managed

Allow users to access the following settings while in kiosk mode (multi-app and single-app mode only).

Values

• Wi-Fi
• NFC
• Device maintenance
• Google account setup
• Flashlight
• Location
• Lockscreen
• Mobile networks
• Blue light
• Smart view
• Bluetooth
• Mobile data
• Hotspot
• Time zone
• Accessibility
• Display
• Sound
• Airplane mode
• Language

Multi-app mode — fully managed: Android 12 and higher

Single-app mode — fully managed Samsung devices: Android 12 and higher

Single-app mode — fully managed non-Samsung devices: Android 12 and higher

Allows control of advanced settings while in kiosk mode.

Values

• Delete Kiosk app when policy is removed
• Turn screen on when plugged in
  • AC charger
  • USB charger
  • Wireless charger
• Use HTTP Proxy (web mode only)

Multi-app mode — fully managed: Android 12 and higher

Single-app mode — fully managed Samsung devices: Android 12 and higher

Single-app mode — fully managed non-Samsung devices: Android 12 and higher

Web mode — fully managed: Android 12 and higher

Allows device users to add or delete accounts.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Specifies a list of apps to allow or block on devices.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Specifies the account types to allow or block on devices.

Values

Enter account types

Android 12 and higher

Fully managed

Specifies the accounts to allow on devices.

Values

• Allow all (default)
• Allow only Managed Google Play account
• Allow Managed Google Play and selected accounts

Android 12 and higher

Fully managed

Specifies the accounts to allow when you select Allow Managed Google Play and selected accounts option in the Select accounts to allow in Google Play setting.

Values

Enter account types

Android 12 and higher

Fully managed

Specifies if deletion of users is allowed.

Values

• Allow (default)
• Don't allow

Android 12 and higher

Fully managed

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device

Android 12 and higher

Fully managed

Work profile

Work profile on company-owned device