Apps on EMM-managed devices are configured within the profiles!
Application Minimize Delete
Package name
com.google.android.youtube Select application
Package name of the application
Install type
Pre install
The way the installation is performed.
Show more installation types
hide
Klicken für dauerhafte Anzeige
Pre install
The app is installed automatically, but can be removed by the user.
Force install
The app is installed automatically and cannot be deleted by the user.
Block
The app is blocked and cannot be installed. If the app was installed using an old profile, it will be uninstalled.
Available
The app is ready for installation.
Required for setup
The app is installed automatically, cannot be deleted by the user, and prevents the device from being set up until the app is installed.
Kiosk
The app is automatically installed in kiosk mode: it is set as the prefered home intention and set to white list for lock-task mode. The device setup will not be completed until after the app has been installed. After installation, users can only use this app, which starts automatically and can no longer be removed. You can only set this installType for one application per policy. If this is present in the policy, the status bar is automatically disabled.
Default permission policy
Prompt
The default policy for all permissions requested by the app. If set, overrides the default policy-level permission policy that applies to all apps. It does not override the global permission grant, which applies to all apps.
View more default authorization policy
hide
Klicken für dauerhafte Anzeige
Not specified (Only apps with credential provider policy)
Policy not specified. If no policy is specified for a permission at any level, 'Prompt' is used by default.
Prompt
Prompts the user to grant an authorization.
Grant
Grant authorization automatically
Deny
Deny authorization automatically
Permissions
Add permission
Grants explicit permission or denial for the app. These values override the default permission policy and global permission restrictions that apply to all apps.
Permission Minimize Delete
Permission
The Android permission or group, for example android.permission.READ_CALENDAR or android.permission_group.CALENDAR.
Policy
Not specified (Only apps with credential provider policy)
The policy for granting authorization.
List of all setting options for »Policy«
hide
Klicken für dauerhafte Anzeige
Not specified (Only apps with credential provider policy)
Policy not specified. If no policy is specified for a permission at any level, 'Prompt' is used by default.
Prompt
Prompt the user to grant permission.
Grant
Grant permission automatically
Deny
Deny permission automatically
Managed Configuration Type
None
Select which configuration type to use
A detailed description of the selected configuration type is provided here:
List of all setting options for »Managed Configuration Type«
hide
Klicken für dauerhafte Anzeige
None
No managed configuration is required for the app
Managed Configuration (Recommended)
A managed configuration is used for the app
Managed Configuration Template
Calls up a template from the app manufacturer in which various parameters can be transferred to the app, depending on what the manufacturer specifies. These can be fixed parameters and variables in email apps:
Deactivated
Whether the app is disabled. When deactivated, the app data is still retained.
Minimum version code
0
The minimum version of the app that will run on the device.
If set, the device will attempt to update the app to at least this version code. If the app is not up to date, the device contains a non-compliance detail with the non-compliance reason APP_NOT_UPDATED. The app must already be published in Google Play with a version code equal or greater than this value. A maximum of 20 apps can set a minimum version code per policy.
Delegate areas
The permissions selected here are delegated to the app by the Device Policy Controller.
Show permissions
hide
Klicken für dauerhafte Anzeige
Not specified (Only apps with credential provider policy)
No delegation area specified.
Certificate installation
Provides access to the installation and management of certificates.
Managed configurations
Provides access to the management of managed configurations.
Block uninstall
Gives access to blocking the uninstallation.
Grant permission
Provides access to the permission policy and permission status.
Packet access
Gives access to the packet access status.
Enable system apps
Grants access to activate system apps.
Accessible Track IDs
List of track IDs of the app that an enterprise device can access. If the list contains multiple track IDs, devices get the latest version among all accessible tracks. If the list does not contain any track IDs, devices have access only to the production track of the app.
Connected Work & Personal App
Not specified (Only apps with credential provider policy)
Controls whether the app can communicate with itself through a device's work and personal profiles with the user's permission.
List of all setting options for »Connected Work & Personal App«
hide
Klicken für dauerhafte Anzeige
Not specified (Only apps with credential provider policy)
Not allowed by default
Not allowed
Default. Prevents cross-profile communication of the app.
Allowed
Allows the app to communicate across profiles after receiving the user's consent.
Credential Provider
Login Provider - Use Default Policy
This app can be used (e.g., as a password manager)
List of all configuration options for »Login Provider - Default Policy«
hide
Klicken für dauerhafte Anzeige
Login Provider - Use Default Policy
The default login provider policy ( see below) determines, whether this app can be used as the default login provider.
This app is allowed to act as a login provider
This app can function as a login provider regardless of global app settings.
Play Store Mode
This mode controls which apps are available to the user in the Play Store. It also determines how the device behaves when apps are removed from the policy. This allows for targeted management and control of available applications and user interactions with the Play Store.
List of all setting options for »Play Store Mode«
hide
Klicken für dauerhafte Anzeige
Not specified (Only apps with credential provider policy)
Not specifie, defaults to Allowlist
Allowlist
Only apps included in the policy are available. Any apps not listed in the policy are automatically uninstalled from the device.
Blocklist
All apps are available. Any apps that should not be on the device must be explicitly marked as Blocked in the application policy.
Automatic App Updates
Always
The policy enforced on a device to automatically update apps depending on the network connection: Apps should also be updated on devices that rarely or never return to a wireless network. The volume of data usually has little effect with standard volume tariffs.
Listing of all setting options for »Automatic App Updates«
hide
Klicken für dauerhafte Anzeige
Not specified (Only apps with credential provider policy)
The auto-update policy is not set. Corresponds with the user selection.
User selection
The user can control the automatic updates.
Never
Apps are never updated automatically
Via WLAN only
Apps are only updated automatically via WLAN.
Always
Apps are updated automatically at any time. Data charges may apply.
Disable app installation
This policy specifies whether the installation of new applications on a device is disabled
When enabled, it prevents users or other processes from installing additional apps, which helps to enhance security and control over the installed software
notempty
If activated , no installations or Updates are possible. Also not via the portal!
Disable uninstalling apps
This policy specifies whether the uninstallation of existing applications on a device is disabled
Preventing uninstallation ensures that important and necessary apps are not removed accidentally or intentionally, which contributes to the stability and security of the system
Global default authorization policy
Not specified (prompt)
The standard authorisation policy sets out how runtime authorisation requests for all apps are handled by default
This covers the approval or rejection of permissions requested by apps whilst they are in use, and is intended to standardise and simplify permission management
List of all setting options for »Global default authorization policy«
hide
Klicken für dauerhafte Anzeige
Not specified (prompt)
Policy not specified. If no policy is specified for a permission at any level, 'Prompt' is used by default.
Prompt
Prompt the user to grant permission.
Grant
Grant authorization automatically
Deny
Deny correction automatically
Global permission granting
Add permission
Explicit permission or group grant or deny for all apps
These values override the Default permission policy
Permission Minimize Delete
Permission
The Android permission or group, for example android.permission.READ_CALENDAR or android.permission_group.CALENDAR.
Policy
Not specified (Only apps with credential provider policy)
The policy for granting authorization.
List of all setting options for »Policy«
hide
Klicken für dauerhafte Anzeige
Not specified (Only apps with credential provider policy)
Policy not specified. If no policy is specified for a permission at any level, 'Prompt' is used by default.
Prompt
Prompt the user to grant permission.
Grant
Grant permission automatically
Deny
Deny permission automatically
notempty
Moved here from Restrictions in v2.18.0
Allowed Input Methods Policy
Allow only selected input methods
If present, only the input methods provided by packages in this list are allowed
If this field is present but the list is empty, only system input methods are allowed
This option restricts the use of keyboards and other input methods to a predefined list to increase security and control over data processing and input
This allows the permitted and prohibited input methods to be defined individually for each application
Show all options
hide
Klicken für dauerhafte Anzeige
Allow all input methods
All input methods are explicitly allowed and can be enabled
Not specified (all allowed)
The policy is not sent to the device. The Google default applies, allowing all input methods to be used
Allow only selected input methods
Only the selected package names may be enabled as input methods. An empty list blocks all input methods except those pre-installed by the OEM
Allowed Input Methods Visible when "selected input methods" is selected
Add package names
Package names of the apps selected above can be added to allow them to function as input methods
Allowed Accessibility Services Policy
Allow only selected accessibility services
Specifies which apps can use accessibility services on the device. Since these services have extended access to screen content and device functions, only trusted apps should be allowed
This setting helps control and monitor the use of accessibility services to ensure system security and integrity while supporting accessibility for users
This allows permitted and prohibited accessibility services to be defined individually for each application
Show all options
hide
Klicken für dauerhafte Anzeige
Allow all accessibility services
All accessibility services are explicitly allowed. Any installed accessibility services can be enabled
Not specified (all allowed)
The policy is not sent to the device. The Google default applies, allowing all accessibility services to be used
Allow only selected accessibility services
Only the selected package names may be enabled as accessibility services. An empty list blocks all services except those pre-installed by the OEM
Allowed Accessibility Services Visible when "selected accessibility services" is selected
Add package names
Add package names of the apps selected above to allow them to function as accessibility services.
Default Credential Provider Policy
Not specified (Only apps with a login provider policy)
This feature determines whether an app on Android 14 and above is allowed to function as a login provider for managing login credentials. If it is relevant for apps that handle authentication or login data, such as password managers or multi-factor authentication apps.
List of all configuration options for »Login Provider - Default Policy«
hide
Klicken für dauerhafte Anzeige
Not specified (Only apps with a login provider policy)
Not specified. Only apps that have explicitly defined a login provider policy.
Only apps with credential provider policy
Only apps that have specified a login provider policy.
Only apps that have declared a login provider policy or OEM default login providers
Only apps with a declared login provider policy or those pre-defined by the OEM as default login providers are allowed.
Allowed Credential Providers
notempty
New as of: 2.12
Add package names
Add package names of the apps selected above to allow them to function as credential providers. Apps prioritize this setting over the credential provider policy. This setting overrides the credential provider setting of individual apps.
Notes on using login providers
Option
Value
Description
Credential Provider
Credential Provider
This app can be used (e.g., as a password manager)
Use default credential provider policy
Select from the options below
Default Credential Provider Policy Only if the app itself does not act as a provider!
Not specified (Only apps with credential provider policy)
The app cannot be used
Only apps with credential provider policy
The app cannot be used
Only apps with a credential provider policy or OEM default credential providers are allowed
Both the selected app and apps classified by Google as credential providers can be used
Managed Configuration Type
Managed configuration
The configuration format depends on the ManagedProperty values supported by the app. Each field name in the managed configuration must match the key field of the managed property. The field value must be compatible with the type of the ManagedProperty.
For each configuration, a specific button is displayed:
Not Configured: This parameter is not yet configured
Configured: This parameter is configured
Caption
Value
Description
Email Address
Field that supports a specific email address or a placeholder ($emailaddress$)
EMMs use this field to retrieve user credentials from Active Directory
Hostname or Host
Full hostname for the ActiveSync server
e.g., hostname.company.com:443/path
The hostname can be accessed via an on-premises EMM proxy server, a virtual IP address (VIP) with load balancing in front of multiple ActiveSync servers, or directly via the public CAS (Client Access Server).
The specified host should not be a host that redirects
If no value is entered, port number 443 is used by default
Username
Field for the user's Active Directory username, which can be specified directly as a username or as a placeholder ($username$)
The username and email address of the user may differ
Device ID
Field containing the EAS (Exchange ActiveSync) device ID, used by some EMM gateways for device correlation.
This setting is ignored if left blank or if an Exchange account already exists in the managed profile
Authentication Types
Allow basic authentication Allow modern authentication
List of allowed authentication types Modern Authentication (allow_modern_authentication) and Basic Authentication (allow_basic_authentication)
If nothing is provided, both types are allowed
SSL Required
Enforces SSL communication for any port specified in the hostname
If enabled (default), SSL is activated.
This setting is ignored if port 443 is specified in the hostname
Trust All Certificates (Caution: For Testing Only)
Disables validation checks for SSL certificates used in communication between ActiveSync servers, proxy servers, or gateways and other email servers
Should only be enabled for self-signed certificates or testing purposes
The default setting is disabled, meaning validation checks are performed
In production, this value must always be set to disabled
If enabled, Gmail may be vulnerable to man-in-the-middle attacks, and communication with servers and proxy servers may not be secure
Alias for Login Certificate
Field for a certificate with a private key stored in the work profile's keystore by the EMM provider's DPC app, used for authentication with ActiveSync servers
Allow Unmanaged Accounts
Allows users to add or remove Exchange accounts not defined in this managed configuration
If enabled, users cannot be prevented from adding additional Exchange accounts to Gmail
There is also no control over data shared between other apps and user-added Exchange accounts
This setting should only be enabled if users need to manage multiple business Exchange accounts in Gmail
Default Email Signature
Field for the default email signature inserted at the end of all outgoing emails
Default Sync Window
3
A value between 0 and 5 representing the time window for synchronisation with the EAS (Exchange ActiveSync) server
The default setting is one week (value: 3)
0: no filter, all items are synchronised; 1: one day; 2: three days; 3: one week; 4: two weeks; 5: one month
Further information on synchronisation window settings can be found here
Managed Configuration Template
Caption
Value
Description
Managed Configuration Template
Manage configuration template
This field is ignored if the managed configuration is set. Calls up a template from the app manufacturer in which various parameters can be transferred to the app, depending on what the manufacturer specifies. These can be fixed parameters and variables in email apps:
Example for Gmail app:
Email Address
$emailaddress$
Variable
Hostname or Host
m.google.com
Fixed parameter
Example: Hostname of the mail server for Gmail accounts
Username
$emailaddress$
Variable (for Gmail accounts the username is the email address.) With other accounts / apps the variable $username$ can be used here.
notempty
New as of: 2.8
notempty
To ensure correct functionality, the Profile is a template button must be enabled in the General tab, and the users must be selected!
For more information, see the wiki article Android Configuration – General
Display variable overview
hide
Klicken für dauerhafte Anzeige
In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden
The values are taken from the user settings of the user to whom the respective device is assigned
Variable name in profiles
Description
Example
$username$
alternative names: %device_user% %device_user_username%
Username
jdoe
$emailaddress$
alternative name: %device_email%
Email address
jdoe@ttt-point.de
$firstname$
alternative name: %device_user_firstname%
First name
John
$lastname$
alternative name: %device_user_lastname%
Last name
Doe
$name$
alternative name: %device_user_name%
First name and surname
John Doe
$variable1$
alternative name: %variable1%
custom value
jdoe/ttt-point.local
$variable2$
alternative name: %variable2%
custom value
$variable3$
alternative name: %variable3%
custom value
$device_name$
alternative name: %device_name%
Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name)
This variable can also be used in iOS profiles in the Shared device section
Cell phone from Markus Müller
$device_alias$
alternative name: %device_alias%
Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed.
This variable can also be used in iOS profiles in the Shared device section
Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons.
A distinction between Android and iOS is no longer necessary.
