Android configuration restrictions

---

Android profile configuration in the Restrictions menu item

New article with version: 1.28

notempty

This article refers to a Resellerpreview

-

Access: portal.securepoint.cloud  Mobile Security Android  Profiles / Tab Restrictions

---

Restrictions Restrictions
Caption	Value	Description	Restrictions within an Enterprise Profile
Support Messages
Short support message	Deactivated by the IT department of ttt-Point AG	A message that is displayed to the user on the settings screen when the functionality has been disabled by the administrator. The maximum message length is 4096 characters. Abb. Supportnachricht Short support message. Change to long support message with Learn more Long support message
Long support message	Deactivated by the IT department of ttt-Point AG due to general security precautions. If you have any questions, please contact Support at: +49 4131-2401-0	A message displayed to the user. The maximum message length is 4096 characters. See figure above.
Permitted input methods	Add package name	If available, only the input methods provided by packages in this list are allowed. If this field exists, but the list is empty, only system input methods are allowed.
Approved input support services	Add package name	Specifies the allowed input accessibility services. If the field is not set, any input accessibility service can be used. When the field is set, only the input assistance services included in this list and the input assistance services integrated in the system can be used. In particular, if the field is empty, only the system's built-in input accessibility services can be used.
Accounts to unlock after factory reset	it-intern@anyideas.de	Factory Reset Protection (FRP). Email addresses of device administrators to protect against resetting to factory defaults. When the device is reset to factory defaults, one of these administrators must log in with the Google Account email address and password to unlock the device. If no administrators are specified, the device provides no protection against resetting to factory defaults.
Location mode	Unspecified	Der Grad der Standorterkennung ist aktiviert. Der Benutzer kann den Wert ändern, es sei denn, der Benutzer kann nicht auf Geräteeinstellungen zugreifen.
	List of all possible settings for »Location mode« Unspecified The current device value is not changed. The user can change the value unless the user cannot access device settings. User choice The location setting is not restricted on the device. No specific behavior is set or enforced. Forced Activates the location setting on the device Disabled Disables the location setting on the device
Disable screen capture		In order to provide data protection, it should not be possible to take screenshots. This also includes blocking screen sharing applications and similar applications (e.g. Google Assistant) that use the system's screenshot functions.
Disable camera		The camera should be deactivated by default.
Account types with management disabled		Account types that cannot be managed by the user
Disable adding users		Shows whether adding new users and profiles is disabled
Disable the volume setting		Shows whether adjusting the main volume is disabled
Deactivate factory reset		The reset to factory settings should be deactivated.
Disable mounting physical media		The mounting of external physical media by the user is to be deactivated.
Disable modifying accounts		Add or remove accounts should be disabled.notempty If this item is not enabled, the user can create another Google Account, log into the Playstore and install any software.
Deactivate key lock		Indicates whether the key lock is deactivated
Disable Bluetooth contact sharing		No contact data should leave the device via Bluetooth.
Disable Bluetooth configuration		The Bluetooth configuration should be deactivated.
Disable cell broadcast configuration		The configuration of Cell Broadcast should be disabled.
Disable credentials configuration		The configuration of user credentials should be disabled.notempty If disabled, certificates can no longer be installed. If these security settings are to be used, it is recommended to deactivate the configuration of the login credentials only after the security settings have been implemented on all devices.
Disable mobile network configuration		The configuration of mobile radio networks should be disabled.
Disable VPN configuration		The configuration of VPN should be disabled.
Disable airplane mode notempty New as of 1.18	Disabled	Controls the current status of flight mode and indicates whether the user can turn it on or off. notempty Available from Android 9 or higher Whether deactivation is necessary depends on local requirements.
	List of all setting options for Unspecified The current device value is not modified. The user can enable or disable the flight mode. User choice The user can enable or disable the flight mode. Disabled The flight mode is deactivated. The user is not allowed to activate the flight mode.
Disable creating windows		Specifies whether creating windows next to app windows is disabled.
Disable resetting network settings		Indicates whether network settings reset is disabled.
Disable sending via NFC		The use of NFC to transfer data from apps should be disabled.
Disable outgoing calls		Indicates whether outgoing calls are disabled.
Disable the removal of users		Shows whether the removal of other users is disabled.
Disable location sharing		Indicates whether location sharing is disabled.
Disable SMS		Shows whether sending and receiving SMS messages is disabled.
Prevent microphone from being switched on		Shows whether the microphone is muted and the microphone volume cannot be adjusted.
USB data access notempty New as of:1.24	Allow all	Controls what files and/or data can be transferred via USB. notempty Does not impact charging functions. notempty Supported only on company-owned devices.
	List of all possible settings for »USB data access« Unspecified Unspecified. Defaults to "Disallow file transfer" Allow all All types of USB data transfers are allowed. Disallow file transfer Transferring files over USB is disallowed. Other types of USB data connections, such as mouse and keyboard connection, are allowed. Disallow all data transfer When set, all types of USB data transfers are prohibited. Supported for devices running Android 12 or above with USB HAL 1.3 or above.
Tethering Einstellungen notempty Aktualisiert	Unspecified	Die Konfiguration von Tethering (z. B. WLAN-Tethering oder Bluetooth-Tethering) kann eingeschränkt werden.
	Auflistung aller Einstellungsmöglichkeiten für »Tethering Einstellungen« Unspecified Entspricht der Einstellung Alles erlauben ‍ Wurde dieser Wert noch nicht aktiv gesetzt wird der Wert aus der veralteten Einstellung tetheringConfigDisabled in das neue Feld TetheringSettings übernommen. Dessen Default Wert war false. Achtung: Doppelte Verneinung: »Deaktivierung der Einstellung = falsch« bedeutet: Einstellung erlaubt. Das neue Feld zeigt Nicht spezifiziert an, wenn der Wert im ursprünglichen Feld nie gesetzt wurde (also noch im Default Zustand ist). Wurde der ursprüngliche Wert auf tetheringConfigDisabled == true gesetzt, erhält neue Feld TetheringSettings den Weret 'DISALLOW_ALL_TETHERING Allow all Alle Formen des Thethering sind erlaubt WLAN Thethering verbieten Alle Formen des Thethering, ausgenommen WLAN-Tethering, sind erlaubt Tethering verbieten Alle Formen des Thethering sind verboten
WLAN Konfigurieren notempty Aktualisiert	Unspecified	Konfiguration von WLAN-Netzen durch Anwender
	Auflistung aller Einstellungsmöglichkeiten für »Tethering Einstellungen« Unspecified Entspricht der Einstellung Alles erlauben ‍ Wurde dieser Wert noch nicht aktiv gesetzt wird der Wert aus der veralteten Einstellung wifiConfigDisabled in das neue Feld ConfigureWifi übernommen. Dessen Default Wert war false. Achtung: Doppelte Verneinung: »Deaktivierung der Einstellung = falsch« bedeutet: Einstellung erlaubt. Das neue Feld zeigt Nicht spezifiziert an, wenn der Wert im ursprünglichen Feld nie gesetzt wurde (also noch im Default Zustand ist). Wurde der ursprüngliche Wert auf wifiConfigDisabled == true gesetzt, erhält neue Feld ConfigureWifi den Weret 'DISALLOW_CONFIGURING_WIFI Allow all Die WLAN Konfiguration ist vollständig erlaubt WLAN Konfiguration hinzufügen verbieten Das Hinzufügen neuer WLAN-Konfigurationen ist nicht zulässig, es kann nur zwischen bereits konfigurierten Netzwerken gewechselt werden WLAN Konfiguration nicht zulassen Verhindert die Konfiguration von WLANs
Disable setting user icon		Indicates whether changing the user icon is disabled.
Disable the background settings		Shows whether changing the background image is disabled.
Disable roaming		Indicates whether roaming data services are disabled.
Disable the Network Escape Hatch		Indicates whether the Network Escape Hatch is enabled. ‍ If a network connection cannot be established at boot time, the Escape Hatch prompts the user to temporarily connect to a network to update the device policy. After applying the policy, the temporary network is forgotten and the device continues booting. This prevents not being able to connect to a network if there is no suitable network in the last policy and the device launches an app in task lock mode or the user cannot otherwise reach the device settings.
Disable Bluetooth		Shows whether Bluetooth is disabled. This setting is preferable to Bluetooth Configuration because Bluetooth Configuration can be bypassed by the user.
Disable easter eggs		Whether the user is allowed to have fun. Controls whether the easter egg game is disabled in the settings.
Automatic date & time zone	Unspecified	Indicates whether automatic date, time, and time zone are enabled on a company-owned device.
	Listing of all setting options for »Automatic date & time zone« Unspecified This value is ignored. By default, the user's choice is used. User choice The automatic date, time and time zone are left to the user's choice. Force automatically Force the automatic date, time and time zone on the device.
Activate the custom kiosk launcher		Indicates whether the custom kiosk launcher is enabled. ‍ This replaces the home screen with a launcher that locks the device to the apps installed via the application setting. The apps are displayed on a single page in alphabetical order. It is recommended to disable the status bar to block access to the device settings.
Skip hints on first user		Flag to skip first time use hints. The company administrator can enable the system recommendation for apps to skip the user tutorial and other introductory notes on first launch.
Enable private key selection		Allows the user interface to be displayed on a device so that a user can select a private key alias if there are no matching rules in ChoosePrivateKeyRules. For Android P devices, this setting can attack company keys.
Disable keyguard	Camera  Ignore trust agents  Remote input	Functions that are not available to the user in the lock screen.
System Update
Activate the status message		After you have activated this, you can set the system update configuration.
Update type	Unspecified	The type of system update to configure.
	Listing of all setting options for »Update type« Unspecified Follow the default update behavior for the device that normally requires the user to accept system updates. Automatic Automatically install when an update is available. In window Automatic installation within a daily maintenance window. This also configures Play apps to be updated within the window. This is highly recommended for kiosk devices, as it is the only way that apps that remain permanently in the foreground can be updated by Play. Delay Delay the automatic installation for a maximum of 30 days.
Start Only with update type in window	0	If the type is windowed, the start of the maintenance window, measured as the number of minutes after midnight in the device's local time. This value must be between 0 and 1439, inclusive.
End Only with update type in window	0	If the type is WINDOWED, the end of the maintenance window, measured as the number of minutes after midnight in device's local time. This value must be between 0 and 1439, inclusive. If this value is less than start_minutes, then the maintenance window spans midnight. If the maintenance window specified is smaller than 30 minutes, the actual window is extended to 30 minutes beyond the start time.
Freeze periods	Add period	An annually recurring period of time when over-the-air (OTA) system updates are pushed to freeze the operating system version running on a device. To prevent the device from freezing indefinitely, each freeze period must be at least 60 days apart.
Start		Start of the period
End		End of period
Rules for private keys	Add rule	Rules for automatically selecting a private key and certificate to authenticate the device to a server. The rules are ordered by priority. Thus, if an outgoing request matches more than one rule, the last rule defines which private key to use.
URL-pattern	URL-pattern	The URL pattern to match with the URL of the outgoing request. The pattern may contain wildcards with asterisks (*). Any URL matches if it is not specified.
Package names	Paketnamen hinzufügen	The package names for which outgoing requests are subject to this rule. If no package names are specified, the rule applies to all packages. For each listed package name, the rule applies to that package and all other packages that used the same Android UID. The SHA256 hash of the signature key signatures of each package name is compared to those provided by Play.
Alias for private key	Alias	Der Alias des zu verwendenden privaten Schlüssels.
Untrusted apps policy	Unspecified	The policy for untrusted apps (apps from unknown sources) enforced on the device.
	Listing of all setting options for »Untrusted apps policy« Unspecified Not specified. Not allowed by default. Allow only in personal profiles For devices with work profiles, allow untrusted app installs in the device's personal profile only. Do not allow Default. Prohibit untrusted app installations on the entire device. Allow Allow untrusted app installations on the entire device.
Force app verification through 'Google Play Protect'	Unspecified	Specifies whether app verification is enforced by 'Google Play Protect'.
	List of all setting options for »Force app verification by 'Google Play Protect'« Unspecified Unspecified. Defaults to enforced. Forced Default. Force app verification. User choice Allows the user to choose whether to enable app verification.
Developer settings	Unspecified	Controls access to developer settings: Developer Options and Safe Launch.
	List of all setting options for »Developer settings« Unspecified Not specified. Disabled by default. Disabled Default. Disables all developer settings and prevents the user from accessing them. Allowed Allows all developer settings. The user can access and optionally configure the settings.
Common Criteria mode	Unspecified	Controls Common Criteria mode - security standards defined in the Common Criteria for Information Technology Security Evaluation (CC). ‍ Enabling Common Criteria mode increases certain security components on a device, including AES-GCM encryption of Bluetooth long keys and Wi-Fi configuration warning: Common Criteria mode enforces a strict security model that is normally only required for IT products used in national security systems and other highly sensitive organizations. The use of standard devices may be affected. Activate only when required.
	Listing of all setting options for »Common Criteria mode« Unspecified Not specified. Disabled by default. Disabled Default. Disables the Common Criteria mode. Activated Activates the Common Criteria mode.
Personal apps that can read work notifications	Add package name	Personal apps that can read work profile notifications with a NotificationListenerService. By default, no personal apps (except system apps) can read work notifications. Each value in the list must be a package name.
Power-Button-Actions	Unspecified	Sets the behavior of a device in kiosk mode when a user presses and holds the On / Off button.
	Listing of all setting options for »Power-Button-Actions« Unspecified Not specified, available by default. Verfügbar The on / off menu (e.g. switch off, restart) is displayed when a user holds down the on / off key of a device in kiosk mode. Blocked The On / Off menu (e.g. power off, restart) is not displayed if a user holds down the On / Off button of a device in kiosk mode. Note: This may prevent users from turning off the device.
System error warnings	Unspecified	Specifies whether to block system error dialogs for crashed or unresponsive apps in kiosk mode.
	Listing of all setting options for »System error warnings« Unspecified Not specified, muted by default. Activated All system error dialogs like crash and app not responding (ANR) are displayed. Mute All system error dialogs like crash and unresponsive app (ANR) are blocked. When it is blocked, the system forcibly stops the app as if the user closes the app from the user interface.
System navigation	Unspecified	Indicates which navigation functions are enabled in kiosk mode (e.g. Home, overview keys).
	Listing of all setting options for »System navigation« Unspecified Not specified, disabled by default. Activated Home and overview buttons are enabled. Disabled The Home and Overview buttons cannot be accessed. Home-button only Only the home-button is enabled.
Status bar	Unspecified	Specifies whether system information and notifications are disabled in kiosk mode.
	Listing of all setting options for »Status bar« Unspecified Not specified, notifications and system information disabled by default. Notifications and system information enabled System information and notifications are displayed in the status bar in kiosk mode Notifications and system information disabled System information and notifications are disabled in kiosk mode. System information only Only system information is displayed in the status bar.
Device settings	Unspecified	Specifies whether a user can access the app settings of the device in kiosk mode.
	Listing of all setting options for »Device settings« Unspecified Not specified, allowed by default. Allowed Access to the settings app is allowed in kiosk mode. Blocked Access to the settings app is not allowed in kiosk mode.