REST Resource: enterprises.policies

Resource: Policy

A policy resource represents a group of settings that govern the behavior of a managed device and the apps installed on it.

JSON representation
{
  "name": string,
  "version": string,
  "applications": [
    {
      object (ApplicationPolicy)
    }
  ],
  "maximumTimeToLock": string,
  "screenCaptureDisabled": boolean,
  "cameraDisabled": boolean,
  "keyguardDisabledFeatures": [
    enum (KeyguardDisabledFeature)
  ],
  "defaultPermissionPolicy": enum (PermissionPolicy),
  "persistentPreferredActivities": [
    {
      object (PersistentPreferredActivity)
    }
  ],
  "openNetworkConfiguration": {
    object
  },
  "systemUpdate": {
    object (SystemUpdate)
  },
  "accountTypesWithManagementDisabled": [
    string
  ],
  "addUserDisabled": boolean,
  "adjustVolumeDisabled": boolean,
  "factoryResetDisabled": boolean,
  "installAppsDisabled": boolean,
  "mountPhysicalMediaDisabled": boolean,
  "modifyAccountsDisabled": boolean,
  "safeBootDisabled": boolean,
  "uninstallAppsDisabled": boolean,
  "statusBarDisabled": boolean,
  "keyguardDisabled": boolean,
  "minimumApiLevel": integer,
  "statusReportingSettings": {
    object (StatusReportingSettings)
  },
  "bluetoothContactSharingDisabled": boolean,
  "shortSupportMessage": {
    object (UserFacingMessage)
  },
  "longSupportMessage": {
    object (UserFacingMessage)
  },
  "passwordRequirements": {
    object (PasswordRequirements)
  },
  "wifiConfigsLockdownEnabled": boolean,
  "bluetoothConfigDisabled": boolean,
  "cellBroadcastsConfigDisabled": boolean,
  "credentialsConfigDisabled": boolean,
  "mobileNetworksConfigDisabled": boolean,
  "tetheringConfigDisabled": boolean,
  "vpnConfigDisabled": boolean,
  "wifiConfigDisabled": boolean,
  "createWindowsDisabled": boolean,
  "networkResetDisabled": boolean,
  "outgoingBeamDisabled": boolean,
  "outgoingCallsDisabled": boolean,
  "removeUserDisabled": boolean,
  "shareLocationDisabled": boolean,
  "smsDisabled": boolean,
  "unmuteMicrophoneDisabled": boolean,
  "usbFileTransferDisabled": boolean,
  "ensureVerifyAppsEnabled": boolean,
  "permittedInputMethods": {
    object (PackageNameList)
  },
  "stayOnPluggedModes": [
    enum (BatteryPluggedMode)
  ],
  "recommendedGlobalProxy": {
    object (ProxyInfo)
  },
  "setUserIconDisabled": boolean,
  "setWallpaperDisabled": boolean,
  "choosePrivateKeyRules": [
    {
      object (ChoosePrivateKeyRule)
    }
  ],
  "alwaysOnVpnPackage": {
    object (AlwaysOnVpnPackage)
  },
  "frpAdminEmails": [
    string
  ],
  "deviceOwnerLockScreenInfo": {
    object (UserFacingMessage)
  },
  "dataRoamingDisabled": boolean,
  "locationMode": enum (LocationMode),
  "networkEscapeHatchEnabled": boolean,
  "bluetoothDisabled": boolean,
  "complianceRules": [
    {
      object (ComplianceRule)
    }
  ],
  "blockApplicationsEnabled": boolean,
  "installUnknownSourcesAllowed": boolean,
  "debuggingFeaturesAllowed": boolean,
  "funDisabled": boolean,
  "autoTimeRequired": boolean,
  "permittedAccessibilityServices": {
    object (PackageNameList)
  },
  "appAutoUpdatePolicy": enum (AppAutoUpdatePolicy),
  "kioskCustomLauncherEnabled": boolean,
  "skipFirstUseHintsEnabled": boolean,
  "privateKeySelectionEnabled": boolean,
  "encryptionPolicy": enum (EncryptionPolicy),
  "usbMassStorageEnabled": boolean,
  "permissionGrants": [
    {
      object (PermissionGrant)
    }
  ],
  "playStoreMode": enum (PlayStoreMode),
  "setupActions": [
    {
      object (SetupAction)
    }
  ],
  "passwordPolicies": [
    {
      object (PasswordRequirements)
    }
  ],
  "policyEnforcementRules": [
    {
      object (PolicyEnforcementRule)
    }
  ],
  "kioskCustomization": {
    object (KioskCustomization)
  },
  "advancedSecurityOverrides": {
    object (AdvancedSecurityOverrides)
  },
  "personalUsagePolicies": {
    object (PersonalUsagePolicies)
  },
  "autoDateAndTimeZone": enum (AutoDateAndTimeZone),
  "oncCertificateProviders": [
    {
      object (OncCertificateProvider)
    }
  ]
}
Fields
name

string

The name of the policy in the form enterprises/{enterpriseId}/policies/{policyId}.

version

string (int64 format)

The version of the policy. This is a read-only field. The version is incremented each time the policy is updated.

applications[]

object (ApplicationPolicy)

Policy applied to apps.

maximumTimeToLock

string (int64 format)

Maximum time in milliseconds for user activity until the device locks. A value of 0 means there is no restriction.

screenCaptureDisabled

boolean

Whether screen capture is disabled.

cameraDisabled

boolean

Whether all cameras on the device are disabled.

keyguardDisabledFeatures[]

enum (KeyguardDisabledFeature)

Disabled keyguard customizations, such as widgets.

defaultPermissionPolicy

enum (PermissionPolicy)

The default permission policy for runtime permission requests.

persistentPreferredActivities[]

object (PersistentPreferredActivity)

Default intent handler activities.

openNetworkConfiguration

object (Struct format)

Network configuration for the device. See configure networks for more information.

systemUpdate

object (SystemUpdate)

The system update policy, which controls how OS updates are applied. If the update type is WINDOWED, the update window will automatically apply to Play app updates as well.

accountTypesWithManagementDisabled[]

string

Account types that can't be managed by the user.

addUserDisabled

boolean

Whether adding new users and profiles is disabled.

adjustVolumeDisabled

boolean

Whether adjusting the master volume is disabled. Also mutes the device.

factoryResetDisabled

boolean

Whether factory resetting from settings is disabled.

installAppsDisabled

boolean

Whether user installation of apps is disabled.

mountPhysicalMediaDisabled

boolean

Whether the user mounting physical external media is disabled.

modifyAccountsDisabled

boolean

Whether adding or removing accounts is disabled.

safeBootDisabled
(deprecated)

boolean

Whether rebooting the device into safe boot is disabled.

uninstallAppsDisabled

boolean

Whether user uninstallation of applications is disabled.

statusBarDisabled
(deprecated)

boolean

Whether the status bar is disabled. This disables notifications, quick settings, and other screen overlays that allow escape from full-screen mode. DEPRECATED. To disable the status bar on a kiosk device, use InstallType KIOSK or kioskCustomLauncherEnabled.

keyguardDisabled

boolean

Whether the keyguard is disabled.

minimumApiLevel

integer

The minimum allowed Android API level.

statusReportingSettings

object (StatusReportingSettings)

Status reporting settings

bluetoothContactSharingDisabled

boolean

Whether bluetooth contact sharing is disabled.

shortSupportMessage

object (UserFacingMessage)

A message displayed to the user in the settings screen wherever functionality has been disabled by the admin. If the message is longer than 200 characters it may be truncated.

longSupportMessage

object (UserFacingMessage)

A message displayed to the user in the device administators settings screen.

passwordRequirements
(deprecated)

object (PasswordRequirements)

Password requirements. The field passwordRequirements.require_password_unlock must not be set. DEPRECATED - Use passwordPolicies.

Note:

Complexity-based values of PasswordQuality, that is, COMPLEXITY_LOW, COMPLEXITY_MEDIUM, and COMPLEXITY_HIGH, cannot be used here.

wifiConfigsLockdownEnabled
(deprecated)

boolean

DEPRECATED - Use wifiConfigDisabled.

bluetoothConfigDisabled

boolean

Whether configuring bluetooth is disabled.

cellBroadcastsConfigDisabled

boolean

Whether configuring cell broadcast is disabled.

credentialsConfigDisabled

boolean

Whether configuring user credentials is disabled.

mobileNetworksConfigDisabled

boolean

Whether configuring mobile networks is disabled.

tetheringConfigDisabled

boolean

Whether configuring tethering and portable hotspots is disabled.

vpnConfigDisabled

boolean

Whether configuring VPN is disabled.

wifiConfigDisabled

boolean

Whether configuring Wi-Fi access points is disabled.

Note: If a network connection can't be made at boot time and configuring Wi-Fi is disabled then network escape hatch will be shown in order to refresh the device policy (see networkEscapeHatchEnabled).

createWindowsDisabled

boolean

Whether creating windows besides app windows is disabled.

networkResetDisabled

boolean

Whether resetting network settings is disabled.

outgoingBeamDisabled

boolean

Whether using NFC to beam data from apps is disabled.

outgoingCallsDisabled

boolean

Whether outgoing calls are disabled.

removeUserDisabled

boolean

Whether removing other users is disabled.

shareLocationDisabled

boolean

Whether location sharing is disabled.

smsDisabled

boolean

Whether sending and receiving SMS messages is disabled.

unmuteMicrophoneDisabled

boolean

Whether the microphone is muted and adjusting microphone volume is disabled.

usbFileTransferDisabled

boolean

Whether transferring files over USB is disabled.

ensureVerifyAppsEnabled
(deprecated)

boolean

Whether app verification is force-enabled.

permittedInputMethods

object (PackageNameList)

If present, only the input methods provided by packages in this list are permitted. If this field is present, but the list is empty, then only system input methods are permitted.

stayOnPluggedModes[]

enum (BatteryPluggedMode)

The battery plugged in modes for which the device stays on. When using this setting, it is recommended to clear maximumTimeToLock so that the device doesn't lock itself while it stays on.

recommendedGlobalProxy

object (ProxyInfo)

The network-independent global HTTP proxy. Typically proxies should be configured per-network in openNetworkConfiguration. However for unusual configurations like general internal filtering a global HTTP proxy may be useful. If the proxy is not accessible, network access may break. The global proxy is only a recommendation and some apps may ignore it.

setUserIconDisabled

boolean

Whether changing the user icon is disabled.

setWallpaperDisabled

boolean

Whether changing the wallpaper is disabled.

choosePrivateKeyRules[]

object (ChoosePrivateKeyRule)

Rules for determining apps' access to private keys. See ChoosePrivateKeyRule for details.

alwaysOnVpnPackage

object (AlwaysOnVpnPackage)

Configuration for an always-on VPN connection. Use with vpnConfigDisabled to prevent modification of this setting.

frpAdminEmails[]

string

Email addresses of device administrators for factory reset protection. When the device is factory reset, it will require one of these admins to log in with the Google account email and password to unlock the device. If no admins are specified, the device won't provide factory reset protection.

deviceOwnerLockScreenInfo

object (UserFacingMessage)

The device owner information to be shown on the lock screen.

dataRoamingDisabled

boolean

Whether roaming data services are disabled.

locationMode

enum (LocationMode)

The degree of location detection enabled.

networkEscapeHatchEnabled

boolean

Whether the network escape hatch is enabled. If a network connection can't be made at boot time, the escape hatch prompts the user to temporarily connect to a network in order to refresh the device policy. After applying policy, the temporary network will be forgotten and the device will continue booting. This prevents being unable to connect to a network if there is no suitable network in the last policy and the device boots into an app in lock task mode, or the user is otherwise unable to reach device settings.

Note: Setting wifiConfigDisabled to true will override this setting under specific circumstances. Please see wifiConfigDisabled for further details.

bluetoothDisabled

boolean

Whether bluetooth is disabled. Prefer this setting over bluetoothConfigDisabled because bluetoothConfigDisabled can be bypassed by the user.

complianceRules[]
(deprecated)

object (ComplianceRule)

Rules declaring which mitigating actions to take when a device is not compliant with its policy. When the conditions for multiple rules are satisfied, all of the mitigating actions for the rules are taken. There is a maximum limit of 100 rules. Use policy enforcement rules instead.

blockApplicationsEnabled
(deprecated)

boolean

Whether applications other than the ones configured in applications are blocked from being installed. When set, applications that were installed under a previous policy but no longer appear in the policy are automatically uninstalled.

installUnknownSourcesAllowed
(deprecated)

boolean

This field has no effect.

debuggingFeaturesAllowed
(deprecated)

boolean

Whether the user is allowed to enable debugging features.

funDisabled

boolean

Whether the user is allowed to have fun. Controls whether the Easter egg game in Settings is disabled.

autoTimeRequired
(deprecated)

boolean

Whether auto time is required, which prevents the user from manually setting the date and time. If autoDateAndTimeZone is set, this field is ignored.

permittedAccessibilityServices

object (PackageNameList)

Specifies permitted accessibility services. If the field is not set, any accessibility service can be used. If the field is set, only the accessibility services in this list and the system's built-in accessibility service can be used. In particular, if the field is set to empty, only the system's built-in accessibility servicess can be used.

appAutoUpdatePolicy
(deprecated)

enum (AppAutoUpdatePolicy)

Deprecated. Use autoUpdateMode instead.

When autoUpdateMode is set to AUTO_UPDATE_POSTPONED or AUTO_UPDATE_HIGH_PRIORITY, this field has no effect.

The app auto update policy, which controls when automatic app updates can be applied.

kioskCustomLauncherEnabled

boolean

Whether the kiosk custom launcher is enabled. This replaces the home screen with a launcher that locks down the device to the apps installed via the applications setting. Apps appear on a single page in alphabetical order. Use kioskCustomization to further configure the kiosk device behavior.

skipFirstUseHintsEnabled

boolean

Flag to skip hints on the first use. Enterprise admin can enable the system recommendation for apps to skip their user tutorial and other introductory hints on first start-up.

privateKeySelectionEnabled

boolean

Allows showing UI on a device for a user to choose a private key alias if there are no matching rules in ChoosePrivateKeyRules. For devices below Android P, setting this may leave enterprise keys vulnerable.

encryptionPolicy

enum (EncryptionPolicy)

Whether encryption is enabled

usbMassStorageEnabled
(deprecated)

boolean

Whether USB storage is enabled. Deprecated.

permissionGrants[]

object (PermissionGrant)

Explicit permission or group grants or denials for all apps. These values override the defaultPermissionPolicy.

playStoreMode

enum (PlayStoreMode)

This mode controls which apps are available to the user in the Play Store and the behavior on the device when apps are removed from the policy.

setupActions[]

object (SetupAction)

Actions to take during the setup process.

passwordPolicies[]

object (PasswordRequirements)

Password requirement policies. Different policies can be set for work profile or fully managed devices by setting the passwordScope field in the policy.

policyEnforcementRules[]

object (PolicyEnforcementRule)

Rules that define the behavior when a particular policy can not be applied on device

kioskCustomization

object (KioskCustomization)

Settings controlling the behavior of a device in kiosk mode. To enable kiosk mode, set kioskCustomLauncherEnabled to true or specify an app in the policy with installType KIOSK.

advancedSecurityOverrides

object (AdvancedSecurityOverrides)

Security policies set to the most secure values by default. To maintain the security posture of a device, we don't recommend overriding any of the default values.

personalUsagePolicies

object (PersonalUsagePolicies)

Policies managing personal usage on a company-owned device.

autoDateAndTimeZone

enum (AutoDateAndTimeZone)

Whether auto date, time, and time zone are enabled on a company-owned device. If this is set, then autoTimeRequired is ignored.

oncCertificateProviders[]

object (OncCertificateProvider)

This feature is not generally available.

ApplicationPolicy

Policy for an individual app.

JSON representation
{
  "packageName": string,
  "installType": enum (InstallType),
  "lockTaskAllowed": boolean,
  "defaultPermissionPolicy": enum (PermissionPolicy),
  "permissionGrants": [
    {
      object (PermissionGrant)
    }
  ],
  "managedConfiguration": {
    object
  },
  "disabled": boolean,
  "minimumVersionCode": integer,
  "delegatedScopes": [
    enum (DelegatedScope)
  ],
  "managedConfigurationTemplate": {
    object (ManagedConfigurationTemplate)
  },
  "accessibleTrackIds": [
    string
  ],
  "connectedWorkAndPersonalApp": enum (ConnectedWorkAndPersonalApp),
  "autoUpdateMode": enum (AutoUpdateMode)
}
Fields
packageName

string

The package name of the app. For example, com.google.android.youtube for the YouTube app.

installType

enum (InstallType)

The type of installation to perform.

lockTaskAllowed
(deprecated)

boolean

Whether the app is allowed to lock itself in full-screen mode. DEPRECATED. Use InstallType KIOSK or kioskCustomLauncherEnabled to to configure a dedicated device.

defaultPermissionPolicy

enum (PermissionPolicy)

The default policy for all permissions requested by the app. If specified, this overrides the policy-level defaultPermissionPolicy which applies to all apps. It does not override the permissionGrants which applies to all apps.

permissionGrants[]

object (PermissionGrant)

Explicit permission grants or denials for the app. These values override the defaultPermissionPolicy and permissionGrants which apply to all apps.

managedConfiguration

object (Struct format)

Managed configuration applied to the app. The format for the configuration is dictated by the ManagedProperty values supported by the app. Each field name in the managed configuration must match the key field of the ManagedProperty. The field value must be compatible with the type of the ManagedProperty:

typeJSON value
BOOLtrue or false
STRINGstring
INTEGERnumber
CHOICEstring
MULTISELECTarray of strings
HIDDENstring
BUNDLE_ARRAYarray of objects

disabled

boolean

Whether the app is disabled. When disabled, the app data is still preserved.

minimumVersionCode

integer

The minimum version of the app that runs on the device. If set, the device attempts to update the app to at least this version code. If the app is not up-to-date, the device will contain a NonComplianceDetail with nonComplianceReason set to APP_NOT_UPDATED. The app must already be published to Google Play with a version code greater than or equal to this value. At most 20 apps may specify a minimum version code per policy.

delegatedScopes[]

enum (DelegatedScope)

The scopes delegated to the app from Android Device Policy.

managedConfigurationTemplate

object (ManagedConfigurationTemplate)

The managed configurations template for the app, saved from the managed configurations iframe. This field is ignored if managedConfiguration is set.

accessibleTrackIds[]

string

List of the app’s track IDs that a device belonging to the enterprise can access. If the list contains multiple track IDs, devices receive the latest version among all accessible tracks. If the list contains no track IDs, devices only have access to the app’s production track. More details about each track are available in AppTrackInfo.

connectedWorkAndPersonalApp

enum (ConnectedWorkAndPersonalApp)

Controls whether the app can communicate with itself across a device’s work and personal profiles, subject to user consent.

autoUpdateMode

enum (AutoUpdateMode)

Controls the auto-update mode for the app.

InstallType

The type of installation to perform for an app.

Enums
INSTALL_TYPE_UNSPECIFIED Unspecified. Defaults to AVAILABLE.
PREINSTALLED The app is automatically installed and can be removed by the user.
FORCE_INSTALLED The app is automatically installed and can't be removed by the user.
BLOCKED The app is blocked and can't be installed. If the app was installed under a previous policy, it will be uninstalled.
AVAILABLE The app is available to install.
REQUIRED_FOR_SETUP The app is automatically installed and can't be removed by the user and will prevent setup from completion until installation is complete.
KIOSK The app is automatically installed in kiosk mode: it's set as the preferred home intent and whitelisted for lock task mode. Device setup won't complete until the app is installed. After installation, users won't be able to remove the app. You can only set this installType for one app per policy. When this is present in the policy, status bar will be automatically disabled.

PermissionPolicy

The policy for granting permission requests to apps.

Enums
PERMISSION_POLICY_UNSPECIFIED Policy not specified. If no policy is specified for a permission at any level, then the PROMPT behavior is used by default.
PROMPT Prompt the user to grant a permission.
GRANT Automatically grant a permission.
DENY Automatically deny a permission.

PermissionGrant

Configuration for an Android permission and its grant state.

JSON representation
{
  "permission": string,
  "policy": enum (PermissionPolicy)
}
Fields
permission

string

The Android permission or group, e.g. android.permission.READ_CALENDAR or android.permission_group.CALENDAR.

policy

enum (PermissionPolicy)

The policy for granting the permission.

DelegatedScope

Delegation Scopes that another package can acquire from Android Device Policy.

Enums
DELEGATED_SCOPE_UNSPECIFIED No delegation scope specified.
CERT_INSTALL Grants access to certificate installation and management.
MANAGED_CONFIGURATIONS Grants access to managed configurations management.
BLOCK_UNINSTALL Grants access to blocking uninstallation.
PERMISSION_GRANT Grants access to permission policy and permission grant state.
PACKAGE_ACCESS Grants access to package access state.
ENABLE_SYSTEM_APP Grants access for enabling system apps.

ManagedConfigurationTemplate

The managed configurations template for the app, saved from the managed configurations iframe.

JSON representation
{
  "templateId": string,
  "configurationVariables": {
    string: string,
    ...
  }
}
Fields
templateId

string

The ID of the managed configurations template.

configurationVariables

map (key: string, value: string)

Optional, a map containing <key, value> configuration variables defined for the configuration.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

ConnectedWorkAndPersonalApp

Controls whether the app can communicate with itself cross-profile, subject to user consent.

Enums
CONNECTED_WORK_AND_PERSONAL_APP_UNSPECIFIED Unspecified. Defaults to CONNECTED_WORK_AND_PERSONAL_APPS_DISALLOWED.
CONNECTED_WORK_AND_PERSONAL_APP_DISALLOWED Default. Prevents the app from communicating cross-profile.
CONNECTED_WORK_AND_PERSONAL_APP_ALLOWED Allows the app to communicate across profiles after receiving user consent.

AutoUpdateMode

Controls the auto-update mode for the app.

Enums
AUTO_UPDATE_MODE_UNSPECIFIED Unspecified. Defaults to AUTO_UPDATE_DEFAULT.
AUTO_UPDATE_DEFAULT

The app is automatically updated with low priority to minimize the impact on the user.

The app is updated when all of the following constraints are met:

  • The device is not actively used.
  • The device is connected to an unmetered network.
  • The device is charging.

The device is notified about a new update within 24 hours after it is published by the developer, after which the app is updated the next time the constraints above are met.

AUTO_UPDATE_POSTPONED

The app is not automatically updated for a maximum of 90 days after the app becomes out of date.

90 days after the app becomes out of date, the latest available version is installed automatically with low priority (see AUTO_UPDATE_DEFAULT). After the app is updated it is not automatically updated again until 90 days after it becomes out of date again.

The user can still manually update the app from the Play Store at any time.

AUTO_UPDATE_HIGH_PRIORITY

The app is updated as soon as possible. No constraints are applied.

The device is notified immediately about a new update after it becomes available.

KeyguardDisabledFeature

Keyguard (lock screen) features that can be disabled..

Enums
KEYGUARD_DISABLED_FEATURE_UNSPECIFIED This value is ignored.
CAMERA Disable the camera on secure keyguard screens (e.g. PIN).
NOTIFICATIONS Disable showing all notifications on secure keyguard screens.
UNREDACTED_NOTIFICATIONS Disable unredacted notifications on secure keyguard screens.
TRUST_AGENTS Ignore trust agent state on secure keyguard screens.
DISABLE_FINGERPRINT Disable fingerprint sensor on secure keyguard screens.
DISABLE_REMOTE_INPUT Disable text entry into notifications on secure keyguard screens.
FACE Disable face authentication on secure keyguard screens.
IRIS Disable iris authentication on secure keyguard screens.
BIOMETRICS Disable all biometric authentication on secure keyguard screens.
ALL_FEATURES Disable all current and future keyguard customizations.

PersistentPreferredActivity

A default activity for handling intents that match a particular intent filter. Note: To set up a kiosk, use InstallType to KIOSK rather than use persistent preferred activities.

JSON representation
{
  "receiverActivity": string,
  "actions": [
    string
  ],
  "categories": [
    string
  ]
}
Fields
receiverActivity

string

The activity that should be the default intent handler. This should be an Android component name, e.g. com.android.enterprise.app/.MainActivity. Alternatively, the value may be the package name of an app, which causes Android Device Policy to choose an appropriate activity from the app to handle the intent.

actions[]

string

The intent actions to match in the filter. If any actions are included in the filter, then an intent's action must be one of those values for it to match. If no actions are included, the intent action is ignored.

categories[]

string

The intent categories to match in the filter. An intent includes the categories that it requires, all of which must be included in the filter in order to match. In other words, adding a category to the filter has no impact on matching unless that category is specified in the intent.

SystemUpdate

Configuration for managing system updates

JSON representation
{
  "type": enum (SystemUpdateType),
  "startMinutes": integer,
  "endMinutes": integer,
  "freezePeriods": [
    {
      object (FreezePeriod)
    }
  ]
}
Fields
type

enum (SystemUpdateType)

The type of system update to configure.

startMinutes

integer

If the type is WINDOWED, the start of the maintenance window, measured as the number of minutes after midnight in the device's local time. This value must be between 0 and 1439, inclusive.

endMinutes

integer

If the type is WINDOWED, the end of the maintenance window, measured as the number of minutes after midnight in device's local time. This value must be between 0 and 1439, inclusive. If this value is less than startMinutes, then the maintenance window spans midnight. If the maintenance window specified is smaller than 30 minutes, the actual window is extended to 30 minutes beyond the start time.

freezePeriods[]

object (FreezePeriod)

An annually repeating time period in which over-the-air (OTA) system updates are postponed to freeze the OS version running on a device. To prevent freezing the device indefinitely, each freeze period must be separated by at least 60 days.

SystemUpdateType

The type of system update configuration.

Enums
SYSTEM_UPDATE_TYPE_UNSPECIFIED Follow the default update behavior for the device, which typically requires the user to accept system updates.
AUTOMATIC Install automatically as soon as an update is available.
WINDOWED

Install automatically within a daily maintenance window. This also configures Play apps to be updated within the window. This is strongly recommended for kiosk devices because this is the only way apps persistently pinned to the foreground can be updated by Play.

If autoUpdateMode is set to AUTO_UPDATE_HIGH_PRIORITY for an app, then the maintenance window is ignored for that app and it is updated as soon as possible even outside of the maintenance window.

POSTPONE Postpone automatic install up to a maximum of 30 days.

FreezePeriod

A system freeze period. When a device’s clock is within the freeze period, all incoming system updates (including security patches) are blocked and won’t be installed. When a device is outside the freeze period, normal update behavior applies. Leap years are ignored in freeze period calculations, in particular: * If Feb. 29th is set as the start or end date of a freeze period, the freeze period will start or end on Feb. 28th instead. * When a device’s system clock reads Feb. 29th, it’s treated as Feb. 28th. * When calculating the number of days in a freeze period or the time between two freeze periods, Feb. 29th is ignored and not counted as a day.

JSON representation
{
  "startDate": {
    object (Date)
  },
  "endDate": {
    object (Date)
  }
}
Fields
startDate

object (Date)

The start date (inclusive) of the freeze period. Note: year must not be set. For example, {"month": 1,"date": 30}.

endDate

object (Date)

The end date (inclusive) of the freeze period. Must be no later than 90 days from the start date. If the end date is earlier than the start date, the freeze period is considered wrapping year-end. Note: year must not be set. For example, {"month": 1,"date": 30}.

Date

Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following:

  • A full date, with non-zero year, month, and day values
  • A month and day value, with a zero year, such as an anniversary
  • A year on its own, with zero month and day values
  • A year and month value, with a zero day, such as a credit card expiration date

Related types are google.type.TimeOfDay and google.protobuf.Timestamp.

JSON representation
{
  "year": integer,
  "month": integer,
  "day": integer
}
Fields
year

integer

Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

month

integer

Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

day

integer

Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

StatusReportingSettings

Settings controlling the behavior of status reports.

JSON representation
{
  "applicationReportsEnabled": boolean,
  "deviceSettingsEnabled": boolean,
  "softwareInfoEnabled": boolean,
  "memoryInfoEnabled": boolean,
  "networkInfoEnabled": boolean,
  "displayInfoEnabled": boolean,
  "powerManagementEventsEnabled": boolean,
  "hardwareStatusEnabled": boolean,
  "systemPropertiesEnabled": boolean,
  "applicationReportingSettings": {
    object (ApplicationReportingSettings)
  },
  "commonCriteriaModeEnabled": boolean
}
Fields
applicationReportsEnabled

boolean

Whether app reports are enabled.

deviceSettingsEnabled

boolean

Whether device settings reporting is enabled.

softwareInfoEnabled

boolean

Whether software info reporting is enabled.

memoryInfoEnabled

boolean

Whether memory reporting is enabled.

networkInfoEnabled

boolean

Whether network info reporting is enabled.

displayInfoEnabled

boolean

Whether displays reporting is enabled. Report data is not available for personally owned devices with work profiles.

powerManagementEventsEnabled

boolean

Whether power management event reporting is enabled. Report data is not available for personally owned devices with work profiles.

hardwareStatusEnabled

boolean

Whether hardware status reporting is enabled. Report data is not available for personally owned devices with work profiles.

systemPropertiesEnabled

boolean

Whether system properties reporting is enabled.

applicationReportingSettings

object (ApplicationReportingSettings)

Application reporting settings. Only applicable if applicationReportsEnabled is true.

commonCriteriaModeEnabled

boolean

Whether Common Criteria Mode reporting is enabled.

ApplicationReportingSettings

Settings controlling the behavior of application reports.

JSON representation
{
  "includeRemovedApps": boolean
}
Fields
includeRemovedApps

boolean

Whether removed apps are included in application reports.

PackageNameList

A list of package names.

JSON representation
{
  "packageNames": [
    string
  ]
}
Fields
packageNames[]

string

A list of package names.

BatteryPluggedMode

Modes for plugging in the battery.

Enums
BATTERY_PLUGGED_MODE_UNSPECIFIED This value is ignored.
AC Power source is an AC charger.
USB Power source is a USB port.
WIRELESS Power source is wireless.

ProxyInfo

Configuration info for an HTTP proxy. For a direct proxy, set the host, port, and excludedHosts fields. For a PAC script proxy, set the pacUri field.

JSON representation
{
  "host": string,
  "port": integer,
  "excludedHosts": [
    string
  ],
  "pacUri": string
}
Fields
host

string

The host of the direct proxy.

port

integer

The port of the direct proxy.

excludedHosts[]

string

For a direct proxy, the hosts for which the proxy is bypassed. The host names may contain wildcards such as *.example.com.

pacUri

string

The URI of the PAC script used to configure the proxy.

ChoosePrivateKeyRule

Controls apps' access to private keys. The rule determines which private key, if any, Android Device Policy grants to the specified app. Access is granted either when the app calls KeyChain.choosePrivateKeyAlias (or any overloads) to request a private key alias for a given URL, or for rules that are not URL-specific (that is, if urlPattern is not set, or set to the empty string or .*) on Android 11 and above, directly so that the app can call KeyChain.getPrivateKey, without first having to call KeyChain.choosePrivateKeyAlias.

When an app calls KeyChain.choosePrivateKeyAlias if more than one choosePrivateKeyRules matches, the last matching rule defines which key alias to return.

JSON representation
{
  "urlPattern": string,
  "packageNames": [
    string
  ],
  "privateKeyAlias": string
}
Fields
urlPattern

string

The URL pattern to match against the URL of the request. If not set or empty, it matches all URLs. This uses the regular expression syntax of java.util.regex.Pattern.

packageNames[]

string

The package names to which this rule applies. The hash of the signing certificate for each app is verified against the hash provided by Play. If no package names are specified, then the alias is provided to all apps that call KeyChain.choosePrivateKeyAlias or any overloads (but not without calling KeyChain.choosePrivateKeyAlias, even on Android 11 and above). Any app with the same Android UID as a package specified here will have access when they call KeyChain.choosePrivateKeyAlias.

privateKeyAlias

string

The alias of the private key to be used.

AlwaysOnVpnPackage

Configuration for an always-on VPN connection.

JSON representation
{
  "packageName": string,
  "lockdownEnabled": boolean
}
Fields
packageName

string

The package name of the VPN app.

lockdownEnabled

boolean

Disallows networking when the VPN is not connected.

LocationMode

The degree of location detection enabled on company owned devices.

Enums
LOCATION_MODE_UNSPECIFIED Defaults to LOCATION_USER_CHOICE.
HIGH_ACCURACY

On Android 8 and below, all location detection methods are enabled, including GPS, networks, and other sensors. On Android 9 and above, this is equivalent to LOCATION_ENFORCED.

SENSORS_ONLY

On Android 8 and below, only GPS and other sensors are enabled. On Android 9 and above, this is equivalent to LOCATION_ENFORCED.

BATTERY_SAVING

On Android 8 and below, only the network location provider is enabled. On Android 9 and above, this is equivalent to LOCATION_ENFORCED.

OFF

On Android 8 and below, location setting and accuracy are disabled. On Android 9 and above, this is equivalent to LOCATION_DISABLED.

LOCATION_USER_CHOICE Location setting is not restricted on the device. No specific behavior is set or enforced.
LOCATION_ENFORCED Enable location setting on the device.
LOCATION_DISABLED Disable location setting on the device.

ComplianceRule

A rule declaring which mitigating actions to take when a device is not compliant with its policy. For every rule, there is always an implicit mitigating action to set policyCompliant to false for the Device resource, and display a message on the device indicating that the device is not compliant with its policy. Other mitigating actions may optionally be taken as well, depending on the field values in the rule.

JSON representation
{
  "disableApps": boolean,
  "packageNamesToDisable": [
    string
  ],

  // Union field condition can be only one of the following:
  "nonComplianceDetailCondition": {
    object (NonComplianceDetailCondition)
  },
  "apiLevelCondition": {
    object (ApiLevelCondition)
  }
  // End of list of possible types for union field condition.
}
Fields
disableApps

boolean

If set to true, the rule includes a mitigating action to disable apps so that the device is effectively disabled, but app data is preserved. If the device is running an app in locked task mode, the app will be closed and a UI showing the reason for non-compliance will be displayed.

packageNamesToDisable[]

string

If set, the rule includes a mitigating action to disable apps specified in the list, but app data is preserved.

Union field condition. The condition, which when satisfied, triggers the mitigating actions defined in the rule. Exactly one of the conditions must be set. condition can be only one of the following:
nonComplianceDetailCondition

object (NonComplianceDetailCondition)

A condition which is satisfied if there exists any matching NonComplianceDetail for the device.

apiLevelCondition

object (ApiLevelCondition)

A condition which is satisfied if the Android Framework API level on the device doesn't meet a minimum requirement.

NonComplianceDetailCondition

A compliance rule condition which is satisfied if there exists any matching NonComplianceDetail for the device. A NonComplianceDetail matches a NonComplianceDetailCondition if all the fields which are set within the NonComplianceDetailCondition match the corresponding NonComplianceDetail fields.

JSON representation
{
  "settingName": string,
  "nonComplianceReason": enum (NonComplianceReason),
  "packageName": string
}
Fields
settingName

string

The name of the policy setting. This is the JSON field name of a top-level Policy field. If not set, then this condition matches any setting name.

nonComplianceReason

enum (NonComplianceReason)

The reason the device is not in compliance with the setting. If not set, then this condition matches any reason.

packageName

string

The package name of the app that's out of compliance. If not set, then this condition matches any package name.

ApiLevelCondition

A compliance rule condition which is satisfied if the Android Framework API level on the device doesn't meet a minimum requirement. There can only be one rule with this type of condition per policy.

JSON representation
{
  "minApiLevel": integer
}
Fields
minApiLevel

integer

The minimum desired Android Framework API level. If the device doesn't meet the minimum requirement, this condition is satisfied. Must be greater than zero.

AppAutoUpdatePolicy

Deprecated. Use autoUpdateMode instead.

When autoUpdateMode is set to AUTO_UPDATE_POSTPONED or AUTO_UPDATE_HIGH_PRIORITY, this field has no effect.

The app auto-update policy, which controls when automatic app updates can be applied.

Enums
APP_AUTO_UPDATE_POLICY_UNSPECIFIED The auto-update policy is not set. Equivalent to CHOICE_TO_THE_USER.
CHOICE_TO_THE_USER The user can control auto-updates.
NEVER Apps are never auto-updated.
WIFI_ONLY Apps are auto-updated over Wi-Fi only.
ALWAYS Apps are auto-updated at any time. Data charges may apply.

EncryptionPolicy

Type of encryption

Enums
ENCRYPTION_POLICY_UNSPECIFIED This value is ignored, i.e. no encryption required
ENABLED_WITHOUT_PASSWORD Encryption required but no password required to boot
ENABLED_WITH_PASSWORD Encryption required with password required to boot

PlayStoreMode

Possible values for Play Store mode policy.

Enums
PLAY_STORE_MODE_UNSPECIFIED Unspecified. Defaults to WHITELIST.
WHITELIST Only apps that are in the policy are available and any app not in the policy will be automatically uninstalled from the device.
BLACKLIST All apps are available and any app that should not be on the device should be explicitly marked as 'BLOCKED' in the applications policy.

SetupAction

An action executed during setup.

JSON representation
{
  "title": {
    object (UserFacingMessage)
  },
  "description": {
    object (UserFacingMessage)
  },
  "launchApp": {
    object (LaunchAppAction)
  }
}
Fields
title

object (UserFacingMessage)

Title of this action.

description

object (UserFacingMessage)

Description of this action.

launchApp

object (LaunchAppAction)

An action to launch an app.

LaunchAppAction

An action to launch an app.

JSON representation
{
  "packageName": string
}
Fields
packageName

string

Package name of app to be launched

PolicyEnforcementRule

A rule that defines the actions to take if a device or work profile is not compliant with the policy specified in settingName.

JSON representation
{
  "blockAction": {
    object (BlockAction)
  },
  "wipeAction": {
    object (WipeAction)
  },
  "settingName": string
}
Fields
blockAction

object (BlockAction)

An action to block access to apps and data on a fully managed device or in a work profile. This action also triggers a user-facing notification with information (where possible) on how to correct the compliance issue. Note: wipeAction must also be specified.

wipeAction

object (WipeAction)

An action to reset a fully managed device or delete a work profile. Note: blockAction must also be specified.

settingName

string

The top-level policy to enforce. For example, applications or passwordPolicies.

BlockAction

An action to block access to apps and data on a fully managed device or in a work profile. This action also triggers a device or work profile to displays a user-facing notification with information (where possible) on how to correct the compliance issue. Note: wipeAction must also be specified.

JSON representation
{
  "blockAfterDays": integer,
  "blockScope": enum (BlockScope)
}
Fields
blockAfterDays

integer

Number of days the policy is non-compliant before the device or work profile is blocked. To block access immediately, set to 0. blockAfterDays must be less than wipeAfterDays.

blockScope

enum (BlockScope)

Specifies the scope of this BlockAction. Only applicable to devices that are company-owned.

BlockScope

Specifies the scope of BlockAction. Only applicable to devices that are company-owned.

Enums
BLOCK_SCOPE_UNSPECIFIED Unspecified. Defaults to BLOCK_SCOPE_WORK_PROFILE.
BLOCK_SCOPE_WORK_PROFILE Block action is only applied to apps in the work profile. Apps in the personal profile are unaffected.
BLOCK_SCOPE_DEVICE Block action is applied to the entire device, including apps in the personal profile.

WipeAction

An action to reset a fully managed device or delete a work profile. Note: blockAction must also be specified.

JSON representation
{
  "wipeAfterDays": integer,
  "preserveFrp": boolean
}
Fields
wipeAfterDays

integer

Number of days the policy is non-compliant before the device or work profile is wiped. wipeAfterDays must be greater than blockAfterDays.

preserveFrp

boolean

Whether the factory-reset protection data is preserved on the device. This setting doesn’t apply to work profiles.

KioskCustomization

Settings controlling the behavior of a device in kiosk mode. To enable kiosk mode, set kioskCustomLauncherEnabled to true or specify an app in the policy with installType KIOSK.

JSON representation
{
  "powerButtonActions": enum (PowerButtonActions),
  "systemErrorWarnings": enum (SystemErrorWarnings),
  "systemNavigation": enum (SystemNavigation),
  "statusBar": enum (StatusBar),
  "deviceSettings": enum (DeviceSettings)
}
Fields
powerButtonActions

enum (PowerButtonActions)

Sets the behavior of a device in kiosk mode when a user presses and holds (long-presses) the Power button.

systemErrorWarnings

enum (SystemErrorWarnings)

Specifies whether system error dialogs for crashed or unresponsive apps are blocked in kiosk mode. When blocked, the system will force-stop the app as if the user chooses the "close app" option on the UI.

systemNavigation

enum (SystemNavigation)

Specifies which navigation features are enabled (e.g. Home, Overview buttons) in kiosk mode.

statusBar

enum (StatusBar)

Specifies whether system info and notifications are disabled in kiosk mode.

deviceSettings

enum (DeviceSettings)

Specifies whether the Settings app is allowed in kiosk mode.

PowerButtonActions

Sets the behavior of a device in kiosk mode when a user presses and holds (long-presses) the Power button.

Enums
POWER_BUTTON_ACTIONS_UNSPECIFIED Unspecified, defaults to POWER_BUTTON_AVAILABLE.
POWER_BUTTON_AVAILABLE The power menu (e.g. Power off, Restart) is shown when a user long-presses the Power button of a device in kiosk mode.
POWER_BUTTON_BLOCKED The power menu (e.g. Power off, Restart) is not shown when a user long-presses the Power button of a device in kiosk mode. Note: this may prevent users from turning off the device.

SystemErrorWarnings

Specifies whether system error dialogs for crashed or unresponsive apps are blocked in kiosk mode.

Enums
SYSTEM_ERROR_WARNINGS_UNSPECIFIED Unspecified, defaults to ERROR_AND_WARNINGS_MUTED.
ERROR_AND_WARNINGS_ENABLED All system error dialogs such as crash and app not responding (ANR) are displayed.
ERROR_AND_WARNINGS_MUTED All system error dialogs, such as crash and app not responding (ANR) are blocked. When blocked, the system force-stops the app as if the user closes the app from the UI.

SystemNavigation

Specifies which navigation features are enabled (e.g. Home, Overview buttons) in kiosk mode.

Enums
SYSTEM_NAVIGATION_UNSPECIFIED Unspecified, defaults to NAVIGATION_DISABLED.
NAVIGATION_ENABLED Home and overview buttons are enabled.
NAVIGATION_DISABLED The home and Overview buttons are not accessible.
HOME_BUTTON_ONLY Only the home button is enabled.

StatusBar

Specifies whether system info and notifications are disabled in kiosk mode.

Enums
STATUS_BAR_UNSPECIFIED Unspecified, defaults to INFO_AND_NOTIFICATIONS_DISABLED.
NOTIFICATIONS_AND_SYSTEM_INFO_ENABLED

System info and notifications are shown on the status bar in kiosk mode.

Note: For this policy to take effect, the device's home button must be enabled using kioskCustomization.systemNavigation.

NOTIFICATIONS_AND_SYSTEM_INFO_DISABLED System info and notifications are disabled in kiosk mode.
SYSTEM_INFO_ONLY Only system info is shown on the status bar.

DeviceSettings

Specifies whether a user can access the device's Settings app while in kiosk mode.

Enums
DEVICE_SETTINGS_UNSPECIFIED Unspecified, defaults to SETTINGS_ACCESS_ALLOWED.
SETTINGS_ACCESS_ALLOWED Access to the Settings app is allowed in kiosk mode.
SETTINGS_ACCESS_BLOCKED Access to the Settings app is not allowed in kiosk mode.

AdvancedSecurityOverrides

Security policies set to the most secure values by default. To maintain the security posture of a device, we don't recommend overriding any of the default values.

JSON representation
{
  "untrustedAppsPolicy": enum (UntrustedAppsPolicy),
  "googlePlayProtectVerifyApps": enum (GooglePlayProtectVerifyApps),
  "developerSettings": enum (DeveloperSettings),
  "commonCriteriaMode": enum (CommonCriteriaMode)
}
Fields
untrustedAppsPolicy

enum (UntrustedAppsPolicy)

The policy for untrusted apps (apps from unknown sources) enforced on the device. Replaces installUnknownSourcesAllowed (deprecated).

googlePlayProtectVerifyApps

enum (GooglePlayProtectVerifyApps)

Whether Google Play Protect verification is enforced. Replaces ensureVerifyAppsEnabled (deprecated).

developerSettings

enum (DeveloperSettings)

Controls access to developer settings: developer options and safe boot. Replaces safeBootDisabled (deprecated) and debuggingFeaturesAllowed (deprecated).

commonCriteriaMode

enum (CommonCriteriaMode)

Controls Common Criteria Mode—security standards defined in the Common Criteria for Information Technology Security Evaluation (CC). Enabling Common Criteria Mode increases certain security components on a device, including AES-GCM encryption of Bluetooth Long Term Keys, and Wi-Fi configuration stores.

Warning: Common Criteria Mode enforces a strict security model typically only required for IT products used in national security systems and other highly sensitive organizations. Standard device use may be affected. Only enabled if required.

UntrustedAppsPolicy

The policy for untrusted apps (apps from unknown sources) enforced on the device. Replaces installUnknownSourcesAllowed (deprecated).

Enums
UNTRUSTED_APPS_POLICY_UNSPECIFIED Unspecified. Defaults to DISALLOW_INSTALL.
DISALLOW_INSTALL Default. Disallow untrusted app installs on entire device.
ALLOW_INSTALL_IN_PERSONAL_PROFILE_ONLY For devices with work profiles, allow untrusted app installs in the device's personal profile only.
ALLOW_INSTALL_DEVICE_WIDE Allow untrusted app installs on entire device.

GooglePlayProtectVerifyApps

Whether Google Play Protect verification is enforced. Replaces ensureVerifyAppsEnabled (deprecated).

Enums
GOOGLE_PLAY_PROTECT_VERIFY_APPS_UNSPECIFIED Unspecified. Defaults to VERIFY_APPS_ENFORCED.
VERIFY_APPS_ENFORCED Default. Force-enables app verification.
VERIFY_APPS_USER_CHOICE Allows the user to choose whether to enable app verification.

DeveloperSettings

Controls access to developer settings: developer options and safe boot. Replaces safeBootDisabled (deprecated) and debuggingFeaturesAllowed (deprecated).

Enums
DEVELOPER_SETTINGS_UNSPECIFIED Unspecified. Defaults to DEVELOPER_SETTINGS_DISABLED.
DEVELOPER_SETTINGS_DISABLED Default. Disables all developer settings and prevents the user from accessing them.
DEVELOPER_SETTINGS_ALLOWED Allows all developer settings. The user can access and optionally configure the settings.

CommonCriteriaMode

Controls Common Criteria Mode—security standards defined in the Common Criteria for Information Technology Security Evaluation (CC). Enabling Common Criteria Mode increases certain security components on a device, including AES-GCM encryption of Bluetooth Long Term Keys, and Wi-Fi configuration stores.

Warning: Common Criteria Mode enforces a strict security model typically only required for IT products used in national security systems and other highly sensitive organizations. Standard device use may be affected. Only enabled if required.

Enums
COMMON_CRITERIA_MODE_UNSPECIFIED Unspecified. Defaults to COMMON_CRITERIA_MODE_DISABLED.
COMMON_CRITERIA_MODE_DISABLED Default. Disables Common Criteria Mode.
COMMON_CRITERIA_MODE_ENABLED Enables Common Criteria Mode.

PersonalUsagePolicies

Policies controlling personal usage on a company-owned device with a work profile.

JSON representation
{
  "cameraDisabled": boolean,
  "screenCaptureDisabled": boolean,
  "accountTypesWithManagementDisabled": [
    string
  ],
  "maxDaysWithWorkOff": integer,
  "personalPlayStoreMode": enum (PlayStoreMode),
  "personalApplications": [
    {
      object (PersonalApplicationPolicy)
    }
  ]
}
Fields
cameraDisabled

boolean

Whether camera is disabled.

screenCaptureDisabled

boolean

Whether screen capture is disabled.

accountTypesWithManagementDisabled[]

string

Account types that can't be managed by the user.

maxDaysWithWorkOff

integer

Controls how long the work profile can stay off. The duration must be at least 3 days.

personalPlayStoreMode

enum (PlayStoreMode)

Used together with personalApplications to control how apps in the personal profile are allowed or blocked.

personalApplications[]

object (PersonalApplicationPolicy)

Policy applied to applications in the personal profile.

PlayStoreMode

Used together with personalApplications to control how apps in the personal profile are allowed or blocked.

Enums
PLAY_STORE_MODE_UNSPECIFIED Unspecified. Defaults to BLOCKLIST.
BLACKLIST

All Play Store apps are available for installation in the personal profile, except those whose installType is BLOCKED in personalApplications.

BLOCKLIST All Play Store apps are available for installation in the personal profile, except those whose installType is BLOCKED in personalApplications.
ALLOWLIST Only apps explicitly specified in personalApplications with installType set to AVAILABLE are allowed to be installed in the personal profile.

PersonalApplicationPolicy

Policies for apps in the personal profile of a company-owned device with a work profile.

JSON representation
{
  "packageName": string,
  "installType": enum (InstallType)
}
Fields
packageName

string

The package name of the application.

installType

enum (InstallType)

The type of installation to perform.

InstallType

Types of installation behaviors a personal profile application can have.

Enums
INSTALL_TYPE_UNSPECIFIED Unspecified. Defaults to AVAILABLE.
BLOCKED The app is blocked and can't be installed in the personal profile.
AVAILABLE The app is available to install in the personal profile.

AutoDateAndTimeZone

Whether auto date, time, and time zone is enabled on a company-owned device.

Enums
AUTO_DATE_AND_TIME_ZONE_UNSPECIFIED Unspecified. Defaults to AUTO_DATE_AND_TIME_ZONE_USER_CHOICE.
AUTO_DATE_AND_TIME_ZONE_USER_CHOICE Auto date, time, and time zone are left to user's choice.
AUTO_DATE_AND_TIME_ZONE_ENFORCED Enforce auto date, time, and time zone on the device.

OncCertificateProvider

This feature is not generally available.

JSON representation
{
  "certificateReferences": [
    string
  ],
  "contentProviderEndpoint": {
    object (ContentProviderEndpoint)
  }
}
Fields
certificateReferences[]

string

This feature is not generally available.

contentProviderEndpoint

object (ContentProviderEndpoint)

This feature is not generally available.

ContentProviderEndpoint

This feature is not generally available.

JSON representation
{
  "uri": string,
  "packageName": string,
  "signingCertsSha256": [
    string
  ]
}
Fields
uri

string

This feature is not generally available.

packageName

string

This feature is not generally available.

signingCertsSha256[]

string

Required. This feature is not generally available.

Methods

delete

Deletes a policy.

get

Gets a policy.

list

Lists policies for a given enterprise.

patch

Updates or creates a policy.