Android Enterprise feature list

Page Summary

outlined_flag

• EMM solutions managing over 500 devices must support all standard features of at least one solution set to be commercially available.

• Various methods exist for provisioning devices with work profiles, fully managed setups, or dedicated device configurations based on Android version and ownership type.

• Android Enterprise offers robust device security features including security challenges, remote wipe/lock, and compliance enforcement.

• Account and app management features cover enterprise binding, silent app distribution, managed configuration, and programmatic app approval.

• Device management features include runtime permission and Wi-Fi configuration management, certificate and VPN management, and control over system settings.

This page lists the complete set of Android Enterprise features.

If you intend to manage more than 500 devices, your EMM solution must support all the standard features (star) of at least one solution set before it can be made commercially available. EMM developers that would like their solutions listed in Android's Enterprise Solutions Directory as offering a Standard Management Set must pass standard feature verification and become a member of our Android Enterprise Partner Program.

An extra set of advanced features is available for each solution set. These features are denoted in each solution set page: work profile on personally-owned device, work profile on company-owned device, fully managed device, and dedicated device. EMM developers that are AE partner program members with solutions that pass advanced feature verification are listed in Android's Enterprise Solutions Directory as offering an Advanced Management Set.

Key

1. Device provisioning

1.1. DPC-first work profile provisioning

1.1.1. The EMM provides an IT admin with a QR code or activation code to support this provisioning method (go to enrolling and provisioning a device).

1.2. DPC-identifier device provisioning

1.2.1. The EMM provides an IT admin with a QR code or activation code to support this provisioning method (go to enrolling and provisioning a device).

1.3. NFC device provisioning

1.3.1. EMMs must use NFC Forum Type 2 Tags with at least 888 bytes of memory. Provisioning must use provisioning extras to pass non-sensitive registration details such as server IDs and enrollment IDs to a device. Registration details shouldn't include sensitive information, such as passwords or certificates.

1.3.2. We recommend the use of NFC tags for Android 10 onwards due to the deprecation of NFC Beam (also known as NFC Bump).

1.4. QR code device provisioning

1.4.1. The QR code must use provisioning extras to pass non-sensitive registration details (such as server IDs, enrollment IDs) to a device. Registration details must not include sensitive information, such as passwords or certificates.

1.5. Zero-touch enrollment

This requirement has been replaced by requirement 1.6.

1.6. Zero-touch provisioning

1.6.1. IT admins can provision a company-owned device using the zero-touch enrollment method.

1.6.2. This requirement is deprecated.

1.6.3. Using the sign-in URL, the EMM must ensure that unauthorized users can't proceed with activation. At a minimum, activation must be locked down to users of a given enterprise.

1.6.4. Using the sign-in URL, the EMM must make it possible for IT admins to pre-populate registration details (for example server IDs, enrollment IDs) aside from unique user or device information (for example username/password, activation token), so that users don't have to enter details when activating a device.

• EMMs must not include sensitive information, such as passwords or certificates, in the zero-touch enrollment's configuration.

1.7. Google Account work profile provisioning

This requirement is removed and replaced by requirement 3.23.

1.8. Google Account device provisioning

This requirement is removed and replaced by requirement 3.23.

1.9. Direct zero-touch configuration

IT admins can use the EMM's console to set up zero-touch devices using the zero-touch iframe.

1.10. Work profiles on company-owned devices

1.10.1. Deliberately blank.

1.10.2. IT admins can set compliance actions for work profiles on company-owned devices through PersonalUsagePolicies.

1.10.3. IT admins can deactivate the camera in either the work profile or the entire device through PersonalUsagePolicies.

1.10.4. IT admins can deactivate screen capture in either the work profile or an entire device through PersonalUsagePolicies.

1.10.5. IT admins can set a blocklist of applications that cannot be installed in the personal profile through PersonalApplicationPolicy.

1.10.6. IT admins can relinquish management of a company-owned device by using the relinquish command in AMAPI.

1.11. Dedicated device provisioning

IT admins can enroll dedicated devices without the user being prompted to authenticate with a Google Account.

2. Device security

2.1. Device security challenge

2.1.1. Policy must enforce settings managing device security challenges (parentProfilePasswordRequirements for work profile, passwordRequirements for fully managed and dedicated devices).

2.1.2. The password complexity should map to the following password complexities:

1. PASSWORD_COMPLEXITY_LOW - pattern or pin with repeating (4444) or ordered (1234, 4321, 2468) sequences.
2. PASSWORD_COMPLEXITY_MEDIUM - PIN with no repeating (4444) or ordered (1234, 4321, 2468) sequences, alphabetic, or alphanumeric password with a length of at least 4
3. PASSWORD_COMPLEXITY_HIGH - PIN with no repeating (4444) or ordered (1234, 4321, 2468) sequences and a length of at least 8 or alphabetic or alphanumeric passwords with a length of at least 6

2.1.3. Additional password restrictions can also be enforced as legacy settings on company-owned devices.

2.2. Work security challenge

2.2.1. Policy must enforce the security challenge for the work profile.

1. By default, IT admins should set restrictions only for the work profile if no scope is specified
2. IT admins can set this device-wide by specifying the scope (see requirement 2.1)

2.2.2. The password complexity should map to the following predefined password complexities:

1. PASSWORD_COMPLEXITY_LOW - pattern or pin with repeating (4444) or ordered (1234, 4321, 2468) sequences.
2. PASSWORD_COMPLEXITY_MEDIUM - PIN with no repeating (4444) or ordered (1234, 4321, 2468) sequences, alphabetic, or alphanumeric password with a length of at least 4
3. PASSWORD_COMPLEXITY_HIGH - PIN with no repeating (4444) or ordered (1234, 4321, 2468) sequences and a length of at least 8 or alphabetic or alphanumeric passwords with a length of at least 6

2.2.3. Additional password restrictions can also be enforced as legacy settings

2.3. Advanced passcode management

2.3.1. Deliberately blank.

2.3.2. Deliberately blank.

2.3.3. The following password lifecycle settings can be set for each lock screen available on a device:

1. Deliberately blank
2. Deliberately blank
3. Maximum failed passwords for wipe: Specifies the number of times users can enter an incorrect password before corporate data is wiped from the device. IT admins must be able to turn off this feature.

2.3.4. (Android 8.0+) Strong Authentication required timeout: A strong authentication passcode (such as PIN or password) must be input after a timeout period set by an IT admin. After the timeout period, non-strong authentication methods (such as fingerprint, face unlock) are turned off until the device is unlocked with a strong authentication passcode.

2.4. Smart lock management

2.4.1. IT admins can disable trust agents on the device.

2.5. Wipe and lock

2.5.1. Devices must be locked using the Android Management API .

2.5.2. Devices must be wiped using the Android Management API .

2.6. Compliance enforcement

2.6.1. At minimum, the security policies enforced on a device must include password policy.

2.7. Default security policies

2.7.1. Installing apps from unknown sources must be blocked, including apps installed on the personal side of any Android 8.0+ device with a work profile. This subfeature is supported by default.

2.7.2. Debugging features must be blocked. This subfeature is supported by default.

2.8. Security policies for dedicated devices

2.8.1. Booting into safe mode must be turned off by default using policy (Go to safeBootDisabled).

2.9. Play Integrity Support

Play Integrity checks are made by default. No extra implementation is required.

2.9.1. Deliberately blank.

2.9.2. Deliberately blank.

2.9.3. IT admins can set up different policy responses based on the value of the device's SecurityRisk , including blocking provisioning, wiping corporate data, and allowing enrollment to proceed.

• The EMM service will enforce this policy response for the result of each integrity check.

2.9.4. Deliberately blank.

2.10. Verify Apps enforcement

IT admins can turn on Verify Apps on devices. Verify Apps scans apps installed on Android devices for harmful software before and after they're installed, helping to ensure that malicious apps can't compromise corporate data.

2.10.1. Verify Apps must be turned on by default using policy (Go to ensureVerifyAppsEnabled).

2.11. Direct Boot support

The Android Management API supports this feature by default. No extra implementation is required.

2.12. Hardware security management

2.12.1. IT admins can block users from mounting physical external media using policy (go to mountPhysicalMediaDisabled).

2.12.2. IT admins can block users from sharing data from their device using NFC beam using policy (go to outgoingBeamDisabled). This subfeature is optional since NFC beam function is no longer supported in Android 10 and higher.

2.12.3. IT admins can block users from transferring files over USB using policy (go to usbFileTransferDisabled).

2.13. Enterprise security logging

The Android Management API doesn't support this feature.

3. Account and app management

3.1. Enterprise binding

3.1.1. An admin with an existing managed Google Domain can bind their domain to the EMM.

3.1.2. Deliberately blank.

3.1.3. Deliberately blank.

3.1.4. The EMM console guides the admin to enter their work email address in the Android signup flow and discourages them from using a Gmail account.

3.1.5. The EMM pre-fills the admin's email address in the Android signup flow.

3.2. Managed Google Play Account provisioning

3.2.1. Managed Google Play Accounts (user accounts) are automatically created when devices are provisioned.

The Android Management API supports this feature by default. No extra implementation is required.

3.3. Managed Google Play device account provisioning

3.3.1. Managed Google Play Accounts are automatically created when devices are provisioned.

The Android Management API supports this feature by default. No extra implementation is required.

3.4. Managed Google Play Account provisioning for legacy devices

This feature is deprecated.

3.5. Silent app distribution

3.5.1. The EMM's console must use the Android Management API to allow IT admins to install work apps on managed devices.

3.5.2. The EMM's console must use the Android Management API to allow IT admins to update work apps on managed devices.

3.5.3. The EMM's console must use the Android Management API to allow IT admins to uninstall apps on managed devices.

3.6. Managed configuration management

IT admins can view and silently set managed configurations for any app that supports managed configurations.

3.6.1. The EMM's console must be able to retrieve and display the managed configuration settings of any Play app.

3.6.2. The EMM's console must allow IT admins to set any configuration type (as defined by the Android Enterprise framework) for any Play app using the Android Management API .

3.6.3. The EMM's console must allow IT admins to set wildcards (such as $username$ or %emailAddress%) so that a single configuration for an app such as Gmail can be applied to multiple users.

3.7. App catalog management

The Android Management API supports this feature by default. No additional implementation is required.

3.8. Programmatic app approval

3.8.1. IT admins can search for apps and approve them within the EMM's console using the managed Google Play iframe.

3.9. Basic store layout management

3.9.1. The EMM's console should allow IT admins to manage the apps visible in an end user's basic store layout.

3.10. Advanced store layout configuration

3.10.1. IT admins can customize the store layout seen in the managed Google Play Store app.

3.11. App license management

This feature is deprecated.

3.12. Google-hosted private app management

3.12.1. IT admins can upload new versions of apps that are already published privately to the enterprise using:

• The managed Google Play iframe , or
• the Google Play Developer Publishing API .

3.13. Self-hosted private app management

This feature is deprecated.

3.14. EMM pull notifications

This feature is not applicable to the Android Management API. Set up Pub/Sub notifications instead.

3.15. API usage requirements

3.15.1. The EMM must adhere to the Android Management API usage limits. Not correcting behavior that exceeds these guidelines may result in suspension of API use, at Google's discretion.

3.15.2. The EMM should distribute traffic from different enterprises throughout the day, rather than consolidating enterprise traffic at specific or similar times. Behavior that fits this traffic pattern, such as scheduled batch operations for each device enrolled, may result in suspending API use, at Google's discretion.

3.15.3. The EMM shouldn't make consistent, incomplete, or deliberately incorrect requests that make no attempt to retrieve or manage actual enterprise data. Behavior that fits this traffic pattern may result in suspended API use, at Google's discretion.

3.16. Advanced managed configuration management

3.16.1. The EMM's console must be able to retrieve and display the up to four levels of nested managed configuration settings of any Play app, using:

• The managed Google Play iframe , or
• a custom UI.

3.16.2. The EMM's console must be able to retrieve and display any feedback returned by an app's feedback channel , when set up by an IT admin.

• The EMM's console must allow IT admins to associate a specific feedback item with the device and app it originated from.
• The EMM's console must allow IT admins to subscribe to alerts or reports of specific message types (such as error messages).

3.16.3. The EMM's console must only send values that either have a default value or are manually set by the admin using:

• The managed configurations iframe, or
• A custom UI.

3.17. Web app management

3.17.1. The EMM console allows IT admins to distribute shortcuts to web apps using:

• The Managed Google Play iframe,
• or the Android Management API .

3.18. Managed Google Play Account lifecycle management

This feature is supported by default. No extra EMM implementation is required.

3.19. Application track management

3.19.2. IT Admins can set devices to use a particular development track for an application.

3.20. Advanced application update management

3.20.1. IT admins can allow apps to use high-priority app updates to be updated when an update is ready.

3.20.2. IT admins can allow apps to have their app updates postponed for 90 days.

3.21. Provisioning methods management

The EMM can generate provisioning configurations and present these to the IT admin in a form ready for distribution to end users (such as QR code, zero-touch configuration, Play Store URL).

3.22. Upgrade Enterprise binding

3.22.1. The EMM console allows the IT admin to trigger the upgrade of an existing managed Google Play Accounts enterprise to a managed Google Domain enterprise using the requisite APIs .

3.22.2. EMMs should use Pub/Sub to receive notifications about IT admin-initiated upgrade events (even those occurring outside the EMM console) and update their UI to reflect these changes.

3.23. Managed Google Account provisioning

3.23.1. The EMM can provision a managed Google Account according to the defined implementation guidelines.

In doing so:

• A managed Google Account is added to the device.
• The managed Google Account must have a 1 to 1 mapping with actual users in the EMM's console.

3.23.2. The IT admin can use the policy to provide users the option to sign in to a managed Google Account for enrollment.

3.23.3. The IT admin can use the policy to control whether the user is required to sign in to a managed Google Account to complete enrollment.

3.23.4. IT admins can optionally restrict the upgrade flow to a specific account identifier (email address) for a given device.

3.24. Managed Google Play Account upgrade

3.24.1. IT admins can upgrade an existing managed Google Play Accounts on a device to a managed Google Account.

3.24.2. IT admins can optionally restrict the upgrade flow to a specific account identifier (email address) for a given device.

3.25. App Roles

3.25.1. Companion apps are optional and allow the EMM to extend management functions using their own local client on a device. If your solution includes a companion app, you must automatically (i.e. without IT admin input) assign your app the correct COMPANION_APP role. This role shouldn't be configurable by the IT admin.

3.25.2. The EMM console allows an IT admin to assign any of the roles specified in RoleType except COMPANION_APP which is assigned by the EMM.

3.25.3 The EMM can suggest appropriate apps for each role, but must not restrict the app choices to an arbitrary list.

3.26. Device data transfer and restore

3.26.1. The EMM console allows IT admins to enable the backup service by setting backupService to BACKUP_SERVICE_USER_CHOICE in AMAPI, as the feature is disabled by default on fully managed devices.

4. Device management

4.1. Runtime permission policy management

4.1.1. IT admins must be able to choose from the following options when setting a default runtime permission policy for their organization:

• prompt (allows users to choose)
• allow
• deny

The EMM should enforce these settings using policy .

4.2. Runtime permission grant state management

4.2.1. IT admins must be able to set the grant state (default, grant, or deny) of any permission requested by any work app built on API 23 or higher. The EMM should enforce these settings using policy.

4.3. Wi-Fi configuration management

4.3.1. SSID, using policy.

4.3.2. Password, using policy.

4.4. Wi-Fi security management

IT admins can provision enterprise Wi-Fi configurations on devices that include the following advanced security features:

4.4.1. Identity

4.4.2. Certificates for client authorization

4.4.3. CA certificates

4.5. Advanced Wi-Fi management

4.5.1. IT admins can lock down corporate Wi-Fi configurations using policy in either of the following configurations:

• Users cannot modify any Wi-Fi configurations provisioned by the EMM (go to wifiConfigsLockdownEnabled), but may add and modify their own user-configurable networks (for example personal networks).
• Users cannot add or modify any Wi-Fi network on the device (go to wifiConfigDisabled), limiting Wi-Fi connectivity to just those networks provisioned by the EMM.

4.6. Account management

4.6.1. IT admins can prevent users from adding or modifying accounts (see modifyAccountsDisabled).

• When enforcing this policy on a device, EMMs must set this restriction before provisioning is complete, to ensure users cannot circumvent this policy by adding accounts before the policy is enacted.

4.7. Workspace account management

This feature is deprecated. See 3.23. for replacement requirements.

4.8. Certificate management

4.8.1. IT admins can install user identity certs generated by their PKI on a per-user basis. The EMM's console must integrate with at least one PKI and distribute certificates generated from that infrastructure.

4.8.2. IT admins can install certificate authorities (see caCerts) in the managed keystore. However, this subfeature is unsupported .

4.9. Advanced certificate management

4.9.1. For any app distributed to devices, IT admins can specify a certificate the app will be silently granted access during runtime. (This subfeature is not supported)

• Certificate selection must be generic enough to allow a single configuration that applies to all users, each of which may have a user-specific identity certificate.

4.9.2. IT admins can silently remove certificates from the managed keystore.

4.9.3. IT admins can silently uninstall a CA certificate. (This subfeature is not supported)

4.9.4. IT admins can prevent users from configuring credentials (go to credentialsConfigDisabled) in the managed keystore.

4.9.5. IT admins can pre-grant certificates for work apps using ChoosePrivateKeyRule.

4.10. Delegated certificate management

4.10.1. IT admins can specify a certificate management package (go to CERT_INSTALL DelegatedScope) to be set as the delegated certificate management app.

• The EMM's may optionally suggest known certificate management packages, but must allow the IT admin to choose from the list of apps available for install, for applicable users.

4.11. Advanced VPN management

4.11.1. IT admins can specify an arbitrary VPN package to be set as an Always On VPN.

• The EMM's console may optionally suggest known VPN packages that support Always On VPN, but can't restrict the VPNs available for Always On configuration to any arbitrary list.

4.11.2. IT admins can use managed configurations to specify the VPN settings for an app.

4.12. IME management

4.12.1. IT admins can set up an IME allowlist (Go to permitted_input_methods) of arbitrary length (including an empty list, which blocks non-system IMEs), which may contain any arbitrary IME packages.

• The EMM's console may optionally suggest known or recommended IMEs to include in the allowlist, but must allow IT admins to choose from the list of apps available for install, for applicable users.

4.12.2. The EMM must inform IT admins that system IMEs are excluded from management on devices with work profiles.

4.13. Advanced IME management

4.13.1. IT admins can set up an IME allowlist (go to permitted_input_methods) of arbitrary length (excluding an empty list, which blocks all IMEs including system IMEs), which may contain any arbitrary IME packages.

• The EMM's console may optionally suggest known or recommended IMEs to include in the allowlist, but must allow IT admins to choose from the list of apps available for install, for applicable users.

4.13.2. EMM must prevent IT admins from setting up an empty allowlist, as this setting will block all IMEs including system IMEs from being set up on the device.

4.13.3. EMM must ensure that if an IME allowlist does not contain system IMEs, the third-party IMEs are silently installed before the allowlist is applied on the device.

4.14. Accessibility services management

4.14.1. IT admins can set up an accessibility service allowlist (go to permittedAccessibilityServices) of arbitrary length (including an empty list, which blocks non-system accessibility services), which may contain any arbitrary accessibility service package. When applied to a work profile, this affects both the personal profile and the work profile.

• Console may optionally suggest known or recommended accessibility services to include in the allowlist, but must allow IT admin to choose from the list of apps available for install, for applicable users.

4.15. Location Sharing management

4.15.1. IT admins can disable location services (go to shareLocationDisabled) within the work profile.

4.16. Advanced Location Sharing management

4.16.1. IT admins can set the device location services to each of the following modes:

• High accuracy.
• Sensors only, for example GPS, but not including network-provided location.
• Battery saving, which limits the update frequency.
• Off.

4.17. Factory reset protection management

4.17.1. IT admins can prevent users from factory resetting (go to factoryResetDisabled) their device from Settings.

4.17.2. IT admins can specify corporate unlock account(s) authorized to provision devices (go to frpAdminEmails) after a factory reset.

• This account can be tied to an individual, or used by the entire enterprise to unlock devices.

4.17.3. IT admins can disable factory reset protection (go to factoryResetDisabled) for specified devices.

4.17.4. IT admins can start a remote device wipe that optionally wipes reset protection data, thus removing factory reset protection on the reset device.

4.18. Advanced app control

IT admins can prevent the user from uninstalling or otherwise modifying managed apps through Settings. For example, preventing force closing the app or clearing an app's data cache.

4.18.1. IT admins can block uninstall of any arbitrary managed apps, or all managed apps (go to uninstallAppsDisabled).

4.18.2. IT admins can prevent users from modifying application data from Settings. (The Android Management API doesn't support this subfeature)

4.19. Screen capture management

4.19.1. IT admins can prevent users from capturing screenshots (go to screenCaptureDisabled).

4.20. Disable cameras

4.20.1. IT admins can disable use of device cameras (go to cameraDisabled) by managed apps.

4.21. Network statistics collection

The Android Management API doesn't support this feature.

4.22. Advanced network statistics collection

The Android Management API doesn't support this feature.

4.23. Reboot device

IT admins can remotely restart managed devices.

4.23.1. IT admins can remotely reboot a managed device.

4.24. System radio management

4.24.1. IT admins can turn off cell broadcasts sent by service providers (go to cellBroadcastsConfigDisabled).

4.24.2. IT admins can prevent users from modifying mobile network settings in Settings (go to mobileNetworksConfigDisabled).

4.24.3. IT admins can prevent users from resetting all network settings in Settings. (go to networkResetDisabled).

4.24.4. IT admins can set up whether the device permits mobile data while roaming (go to dataRoamingDisabled).

4.24.5. IT admins can set up whether the device can make outgoing phone calls, excluding emergency calls (go to outGoingCallsDisabled).

4.24.6. IT admins can set up whether the device can send and receive text messages (go to smsDisabled).

4.24.7. IT admins can prevent users from using their device as a portable hotspot by tethering (go to tetheringConfigDisabled).

4.24.8. IT admins can set the Wi-Fi timeout to default, while plugged in, or never. (The Android Management API doesn't support this subfeature)

4.24.9. IT admins can prevent users from setting up or modifying existing Bluetooth connections (go to bluetoothConfigDisabled).

4.25. System audio management

IT admins can silently control device audio features, including muting the device, preventing users from modifying volume settings, and preventing users from unmuting the device microphone.

4.25.1. IT admins can silently mute managed devices. (The Android Management API doesn't support this subfeature)

4.25.2. IT admins can prevent users from modifying device volume settings (go to adjustVolumeDisabled). This also mutes the devices.

4.25.3. IT admins can prevent users from unmuting the device microphone (go to unmuteMicrophoneDisabled).

4.26. System clock management

4.26.1. IT admins can enforce system auto time and auto time zone, preventing the user from setting the date, time, and time zone of the device.

4.27. Advanced dedicated device features

For dedicated devices, IT admins can manage the following features using policy to support various kiosk use cases.

4.27.1. IT admins can turn off the device keyguard (go to keyguardDisabled).

4.27.2. IT admins can turn off the device status bar, blocking notifications and Quick Settings (go to statusBarDisabled).

4.27.3. IT admins can force the device screen to remain on while the device is plugged in (go to stayOnPluggedModes).

4.27.4. IT admins can prevent the following system UIs from being displayed (go to createWindowsDisabled):

• Toasts
• Application overlays.

4.27.5. IT admins can allow the system recommendation for apps to skip their user tutorial and other introductory hints on first start-up (go to skip_first_use_hints).

4.28. Delegated scope management

IT admins are able to delegate extra privileges to individual packages.

4.28.1. IT admins can manage the following scopes:

• Certificate installation and management
• Deliberately blank
• Network logging
• Security logging (not supported for work profile on personally-owned device)

4.29. Enrollment-specific ID Support

Starting in Android 12, work profiles will no longer have access to hardware-specific identifiers. IT admins can follow the lifecycle of a device with a work profile through the enrollment-specific ID, which will persist through factory resets.

4.29.1. IT admins can obtain an enrollment-specific ID

4.29.2. This enrollment-specific ID must persist through a factory reset

4.30. Credential manager policy

4.30.1 IT admins can block all credential managers on the device (or within the Work profile) using policy.

4.30.2 IT admins can by default allow only system credential providers as shown in credential provider policy default.

4.30.3 IT admins can specify a list of package names to enable credential manager functionality.

4.31. Basic eSIM management

4.31.1 IT admins can silently provision an eSIM profile onto a device using policy.

4.31.2 IT admins can delete managed eSIMs from a device using policy.

4.31.3 IT admins can prevent users from modifying mobile network settings in Settings (go to mobileNetworksConfigDisabled).

4.31.4 IT admins can remotely send a wipe command to a device or work profile. This command optionally removes managed eSIMs from the device. By default, managed eSIMs are removed from work profiles on personally-owned devices, but retained on company-owned devices.

4.31.5 IT admins can retrieve the EID (Embedded Identity Document) identifier of a device using the EMM console UI (or equivalent method).

5. Device usability

5.1. Managed provisioning customization

5.1.1. IT admins can customize the provisioning process by specifying enterprise-specific Terms of Service and other disclaimers (go to termsAndConditions).

5.1.2. IT admins can deploy non-configurable, EMM-specific Terms of Service and other disclaimers (go to termsAndConditions).

• EMMs may set their non-configurable, EMM-specific customization as the default for deployments, but must allow IT admins to set up their own customization.

5.1.3. primaryColor has been deprecated for the enterprise resource on Android 10 and higher.

5.2. Enterprise customization

The Android Management API doesn't support this feature.

5.3. Advanced enterprise customization

The Android Management API doesn't support this feature.

5.4. Lock screen messages

5.4.1. IT admins can set a custom lock screen message (go to deviceOwnerLockScreenInfo).

5.5. Policy transparency management

5.5.1. IT admins can customize short and long user-facing support messages.

5.5.2. IT admins can deploy non-configurable, EMM-specific, short and long support messages (go to shortSupportMessage and longSupportMessage in policies).

• EMM may set their non-configurable, EMM-specific support messages as the default for deployments, but must allow IT admins to set up their own messages.

5.6. Cross-profile contact management

5.6.2. IT admins can disable bluetooth contact sharing of work contacts, for example hands-free calling in cars or headsets.

5.7. Cross-profile data management

5.7.1. IT admins can configure cross-profile data sharing policy so that personal apps can resolve intents from the work profile, such as sharing intents or web links.

5.7.2. IT admins can allow applications from the work profile to create and display widgets on the home screen of the personal profile. This capability is turned off by default, but can be set to allowed using workProfileWidgets and workProfileWidgetsDefault fields.

5.7.3. IT admins can control the ability to copy/paste between the work and personal profiles.

5.8. System update policy

5.8.1. The EMM's console allows IT admins to set the following OTA configurations:

• Automatic: Devices install OTA updates when they become available.
• Postpone: IT admins must be able to postpone OTA update for up to 30 days. This policy does not affect security updates (e.g. monthly security patches).
• Windowed: IT admins must be able to schedule OTA updates within a daily maintenance window.

5.8.2. OTA configurations are applied to devices using policy .

5.9. Lock task mode management

5.9.1. The EMM's console allows IT admins to silently allow an arbitrary set of apps to install and lock to a device. Policy allows setting up dedicated devices.

5.10. Persistent preferred activity management

5.10.1. IT admins can set any package as the default intent handler for any arbitrary intent filter.

• The EMM's console may optionally suggest known or recommended intents for configuration, but cannot restrict intents to any arbitrary list.
• The EMM's console must allow IT admins to choose from the list of apps that are available to install for applicable users.

5.11. Keyguard feature management

5.12. Advanced keyguard feature management

• Secure camera
• All notifications
• Unredacted
• Trust agents
• Fingerprint unlock
• All keyguard features

5.13. Remote debugging

The Android Management API doesn't support this feature.

5.14. MAC address retrieval

5.14.1. The EMM can silently retrieve a device's MAC address and can associate it with the device in the EMM's console.

5.15. Advanced lock task mode management

5.15.1. Silently allow a single app to install and lock to a device .

5.15.2. Turn on or off the following System UI features:

• Home button
• Overview
• Global actions
• Notifications
• System info / Status bar
• Keyguard (lock screen). This subfeature is turned on by default when 5.15.1. is implemented.

5.15.3. Turn off System error dialogs.

5.16. Advanced system update policy

5.16.1. The EMM's console must allow IT admins to block over-the-air (OTA) system updates for a specified freeze period.

5.17. Work profile policy transparency management

5.17.1. IT admins can provide custom text to display (go to wipeReasonMessage) when a work profile is wiped.

5.18. Connected app support

IT admins can set a list of packages that can communicate across the work profile boundary by setting ConnectedWorkAndPersonalApp.

5.19. Manual system update

The Android Management API doesn't support this feature.

6. Device Admin Deprecation

This section has been removed.

7. API usage

7.1. Standard policy controller for new bindings

7.2. Standard policy controller for new devices

By default devices must be managed using Android Device Policy for all new device enrollments, for both existing and new bindings. EMMs may provide the option to manage devices using a custom DPC in a settings area under a heading 'Advanced' or similar terminology.