Relution Signet Customer Hub

Restrictions

Targeted restriction of device and app features increases security when using Android devices and can optimize device usage by providing more focus. Controlling device settings and restricting access also prevents third-party apps from accessing corporate data and resources. Restriction availability may vary, depending on device manufacturer and existing OS version. Some of the restrictions are only available on Samsung Knox devices (group Knox specific restrictions).

Misconfigured restrictions can lead to data loss. Admins, customers and the people using the devices are responsible for backing up their own data from individual apps or from the devices.

Applying restrictions to Android devices

  1. In the Relution portal, a new policy is created under Devices → Policies via Add.

  2. An Android policy is created and given a Name. The policy is saved via Save.

  3. Via Add, the Restrictions option is selected, followed by Add details.

  4. After selecting the desired options, the configuration is saved and the current version of the policy is published.

    If Enforce Device Encryption or Enforce SD Card Encryption is enabled, the policy must also contain an enabled Passcode configuration. Otherwise, the version can neither be published nor tested. For effective encryption, a passcode quality should also be set in the passcode configuration.

  5. To apply the policy to Android devices, the desired devices are added via the Devices with this policy tab. The devices are assigned to an existing static device group with this policy or to a newly created static device group. The selected restrictions are then automatically applied on the devices.

Many options in the restrictions offer explanations and extended information via a mouse-over. Options that require a Samsung Knox device are grouped under Knox specific restrictions.

Available restrictions

The Restrictions configuration is divided into three groups. Via the download icon (Export restrictions as CSV file) above the groups, all restrictions and their current values can be exported as a CSV file.

General restrictions

  • Enforce Device Encryption – encrypts accounts, settings, apps and their data, media and other files. Afterwards, a PIN or password has to be entered each time the device is switched on. The encryption can only be removed by a factory reset, which erases all data. The process takes an hour or more; the device should be charged and plugged in, as an interruption can lead to data loss.
  • Deny Camera
  • Deny Camera/Widgets on lock screen – the lock screen must be secured with a PIN, pattern or password.
  • Disable root detection – rooted devices are no longer reported as noncompliant. The device details continue to show the device as rooted.

Roaming

  • Activate restrictions only while roaming – the restrictions are only applied while the device is roaming.
  • Allow on WiFi – only available if the previous option is enabled. The restrictions are then only applied while roaming and not connected to a Wi-Fi network.

Knox specific restrictions

These options are only available on Samsung Knox devices.

SectionOptions
GeneralDeny Screen Capture, Deny Clipboard, Deny to switch GPS on or off, Deny to change date and time, Deny widgets on Lockscreen, Deny shortcuts on Lockscreen
StorageEnforce SD Card Encryption, Deny SD Card Access, Deny SD Card Write
DebuggingDeny USB Debugging, Deny Google crash reporting
USB restrictionsDeny Media Transfer Protocol (MTP), Deny USB Tethering, Deny USB Host Storage
Backup & resetDeny Google Backup, Deny factory reset, Deny OTA upgrade, Deny safe boot
App restrictionsDeny Installation of non Play Store Apps, Deny Google Play, Deny Youtube, Deny Browser, Deny Settings, Deny Voice Dialer

Notes on individual options:

  • Enforce SD Card Encryption requires an alphanumeric device password. The passcode policy can only be changed while the encryption is deactivated.
  • Deny Media Transfer Protocol (MTP) blocks any file transfer via USB, since Android only transfers files via MTP. PTP (Picture Transfer Protocol) is affected as well.
  • Deny USB Host Storage prevents USB sticks, external hard drives or SD card readers from being mounted as storage via USB OTG.
  • Deny safe boot prevents booting into safe mode, which could otherwise be used to leave kiosk mode.
  • Deny Installation of non Play Store Apps blocks the installation of apps from outside Google Play; the user cannot allow it in the Android settings. If the option is disabled, the user can allow the installation in the Android settings; it is not enabled by the option itself.

How helpful was this article?