Customer HubAdvanced security overrides
For devices enrolled in Android Enterprise, the Advanced Security Overrides configuration provides deep control capabilities. Administrators can determine whether the installation of APK files from third-party sources is permitted, whether Google Play Protect verification is enforced, and whether developer mode is available for testing purposes. Settings for the Memory Tagging Extension, content protection, and work profile notifications are also available.
Allow from Unknown Sources
This setting controls whether apps can be installed from sources outside the Google Play Store (side-loading). The following options are available:
- Unspecified (default for new configurations): Relution does not set a value; the Android Enterprise default behavior applies.
- Disallow untrusted app installs on entire device: Side-loading is prohibited across the entire device.
- Allow untrusted app installs in the device’s personal profile only: Side-loading is permitted exclusively within the user’s private profile.
- Allow untrusted app installs on entire device: Side-loading is permitted across the entire device.
Enforce Google Play Verification
Determines whether security scanning by Google Play Protect is mandatory to identify malicious software.
- Unspecified (default for new configurations): Relution does not set a value; the Android Enterprise default behavior applies.
- Yes: Verification is enforced system-wide and cannot be disabled by the user.
- User Choice: The end user decides whether the verification should be active.
Device Encryption Policy
Defines the security level for data encryption on the physical storage.
| Option | Description |
|---|---|
| No encryption required (default) | No encryption of user data is enforced. |
| Encryption required, no password required to boot | Data is encrypted, but no password is required during the boot process. |
| Encryption required, password required to boot | Encryption is active and requires a password to be entered during the startup process. |
How devices that do not meet the required encryption are handled is defined in the Advanced security overrides row of the Compliance enforcement → configuration.
Allow Developer Settings
This defines whether Developer Mode can be unlocked on the device. This is primarily relevant for debugging purposes or app testing. For standard production use, this option should remain disabled for security reasons.
Common Criteria Mode
Common Criteria Mode is used to comply with international security standards for information technology.
The setting is only applied to fully managed devices and to managed devices with a personal profile (COPE). Relution does not transfer it to devices with a work profile (BYOD).
Memory Tagging Extension
Defines the policy for the Memory Tagging Extension (MTE). The setting is marked with the Android 14+, COPE Work profile, and Managed Device badges.
The options Unspecified (default for new configurations), User choice, Enabled, and Disabled are available.
Content Protection
Content protection scans for deceptive apps. The setting is marked with the Android 15+ badge.
The options Unspecified (default for new configurations), User choice, Enabled, and Disabled are available.
Personal Apps That Can Read Work Profile Notifications
Defines which apps in the personal profile may read notifications from the work profile. The setting is marked with the COPE Work profile badge.
Clicking Add opens an app selection in which one or more apps are selected. Their package names are adopted; individual entries can be removed again. If the list remains empty, Relution does not transfer any setting to Google.