6.1 Android policies

Android policies are divided into seven categories, which are explained in the following lines:

Passcode

When enabled, this category defines passcode settings like complexity and duration. There are two tabs in this category: Device scope and Profile scope. Device scope applies for full device ownership, while Profile scope applies for the work profile of the device only. See the table below to see the different settings controlled by this category.

Table 2. Android Passcode category settings.

Restrictions

This category includes a series of restrictions that can be applied. They are divided into Functionality, Application, Network & Internet, and Security & Privacy. Some restrictions apply to company-owned devices and others to BYOD. When a restriction applies to BYOD devices, it also applies to company-owned devices. Refer to the table below for an explanation of each restriction.

¹ If a network connection can’t be made at boot time, the escape hatch prompts the user to temporarily connect to a network to refresh the device policy. After applying policy, the temporary network will be forgotten, and the device will continue booting. This prevents being unable to connect to a network if there is no suitable network in the last policy and the device boots into an app in lock task mode, or the user is otherwise unable to reach device settings.

² Controls whether preferential network service is enabled on the work profile. For example, an organization may have an agreement with a carrier that all the work data from its employees’ devices will be sent via a network service dedicated for enterprise use. An example of a supported preferential network service is the enterprise slice on 5G.

Applications

This category controls which apps can be installed or denied. It also controls the installation of apps and kiosk mode.

The Applications category has two tabs: Managed Apps and Kiosk Settings. Kiosk mode will be explained in section nine, for now the focus is the control of applications.

The Managed Applications tab has three sections: General, Always-on VPN and Managed Applications, each of which is explained below.

General section

Here, the policy can be configured to set permissions for all applications added to the device(s).

Refer to the table below for an explanation on these fields.

Table 4. Android policy, general application settings

Always-on VPN section

Android can start a VPN service when the device boots and keep it running while the device or work profile is on. This section allows you to set a specific VPN application for this purpose. Optionally, network access can be blocked if the VPN application loses connectivity (use with caution, as offline devices cannot be managed). The VPN app must be added as a managed application to the policy.

To configure the VPN solution, enter the application package name (e.g., com.wireguard.android) in the corresponding settings. Any Android VPN application is supported. However, it is recommended to use one that supports remote configuration via managed configuration (accessible through the application details in the managed applications list). This is because the VPN solution must be configured before being set to always on. Failure to do so may cause errors on Android devices.

Managed Applications section

This section allows you to add, remove, and edit applications.

Once an app is added to the policy, it can be edited to modify its attributes. These attributes determine how the application will behave, such as whether it is allowed or denied. If allowed, you can further configure how the application will function once installed on the device.

The attributes must be edited for each application individually, they cannot be edited in bulk.

Applications can be System apps, Play Store apps, private apps, or Web apps.

Each added application will have an Application assignment type by default, as defined in the above section, however they can be edited and changed individually. The different assignment types are explained in the table below.

Table 5. Android Application Assignment Types.

Additionally, to the Application assignment type, each application has other attributes that are explained in the table below.

Table 6. Android App attributes.

Note: the attribute list has a second tab called Managed configurations. These configurations are application specific, and the number of fields can vary depending on the app. Refer to the application owner for specifics on these fields.

Follow the steps below to modify attributes of an application.

1. Select the application from the list using the check mark to the left of its name.
2. Click Edit. The edit application policy dialog box appears.
3. Under Assignment type, select the assignment of your preference, per the assignment types shown on Table 5.
4. Continue filling out the rest of the fields or app attributes per Table 6.

The following paragraphs explain how to add each type of app to the policy.

• Follow the steps below to add a Play Store app to the policy.
  1. Click the + Add apps button.
  2. Select Play Store. The Add New Package dialog box appears.

     

  3. Find the app from the list of applications, the search bar can be used to find the app more easily.
  4. Once the desired application is found, click on it and then click Select.

     

• Follow the steps below to add a private app to the policy.
  1. Click the + Add apps button.
  2. Select Play Store. The Add New Package dialog box appears.

     

  3. Select Private Apps on the left side of the Add New Package dialog box (the padlock icon).

     

  4. Click the + icon.
  5. Provide a name for the app and upload the APK file.

     

  6. Click Create.
• Follow the steps below to add a Web app to the policy.
  1. Click the + Add apps button.
  2. Select Play Store. The Add New Package dialog box appears.

     

  3. Select Web Apps on the left side of the Add New Package dialog box (the earth icon).

     

  4. Click the + icon.
  5. Provide a name for the app and the URL. Then select how the web site will be displayed, and optionally upload an icon to identify the app.
     If no icon is uploaded, a generic one will be inserted by NinjaOne.

     

  6. Click Create.
  7. After a few seconds, it will appear in the list as a web application. If more web applications were added before, they would all appear together.
     Note: The newly added web app may take some minutes to be available to be added.

     

  8. Click the newly added icon.
  9. Scroll down and click Select. If the Select button is grayed out, wait a few minutes and try again.
  10. Click Close.
• Follow the steps below to add a System app to the policy.
  1. Click the + Add apps button.
  2. Select System app. The Add New system app dialog box appears.

     

  3. Fill out the app package name, then, select the assignment type from the drop-down. Then, optionally provide a name and publisher for the app.
  4. Click Confirm.

Network

In this category, device’s network settings can be configured, like Proxy and Wi-Fi networks. Multiple Wi-Fi networks can be added, but only one proxy.

Proxy

Use the Manual proxy setup button to configure proxy settings. This action will open the Manual Proxy Setup dialog box.

Turn on the Direct Proxy switch to manually enter the proxy configuration information – Host name and port.

Turn on the Proxy auto-configuration (PAC) switch to enter the URL for the PAC file.

Host names can be excluded from the proxy by writing the name under the Excluded host field and pressing enter.

After entering the information, click the blue Save button. This will add the proxy settings used by the mobile device. Once added, the information can be edited or removed.

Wi-Fi Networks

Use the Add new Wi-Fi Network button to configure a new Wi-Fi network. This action will open the Wi-Fi Network dialog box, then follow the next steps to configure a new Wi-Fi network.

1. Enter a configuration name (a friendly name of your choice to distinguish this Wi-Fi network).
2. Enter the SSID.
3. Under Security, select either ‘WPA-PSK‘ or ‘WEP-PSK‘ as the encryption method. This will bring up the Password field.
4. Enter the password.
5. Select Hidden network if it’s the case.
6. Click Save.
7. The new Wi-Fi network configuration will appear in the list. This network can be edited or removed by selecting it using the check mark to the left of the name.

Security

The Security category allows admins to encrypt the device, manage developer settings, define how data is moved for work, and more. There are 6 sections under this category which will be explained below.

General

• Minimum Android version support (API level). The minimum supported API level.
• Maximum time to lock (seconds). This field defines how many seconds pass before the device is locked and the user is required to input password.
• Encryption Policy—Enable the policy to require a password or not. Options are: Unspecified, Enabled without password and Enabled with password.
• Disabled keyguard customizations—Keyguard customizations are lockscreen items, such as widgets, notifications, camera access, and other tools while the device is locked.
• Battery Plugged Mode—The battery plugged in modes for which the device stays on. This setting is used to force a device to have its screen stay on under specific conditions (e.g., plugged into AC power, on wireless charging or connected to a USB connection). When using this setting, it is recommended to clear Maximum Time To Lock (above) so that the device doesn’t lock itself while it stays on.
• Developer Settings—Defines whether developer options such as system behaviors, quick settings, and safe boot are allowed. For more information about Android developer settings, please refer to Configure on-device developer options  |  Android Studio  |  Android Developers.
• Memory Tagging Extension (MTE). Defines whether MTE (a hardware feature that helps detect and fix memory safety bugs in Android) is used or not.
• Send content to assist apps. Allows for contextual content about the current app or screen state to be provided to assist apps such as Gemini, supported on Android 15+, disable to prevent content from being shared.
• Factory reset protection allowlisted accounts. This feature helps prevent unauthorized factory resets of the device. Enter the email addresses of all device administrators responsible for Factory Reset Protection (FRP), which may include one or more Google accounts. If someone attempts a factory reset, the device will require one of the listed administrators to log in with their Google account to unlock the device.

Custom messaging

Provide messages to notice the end user about unallowed actions or lockscreen.

• Short support message. Provide a short message that will be displayed on the device´s screen when an action is not permitted.
• Long support message. Provide a long message that will be displayed on the device´s screen when the user taps for more information on the action disallowed prompt.
• Lock screen message. Define a message that appears on the lockscreen of the device.

Personal Usage Policies

• Camera Disabled. Turn on this switch to disable the device camera.
• Screen Capture Disabled. Turn on this switch to disable taking screenshots.
• Controls how long the work profile can stay off (days). This setting is for COPE devices which can disable the work profile. It controls the maximum number of days that the work profile can be disabled. If the limit is reached and the work profile is not re-enabled, all personal applications are disabled, and the device can only be used for calls.

Cross-profile policies applied on the device

• Shown in personal profile contact searches and incoming calls.

This setting controls whether work contacts are displayed when receiving a call and when searching for contacts in the personal contacts app.

Drop-down menu.

• Unspecified. Default to “Allowed”.
• Disallowed. Contacts are not displayed.
• Allowed. Contacts are displayed.

• Copy and paste between profiles. Drop-down menu that controls whether copy and paste is allowed across personal and work profiles.
• Unspecified. Defaults to “Disallowed.”
• Disallowed. Copying and pasting across personal and work profiles is not allowed.
• Allowed. Copying and pasting across personal and work profiles is allowed.

• Data from either profile can be shared with the other profile. Drop-down menu that controls whether data can be shared between profiles.
• Unspecified. Defaults to “Disallowed.”
• Disallowed. Data cannot be shared between profiles.
• From Work to personal Disallowed. Data can be shared from personal profile to the work profile, but not the other way around.
• Allowed. Data can be shared from one profile to another.

System update configuration

• Type. Drop-down menu that controls how the OS and apps update will be performed. See below the explanation for each option.
• Unspecified. When updates are available, the user is prompted to install them.
• Automatic. Updates are installed as soon as they become available, without user intervention. If a reboot is required, it will occur automatically, which may disrupt ongoing work.
• Windowed. Updates are installed when available, but only during a specified update window. Selecting this option allows you to configure the update window.
  Start minutes: (0-1439 minutes). Specifies the time after midnight, in minutes, when the update window begins.
  End minutes: (0-1439 minutes). Specifies the time after midnight, in minutes, when the update window ends.
• Postpone. The update will not be performed.

Freeze periods

Freeze Periods are timeframes during which over-the-air system updates are paused to maintain the current OS version on a device. To avoid indefinite freezing, each freeze period can last up to 90 days and must be followed by a minimum of 60 days before another freeze period can begin.
To add a freeze period, follow the steps below.

1. Click the Add freeze periods button. The Add freeze periods dialog box appears.

   
2. Enter the start date and the End date.
3. Click Save.
   Multiple freezing periods can be added, considering restrictions.

Policy enforcement

Policy enforcement rules are rules that define behavior when a policy cannot be enforced on a device. For example, blocking access to a certain setting in a work profile or on the entire device for a specific number of days. If certain aspects of the policy are not enforced correctly, there is an additional option to wipe the device. Follow the steps below to add a policy enforcement rule:

1. Select Policy enforcement on the left side panel of the policy editor.
2. Click +Add. The Add new policy enforcement dialog box appears.

   

3. Under Setting Name, select setting you want to block. Refer to Table 6. (below) for an explanation for each setting.
   

   Setting Name	Description
   Applications	Policy settings applied to applications.
   Keyguard disabled	Disabled Lock Screen for primary and/or secondary displays.
   Permitted accessibility services	If the field is not set, any accessibility service can be used. If the field is set, only the accessibility services in this list and the system’s built-in accessibility service can be used. In particular, if the field is set to empty, only the system’s built-in accessibility services can be used. This can be set on fully managed devices and on work profiles. When applied to a work profile, this affects both the personal profile and the work profile.
   Permitted input methods	If present, only the input methods provided by packages in this list are permitted. If this field is present, but the list is empty, then only system input methods are permitted.
   Minimum API level	Minimum allowed Android API level.
   Recommended global proxy	The network-independent global HTTP proxy. Typically, proxies should be configured per-network in Network configuration. However, for unusual configurations like general internal filtering a global HTTP proxy may be useful. If the proxy is not accessible, network access may break. The global proxy is only a recommendation, and some apps may ignore it.
   Location mode	Degree of location detection enabled.
   Always on VPN Package	Specifies whether the app is allowed networking when the VPN is not connected and enabled. Only supported on devices running Android 10 and above.
   Bluetooth config disabled	Whether configuring Bluetooth is enabled.
   Encryption policy	Encryption configuration.
   Permission grants	Explicit permission grants or denials for the app.
   Password policies	Password requirement policies. Different policies can be set for work profile or fully managed devices by setting the password Scope field in the policy.
   Advanced security overrides	Security policies set to secure values by default. To maintain the security posture of a device, we don’t recommend overriding any of the default values.
   Personal usage policies	Policies managing personal usage on a company-owned device.
   Cross-profile policies	Cross-profile policies applied on the device.

   Table 6. Policy enforcement settings

4. Fill out the Block scope, Block after days, Wipe after days and Preserve Frp fields. Refer to Table 5 (below) for an explanation of each field.
   

   Field	Description
   Block Scope	Block access to apps and data on a company owned device or in a work profile. This action also triggers a user-facing notification with information (where possible) on how to correct the compliance issue.
   Block after days	Optionally, set a specific date for the setting to be blocked X days following the date the policy changes are saved.
   Wipe after days	An action to reset a company owned device or delete a work profile. This number must be greater then “Block after days” and up to 30.
   Preserve Frp	Optionally, preserve the factory reset protection for personal profiles.

   Table 7. Policy enforcement scope and actions.

5. Click Save Changes.
   
   Once the policies are set, you can edit or delete them by hovering the mouse over the policy row and clicking the ellipsis button.

   

Location tracking

This category enables location tracking and specifies the accuracy and frequency of location updates.

Follow the instructions below to enable location tracking.

1. Click Enable.
2. Select accuracy: Balanced mode is accurate to within 100 meters and consumes less battery. High Accuracy mode captures the best available location but consumes more battery.
3. Select the location update frequency: Distance traveled means a location update is sent to the server after the device moves a specified distance (500 m, 1000 m or 5000 m). Time based means a location update is sent to the server based on time. Options are five minutes, 30 minutes, one hour, six hours, 12 hours or 24 hours.
4. Click Save.
   Note: Enabling location tracking automatically installs the NinjaOne Assist mobile app, which users can’t remove. Additionally, location tracking services must be allowed on the Android device.

iOS policites

iOS policies are divided into six categories, which are explained in the following lines:

Passcode

When enabled, this category defines passcode settings like complexity, history, etc. See the table below to see the different settings controlled by this category.

Table 8. iOS policy passcode settings.

Restrictions 

Through this category, there is a series of restrictions that can be applied, they are divided into Functionality, Application, Network, Security & Privacy, Media, iCloud and Classroom. Some restrictions apply to supervised, others to unsupervised. All restrictions are displayed under their appropriate category and can be filtered using the Category dropdown at the top of the page; they can be enabled or disabled by checking/unchecking the box next to the restriction name. The policy configuration will be sent to all devices managed by the policy. Refer to the sections below for an explanation of each restriction.

Functionality restrictions

The table below explains the functionality restrictions for iOS policies. Some apply to supervised enrollment while others to unsupervised.

Table 9. iOS policy functionality restrictions.

Application restrictions

The table below explains the application restrictions for iOS policies. Some apply to supervised enrollment while others to unsupervised.

Table 10. iOS policy application restrictions.

Security & privacy restrictions

The table below explains the Security & Privacy restrictions for iOS policies. Some apply to supervised enrollment while others to unsupervised.

Table 11. iOS policy security & privacy restrictions.

Media restrictions

The table below explains the Media restrictions for iOS policies. Some apply to supervised enrollment while others to unsupervised.

Table 12. iOS policy media restrictions.

iCloud restrictions

The table below explains the iCloud restrictions for iOS policies. Some apply to supervised enrollment while others to unsupervised.

Classroom restrictions

The table below explains the classroom restrictions for iOS policies. Some apply to Supervised enrollment while others to unsupervised.

Table 14. iOS policy classroom restrictions.

Applications

This category controls which apps are available to end users, and which apps are blocked from use. In addition, NinjaOne’s MDM supports apps assigned through Apple’s App and Books feature – formerly Volume Purchase Program (VPP). Apple Business Manager (ABM) content tokens are supported per organization/location, and provides information related to the token, assigned apps, and licenses from the MDM Configuration page in NinjaOne. To learn more about Apple’s App and Books, consult the Buying content through apps and books tutorial.

Follow the steps below to add and configure apps in a policy.

Click + Add apps.

1. Switch between the Apps and Books and Public App Store tabs depending on the type of app you want to add. Please note that if you do not have your Apps and Books token set up you will not see any content under the Apps and Books tab.
2. Type the name of the app or the app’s publisher into the search field. If you’re unsure what to enter, you can simply type a single letter and then click Search. A list of matching applications will appear.
3. Click the desired application. A dialog box will appear.

   

4. Select the assignment type from the drop-down (force installed or blocked). Note that the Blocked assignment type is only supported on supervised devices.
5. If the selection was blocked, go to step eight.
6. If the selection was Force Installed, fill out the remaining fields.

   

   Note: If you opt to remove the app when a device is removed from a policy, this function also applies when you switch a device’s policy under the Settings tab on the device dashboard if the new policy does not also have the app included.

7. Click Add. You can continue adding applications, once you’re done,
8. Click Save on the upper right side of the screen. Enter your MFA response method and close.

The app(s) will now appear under Managed Applications, displaying its details and assignment type. When the policy attempts to install an application via the Public App Store on company-supervised devices, or through any method on unsupervised devices, the end user receives a notification on their device. The user may need to sign in with an Apple ID and enter their password to complete the installation. Additionally, the user must select Install to proceed with the installation.

Network

In this category, device’s network settings can be configured, like Proxy and Wi-Fi networks. Multiple Wi-Fi networks can be added, but only one proxy.

Proxy

Use the Manual proxy setup button to configure proxy settings. This action will open the Manual Proxy Setup dialog box.

Turn on the Direct Proxy switch to manually enter the proxy configuration information – Host name and port.

Turn on the Proxy auto-configuration (PAC) switch to enter the URL for the PAC file.

Host names can be excluded from the proxy by writing the name under the Excluded host field and pressing enter.

After entering the information, click the blue Save button. This will add the proxy settings used by the mobile device. Once added, the information can be edited or removed.

Wi-Fi Networks

Use the Add new Wi-Fi Network button to configure a new Wi-Fi network. This action will open the iOS policy Wi-Fi Network Dialog Box, then follow the next steps to configure a new Wi-Fi network.

1. Enter a configuration name (a friendly name of your choice to distinguish this Wi-Fi network).
2. Enter the SSID.
3. Under Security, select the encryption method, options are: ‘WEP-PSK‘, ‘WPA-PSK‘, ‘WPA2-PSK‘, ‘WPA3-PSK‘, Any or None.
4. Enter the password.
5. Select the additional options if required (Auto Join, Enable IPv6, Hidden Network, Hotspot or Random MAC Address).
6. Select the proxy method (Auto, Manual or None).
7. Click Save.
8. The new Wi-Fi network configuration will appear on the list. This network can be edited or removed by selecting it using the check mark to the left of the name.

OS updates

This category defines how users can install software updates and defines enforced OS versions.

• Type of updates that can be self-installed (iOS 18+). This option controls what updates will be installed. Options are: All available updates, Highest available update, and Lowest available update.
• Allow user to install beta OS versions (iOS 18+). This option controls the installation of beta OS versions. The available settings are: Allowed, Always On, and Always Off.
• Delay when new iOS updates can be self-installed. This option delays the availability of a released operating system (OS) update for the device. When enabled, you can specify the delay duration, which can range from 1 to 90 days.
• Allow the user to install Rapid Security Responses. If enabled, critical security updates released by Apple will be installed. RSRs are released more quickly than traditional OS updates.
• Allow the user to remove Rapid Security Responses. This option controls the ability for a used to remove RSRs.
• Show additional notifications for scheduled updates (iOS 18+). If enabled, users will receive daily notifications for updates scheduled in the future. If disabled, users will only receive notifications beginning one hour before the scheduled deadline.
• Manually scheduled updates. This option is used to enforce software updates. An approval date is set to give the user the option to install the update voluntarily. If the user does not install the update by the approval date, an enforcement date ensures the update is installed automatically.

Location tracking

This category enables location tracking and specifies the accuracy and frequency of location updates.

Follow the instructions below to enable location tracking.

1. Click Enable.
2. Select accuracy: Balanced mode is accurate to within 100 meters and consumes less battery. High Accuracy mode captures the best available location but consumes more battery.
3. Select the location update frequency: Distance traveled means a location update is sent to the server after the device moves a specified distance (500 m, 1000 m or 5000 m). Time based means a location update is sent to the server based on time. Options are five minutes, 30 minutes, one hour, six hours, 12 hours or 24 hours.
4. Click Save.

Note: Location tracking requires the NinjaOne Assist app to be installed and active on the device, with Location Services enabled. The app must also be added to the policy as a managed application with Forced Install selected.