Restrictions

By disabling this, users will not be allowed to use the Camera on their devices. On restricting this, the Camera will remain restricted within the Knox container also.

By disabling this, the users are restricted from accessing the Camera from the lock screen of the device. This can be configured only when Camera is allowed on the device.

By disabling this, users will not be able to record videos on their devices. Video Recording can be allowed only when Camera is allowed on the device.

By enabling this, users will be allowed to use the Microphone. If this is disabled, users can use the Microphone only for receiving and making calls. All other voice applications which require the Microphone usage will be restricted.

On restricting this on the device, the Microphone will remain restricted within the Knox container also.

By disabling this, users will not be able to record audios on their devices. Audio recording can be enabled only when the Microphone is enabled on the device.

By disabling this, users cannot perform firmware recovery on the device.

By enabling this, users will be able to perform OS upgrades on their devices.

By enabling this, users will be allowed to capture the screen on the devices.

By enabling this, users will be allowed to access smart clip mode on their devices.

By disabling this, users will be unable to use the S-Voice feature on their devices. S-Voice can be enabled only when the Microphone is enabled on the device.

Enabling this will allow users to add email, exchange, LDAP, and Google accounts on managed devices.
Disabling this prevents users from adding any of these accounts. The account addition is prevented only after the restriction is applied to the devices and the accounts that were already present, are not affected.

All data stored in the internal memory of the device must be encrypted. Ensure your devices are charges up to 80% to begin the encryption process. This restriction is applied only if the device is secured through a passcode. If there is no passcode on the device, you can associate a Passcode policy first and then distribute the restrictions policy.

Encryption is forced on the SD Card. This restriction is applied only if the device is secured by a passcode. If there is no passcode on the device, you can associate a Passcode policy first and then distribute the restrictions policy.

By restricting this, admins can prevent users from resetting devices to their factory settings. Admins can also prevent users from removing devices from management by performing a hard reset by restricting this and also configuring EFRP on the devices.

By disabling this, users will be unable to use the Reactivation Lock feature on their devices to prevent device activation by anyone else in case the device is stolen.

Configure how the notifications appear on the lock screen of the device. Either choose to show all content, hide sensitive content, or completely hide notifications.

Allow/Restrict to install apps not listed on the Play Store. Restricting this disables Install apps from unknown sources settings, for app installation.

By enabling this, users will be allowed to use the Clipboard memory.

By enabling this, users can share the Clipboard content between different applications. This can be enabled only when Clipboard feature is enabled on the device.

By enabling this, users can boot device in Safe mode.

By enabling this, users can use developer options on the device.

By enabling this, users will be allowed to use the share list on their devices.

Google Play Protect regularly checks apps and the devices for any harmful behavior. You can choose to disable this option, if necessary.

By enabling this option, users will be allowed to backup the device data and restore it.

By enabling this option, users will be allowed to backup the device data like images, videos, etc. in the Google server.

By enabling this option, users will be allowed to sync their Google Accounts on their devices.

By enabling this, crash reports will be sent to Google.

By enabling this, users will be allowed to use an SD Card on their devices.

By enabling this, users will be allowed to store data on SD Cards of the devices.

By enabling this, users will be able to move applications installed in device memory to the SD card.

By enabling this, users will be allowed to use USB on their devices.

By enabling this, users will be allowed to use USB to establish connections for debugging.

By enabling this, users will be allowed to connect USB Storage devices. This can be enabled only when USB is enabled on a device.

If installing unapproved apps is restricted, all apps previously installed by users get disabled and in the case of subsequent installations of unapproved apps, although the apps get downloaded and installed, the apps are automatically uninstalled. This ensures that, only those apps distributed via MDM are installed on the device. Once this restriction is removed, apps previously disabled get enabled automatically.

By enabling this, users will be allowed to use uninstall applications from the device.

By enabling this, the user can choose to allow or restrict app notification If restricted the app notifications would be disabled.

By enabling this, users will be allowed to access Youtube from the device.

By enabling this, users will be allowed to access Gmail on their devices.

By enabling this, users will be allowed to use "S Finder" to search for Apps and settings on the device. This is applicable only for Samsung Knox devices.

Configuring this ensures you can choose to automatically deny/allow permissions for apps present on the device. In case if Auto-deny is chosen, for some apps such as Camera, the app will be disabled and the user will not be prompted to accept the permission. While in other apps such as Phone, a display message will be shown notifying the user of the denied access. Optionally, you can also leave it to the user.

By enabling this, users will be allowed to use the default Android web browser.

By enabling this, users will be allowed to use Fraud Warning Settings on the device.

By enabling this, user Pop-Ups will be enabled on the device.

By enabling this, users will be allowed to use applications running on Java scripts.

By enabling this option, users will be allowed to use Auto-Fill Settings.

By enabling this option, users will be allowed to use Cookies Settings on the device.

If this is restricted, users will be unable to use airplane mode on their devices.

If Allow is chosen, users will be able to disable the background data whereas background data will be enabled by default. (This profile does not get applied automatically and the user has to accept this profile).

If 'User Controlled' is chosen, users will be allowed to disable or enable Wi-Fi on the device. If Wi-Fi is Always On on the device, users will not have permission to disable it. If Wi-Fi is Always Off on the device, users will not have permission to enable it. The managed devices will be out of network connectivity and even the MDM server cannot reach the device until cellular data is enabled on the device. This is supported only till Android 9.0.

By enabling this, users will be allowed to access Wi-Fi Direct on their devices.

Restrict/Allow users to connect to Wi-Fi networks only if Wi-Fi configurations have been distributed as a profile via MDM. If no Wi-Fi has been configured via MDM, enabling this ensures, the device connects only to the secure Wi-Fi network configured using MDM. If restricted, the device will not connect to any network, due to which it cannot communicate to the MDM server. Also, if the Wi-Fi SSID has been changed, then the profile must be modified to include the new SSID and then re-distributed to the device, for continued management.

Note: In non-Samsung devices running Android 10.0 or later, once the Wi-Fi profile is distributed, the users will be prompted to connect to the Wi-Fi. In Device Owner devices, the users will be prompted continuously until they connect to the Wi-Fi. While in Profile Owner devices, the users will only be prompted 5 times.

Users are restricted from configuring VPN on devices, apart from any VPN configurations distributed through the MDM server. If this restriction is enabled on Samsung devices (running on OS 4.3 and above), any VPN configured by the user gets deleted.

By restricting this, users will not be allowed to use any of the features like roaming data, data sync, etc., while roaming.

By enabling this, users will be allowed to use Sync feature while roaming.

By enabling this, data will be pushed to devices even if they are in roaming.

By enabling this, users will be allowed to receive/make voice calls during roaming.

By enabling this, users can utilize Near Field Communication (NFC).

By enabling this, users can utilize Android Beam to transfer data to other supported devices.

By enabling this, users can utilize S Beam to share files with other supported devices.

By enabling this, users will be allowed to use Bluetooth in their devices.

By enabling this, users can allow other devices to detect and connect to their devices.

By enabling this, users will be allowed to pair their devices with other devices to enable data transfer.

By enabling this, users will be allowed to place outgoing calls using Bluetooth.

By enabling this, users can connect their devices to desktops/laptops using Bluetooth.

By enabling this, users will be allowed to transfer data from their devices to other devices using Bluetooth.

By enabling this, users will be allowed to use bluetooth printers through their devices.

Disabling this, restricts managed devices from tethering with other devices, for sharing the cellular network.

By enabling this, users will be allowed to share Internet connection via Bluetooth with other devices. This can be enabled only when Bluetooth is enabled on a device.

By enabling this, users will be allowed to share Internet connection via Wi-Fi with other devices. This can be enabled only when Wi-Fi and Wi-fi Direct are enabled on the device.

By enabling this, users will be allowed to share Internet connection via USB with other devices. This can be enabled only when USB is enabled on the device.

When set as Always On, Location Services is forcefully enabled. Even if users turn it Off, it automatically reverts to On state. This is applicable for Always Off option as well. In case, you configure it as User Controlled, device users can enable/disable it as per their needs.

Allow/Restrict users from showing falsifying location data.

By enabling this, users can utilize Google Maps.

By enabling this, users will be allowed to use Voice Dialer feature. Voice dialer can be enabled only when the Microphone is enabled on the device.

By disabling this, users will not be able to use Short Messaging Service(SMS) in the managed devices.

By disabling this, users will not be able to receive any incoming message on their devices.

By disabling this, users will not be able to send any outgoing message from their devices.

By disabling this, users will not be able to use Multimedia Messaging Service (MMS) in the managed devices.

By disabling this, users will not be able to receive any incoming MMS to their devices.

By disabling this, users will not be able to send any outgoing MMS from their devices

If disabled, users cannot make/receive calls.

By disabling this, users will not be able to receive any incoming calls on their devices. Even when it is allowed, incoming calls will work only when the Microphone is enabled on the device.

By disabling this, users will not be able to place any outgoing calls on their devices. Even when it is allowed, outgoing calls will work only when the Microphone is on the device.

Select whether the device time should be set based on the network time or manually by selecting the timezone.

Select the timezone based on which, the time on the devices will be displayed if the device time settings is configured as set timezone manually.

Restricting this prevents the users from modifying date/time settings such as time format, date format, etc.

Restricting this prevents the users from modifying the date/time already set on the device.

The duration(between 5 and 1800 seconds) of inactivity, after which the device goes to sleep.
Note: Screen Timeout duration cannot be higher than Maximum idle time allowed before auto-lock configured in Passcode profile.

Disabling this, ensures the screen timeout configured above or on the device cannot be modified.

Provide the level of brightness to be configured on the device.

Disabling this, ensures the brightness configured above or on the device cannot be modified.

Enable/Disable displaying details such as the time, date, etc, on the device lock screen, when it is in sleep.

Disabling this, will restrict creating multiple users on the device.

By disabling this, users will not be able to turn off their devices using the Power Button.

By enabling this, the background processes running on the device can be restricted.

By enabling this, you can permit the user to kill current activity on the device when the user exits.

By enabling this, the device can be restored to the default settings.

Enabling this will allow users to the access featues related to S Pen, such as Notepad, virtual keyboard, Memo, etc. This is applicable only for Samsung Knox devices.

Enabling this will allow users to access various features by hovering the finger over Samsung devices. This is applicable only for Samsung Knox devices.