Create policies for Android devices

Policies for private devices with a work profile (example)

Policies for Fully Managed Devices (example)

Set up password policies (example)

Depending on the enrollment method, you have different policies available.

• If you want to create a new policy for Android, first proceed as described here.
• Select Android as the policy that you want to add.
• First enter a name for the policy in the field below as well as an optional descrip­tion.
• Using the filter, you can view the existing policies depending on the enrollment method. Depending on whether you are using fully managed devices, private devices with work profile or company-owned devices with work profile. 
• The Reset button resets all previously made changes back to the default settings.

Note! Detailed information about the policies Minimum integrity level and Action for non-compliant devices can be found in our help article How to set a minimum integrity level for Android devices.

Policies for private devices with a work profile (example)

In the following example, we show you how to create a policy for a private device with a work profile. Setting up policies for the other enrollment methods can be done analogously to this example. Just filter by the enrollment method used first. There are significantly more policies available for company-owned devices. 

Policies for a work profile on private devices apply only to the work profile and do not affect the private portion of user devices. The exchange of data between the private and the business part of the devices can be prevented by means of a policy.

• Under Filter policies by enrollment method select Work Profile (arrow in illus.).

• Now, select the desired option(s), in the example, the checkbox Allow use of Camera has been disabled (arrow in illus.).
• Close the dialog by clicking OK.

In the next step you need to assign the policy:

• Select the appropriate policy and click on Assign.
• Now select the users, groups or devices to whom you would like to assign the policy.

Note! When assigning directives, be sure to follow the instructions in our Help article Special conditions when assigning multiple policies.

Note! You can also assign the policies under Administration→ Users or Groups.

The outcome in the example: The camera app in the work profile (left illus.) has been disabled and is grayed out (middle illus.). The Cortado app also says that the use of the camera is not allowed (right illus.).

Policies for Fully Managed Devices (example)

• Under Filter policies by enrollment method select Fully Managed Device (arrow in illus.).

• First enter a name for the policy in the field below as well as an optional descrip­tion. 
• Now, select the desired option(s).
• In the example, the checkbox Allow factory reset has been disabled. Users are denied the right to reset the device (lower arrow in the illus.).
• Close the dialog by clicking OK.

In the next step you need to assign the policy:

• Select the appropriate policy and click on Assign (illus. above).
• Now select the users, groups or devices to whom you would like to assign the policy.

Note! When assigning directives, be sure to follow the instructions in our Help article Special conditions when assigning multiple policies.

Note! You can also assign the policies under Administration→ Users or Groups.

The outcome in the example: In the Cortado app you can see that resetting the device to factory settings is not allowed (arrow in left illus.). The action cannot be performed by the user (right illus.).

With the help of a policy you can put devices into kiosk mode. How this works, we show you in our How-To: How to set up Kiosk mode for fully managed Android devices.

Set up password policies (example)

Password policies can be set for all three enrollment methods.

• Under Filter policies by enrollment method, select an enrollment type. In the example, the Work Profile on Company Owned Device type was selected.

• Then define your password policies (example in illus.).
• For the example, a low complexity device password and a high complexity work profile password are set.
• Under device, first activate the Force password checkbox (upper arrow in illus.).
• Then select, for example, the password complexity Low (lower arrow in illus.).

Note! We recommend using the predefined complexity buckets with password strengths Low, Medium or High. As of Android version 12, user-defined passwords can no longer be used for device passwords on devices with a work profile (BYOD, COPE).

• Then switch to the Work Profile button and select here, for example, password complexity High (upper arrow in illus.).
• Also remove the checkmark from the checkbox Use one lock for work profile and device screen (lower arrow in illus.). 

Note! If you want users of devices with a work profile to use a separate password for the work profile, set a stronger password for the work profile than for the device itself.

• Close the dialog by clicking OK.

In the next step you need to assign the policy:

• Select the appropriate policy and click on Assign (illus. above).
• Now select the users, groups or devices to whom you would like to assign the policy.

Note! When assigning directives, be sure to follow the instructions in our Help article Special conditions when assigning multiple policies.

Note! You can also assign the policies under Administration→ Users or Groups.

The outcome in the example: The users will be requested to define a compliant password/PIN for access to the device(s) (left illus.). As long as a sufficiently strong password has not been set, the work apps remain locked (right illus.).