Restrictions Configuration

Prevents users from creating windows besides app windows.

Prevents users from taking screen captures..

Prevents users from changing the user icon.

Prevents users from accessing the hidden "Easter egg" game in the Settings.

Prevents users from installing new apps.

Sets the behavior for the Managed Play Store on devices.

• Whitelist. This is the default mode. Only approved apps are available and any unapproved app is automatically uninstalled.

• Blacklist. All apps are available except those explicitly marked as blocked.

Prevents users from turning on Bluetooth.

Prevents users from turning on Bluetooth.

Prevents configuring cellular broadcast on the device.

Prevents configuring mobile networks on the device.

Prevents users from resetting network settings.

Prevents users from using NFC to beam data to other devices.

Prevents users from making outgoing calls.

Prevents users from changing the volume on the device. This also mutes the device.

Sets the behavior for the camera.

• User choice. This is the default mode. Each app requests permission to access the camera.

• Disabled. The camera is disabled device wide.

• Enforced. The camera is available device wide.

Prevents users from factory resetting the device.

Disables the lock screen.

Sets the behavior for the microphone.

• User choice. This is the default mode. Each app requests permission to access the microphone.

• Disabled. The microphone is disabled device wide.

• Enforced. The microphone is available device wide.

Prevents users from connecting external media.

Prevents users from adding new users.

Prevents users from sharing contacts between devices via bluetooth.

Prevents users from configuring user credentials.

Sets the encryption policy on the device.

• Unspecified. No encryption.

• Enabled with password. Encryption and a password are required.

• Enabled without password. Encryption is required, but a password is not.

The amount of time without user activity before the device automatically locks the screen. A value of 0 means there is no restriction.

Prevents users from adding and removing accounts.

Configures common security standards defined in the Common Criteria for Information Technology Security Evaluation. Common Criteria mode enforces a very strict security model that may disrupt device use in standard environments.

Configures whether the device automatically scans apps for malware.

• Disabled. This is the default mode. Automatic content protection is disabled.

• Enforced. Automatic content protection is enabled.

• User choice. Users can select whether they would like to use content protection or not.

Configures whether users can access developer options and safe boot.

• Disabled. This is the default mode. Disables all developer options.

• Allowed. Users are able to access and configure developer settings.

Sets the behavior for Google Play Protect.

• Enforced. This is the default mode. Automatic app verification is enabled.

• User choice. Users can select whether they would like to use app verification or not.

Sets the behavior for Memory Tagging Extension (MTE). MTE helps detect memory safety bugs. For more information, see Google's documentation: Arm memory tagging extension.

• User choice. This is the default mode. Users can select whether they would like to use MTE or not.

• Enforced. MTE is enabled.

• Disabled. MTE is disabled.

If the device is in kiosk mode, configures whether the settings app is accessible.

• Settings access allowed. This is the default mode. Users can access the settings app.

• Settings access blocked. Users cannot access the settings app.

If the device is in kiosk mode, configures what happens when a user presses and holds the power button.

• Power button available. This is the default mode. Users can power off or restart the device.

• Power button blocked. Users cannot power off or restart the device.

If the device is in kiosk mode, configures whether system info and notifications show.

• Notifications and system info disabled. This is the default mode. System info and notifications are disabled.

• Notifications and system info enabled. System info and notifications are shown in the status bar. This setting only works if Kiosk Customization > System Navigation is set to Navigation enabled or Home button only.

• System info only. System info is shown in the status bar.

If the device is in kiosk mode, configures whether system error dialogs show when an app crashes or becomes unresponsive.

• Error and warnings muted. This is the default mode. System error dialogs are blocked. The device automatically force-stops crashed apps.

• Error and warning enabled. System error dialogs are shown.

Configures whether users can turn airplane mode on and off.

• Airplane mode user choice. This is the default mode. Users are able to turn airplane mode on and off.

• Airplane mode disabled. Airplane mode is disabled.

Configures whether users can turn cellular 2G on and off.

• Cellular two G user choice. This is the default mode. Users are able to turn cellular 2G on and off.

• Cellular two G disabled. Cellular 2G is disabled.

Configures which types of Wi-Fi networks devices can connect to.

• Open network security. This is the default mode. The device can connect to all types of Wi-Fi networks.

• Personal network security. At a minimum, personal network security, such as WEP or WPA2-PSK, is required.

• Enterprise network security. At a minimum, enterprise EAP level security is required.

• Enterprise bit192 network security. At a minimum, 192-bit enterprise level security is required.

Configures whether users can turn ultra wideband on and off. Ultra wideband is used for location tracking and data sharing.

• Ultra wideband user choice. This is the default mode. Users are able to turn ultra wideband on and off.

• Ultra wideband disabled. Ultra wideband is disabled.

Configures whether users can use Bluetooth sharing to share data from their personal profile. (Company-owned, work profile devices only.)

• Bluetooth sharing allowed. This is the default mode. Users are able to use Bluetooth sharing on their personal profile.

• Bluetooth sharing disallowed. Prevents users from using Bluetooth sharing on their personal profile.

Configures whether users can configure Wi-Fi network connections.

• Allow configuring wifi. This is the default mode. Users are able to configure Wi-Fi network connections.

• Disallow add wifi config. Prevents users from adding new Wi-Fi network configurations. They are able to switch between already configured networks.

• Disallow configuring wifi. Prevents users from configuring Wi-Fi network connections.

Configures whether users can use tethering, such as Wi-Fi tethering or Bluetooth tethering.

• Allow all tethering. This is the default mode. Users are able to use all forms of tethering.

• Disallow wifi tethering. Prevents users from using Wi-Fi tethering. Other forms of tethering are allowed.

• Disallow all tethering. Prevents users from using all forms of tethering.

Sets the behavior when a USB is connected to the device or when the device is connected to a PC via USB.

• Disallow USB file transfer. This is the default mode. Prevents transferring files over USB. Peripheral USB connections (headset, keyboard, mouse, etc.) are allowed.

• Allow USB data transfer. All types of USB data transfers are allowed.

• Disallow USB data transfer. Prevents all types of USB data transfers.

Configures whether users can use Wi-Fi direct connections. These are often used to connect to things like smart TVs and printers. (Company-owned, work profile devices only.)

• Allow wifi direct. This is the default mode. Users are able to use Wi-Fi direct connections.

• Disallow wifi direct. Prevents users from using Wi-Fi direct connections.