20.1 Mobile Device Control Policy

Device

Allow camera

Determines whether to enable or disable the device camera. If set to No, the camera icon is removed from the home screen on the device.

Allow global background fetch while roaming

Determines whether the latest app data should be fetched from the network for apps running in the background, while the device is roaming.

Allow Siri

Determines whether Apple’s voice assistant should be enabled.

Enable Siri profanity filter

Determines whether the Profanity Filter option in Siri should be enabled. This setting is enabled if the Allow Siri setting is set to Yes or Inherit.

Allow iMessage

Determines whether the user can use the iMessage feature on devices.

iOS 6.0+

Allow iBooks Store

Determines whether the user can download content from iBooks Store.

iOS 6.0+

Allow documents from managed sources in unmanaged destinations

Determines whether a document can be opened in an unmanaged app or account if the document was created or downloaded from a managed app or account.

iOS 7.0+

Allow documents from unmanaged sources in managed destinations

Determines whether a document can be opened in a managed app or account if the document was created or downloaded from an unmanaged app or account.

iOS 7.0+

Allow screenshots

Determines whether the user can capture images of the device’s display screen. If disabled, this setting will prevent the classroom app from observing remote screens.

iOS 9.0+

Allow account modification

Determines whether the user is allowed to modify account settings, such as adding or removing mail account, modifying iCloud settings and so on.

iOS 7.0+

Allow device name modification

Determines whether the user can modify the name of the device.

iOS 9.0+

Allow restrictions modification

Determines whether the user can modify restrictions on the device.

Allow notifications modification

Determines whether the user can modify the Notification settings on the device.

iOS 9.3+

Allow diagnostics settings modification

Determines whether the user can modify the Diagnostic settings and app analytics settings in the Diagnostic and Usage screen on the device.

iOS 9.3.2+

Force encrypted backup

Determines whether the device backup process should be encrypted.

Request passcode for incoming AirPlay requests

Determines whether a pairing passcode restriction should be enforced for all incoming AirPlay requests coming from another device to a managed device.

Apple TV 6.1 to tvOS 10.1

Treat Airdrop as unmanaged destination

Determines whether Airdrop should be considered as an unmanaged drop target. If set to Yes, then the user will be unable to share managed data through Airdrop.

iOS 9.0+

Allow definition lookup

Determines whether the user can lookup definitions using the in-built iOS dictionary.

iOS 8.1.3+ and macOS 10.11.2+

Allow VPN creation

Determines whether or not the user can configure a VPN connection using their devices.

iOS 11.0+

Allow automatic update of date and time

Determines whether the date and time can be automatically set based on the current location and network.

iOS 12.0+

Apps

Allow installation of apps

Determines whether the user can install apps.

Allow automatic app downloads

Determines whether the user can automatically download apps purchased on other devices. This field is enabled if the Allow Installation of Apps field is enabled.

iOS 9.0+

Allow in-app purchases

Determines whether the user can make in-app purchases.

Allow enterprise app trust

Determines whether custom apps can be provisioned using universal provisioning profiles. If No is selected, it removes the Trust Enterprise Developer button in Settings-> General-> Profiles & Device Management.This restriction applies to free developer accounts but it does not apply to enterprise app developers who are trusted because their apps were pushed via MDM, nor does it revoke previously granted trusts.

iOS 9.0+

Allow in-app purchase

Determines whether the user can make in-app purchases.

Allow notes and highlights sync for enterprise books

Determines whether metadata, which includes notes and highlights of books that are distributed by the user’s organization, should be synced with iCloud.

Allow System App Removal

Determines whether the user can remove system apps from the device.

iOS 11.0+

Allow eSIM modifications

Determines whether users can modify the cellular plan for the eSIM card that is embedded in the device.

iOS 12.1+

Allow personal hotspot modification

Determines whether users can modify the personal hotspot settings.

iOS 12.2+

Force Wi-Fi power on

Determines whether the user can turn off the Wi-Fi on the device from Settings menu or the Control Center even during airplane mode. This setting does not prevent the user from selecting which Wi-Fi network to use on the device.

iOS 13+

Allow pairing with Apple Watch

Determines whether the user can pair with an Apple Watch.

iOS 9.0+

Require iTunes Store password for each purchases

Determines whether or not the user needs to enter the password for each purchase on the iTunes Store.

iOS 5.0+

Allow iCloud Keychain

Determines whether Keychain data such as accounts, passwords, and credit card information, should be synced with iCloud.

iOS 7.0+ and macOS 10.12+

Allow iCloud Photo Sharing

Determines whether the user can publish and share photos with other iOS users through the iCloud website.

Allow iCloud document sync

Determines whether the user can synchronize documents and key-values to the iCloud storage space.

iOS 5.0+ and macOS 10.11+

Accept cookies

Determines the cookie policy that should be enabled in the Safari web browser. The accepted values are:

The default value is to allow cookies from all websites, third parties, and advertisers.

Enable autoFill

Determines whether Safari should remember the data entered by users on web entry forms. This setting is enabled, if Allow use of Safari is configured as Yes or Inherit.

Force fraud warning

Determines whether Safari should warn users about refraining from visiting websites that are fraudulent. This setting is enabled, if Allow use of Safari is configured as Yes or Inherit.

Allow voice dialing while device is locked

Determines whether voice dialing should be enabled while the device is locked.

Show Notification Center in lock screen

Determines whether users can view past notifications on the lock screen. If enabled, the users can still view notifications on the lock screen, when they arrive.

iOS 7.0+

Allow USB connections when device is locked

Determines whether the device can connect to USB accessories while locked.

iOS 12.0+

Allow explicit content

Determines whether the user can access explicit music or video content purchased from the iTunes Store. Explicit content is marked by the content providers when sold in the iTunes Store.

iOS and tvOS 11.3+

Apps

Determines the maximum allowed rating for apps. These values are populated based on the selected Ratings region. If a rating is enabled, items that do not conform to the rating restrictions cannot be downloaded or installed on the device.

iOS 5.0+ and tvOS 11.3+

TV Shows

Determines the maximum allowed rating for TV shows. The values in this field are populated based on the selected Ratings region. If a rating is enabled, items that do not conform to the rating restrictions cannot be downloaded on the device.

iOS and tvOS 11.3+

Allow passcode modification

Determines whether the user can modify the passcode on the device. If disabled, the user will not be able to add, change or remove the passcode. Applicable for supervised devices only. This restriction is ignored in shared iPads.

iOS 9.0+

Force authentication before using autofill

Determines whether users need to authenticate using Touch ID or Face ID before entering passwords or credit card information in Safari and Apps.

iOS 12.0+

Allow password sharing

Determines whether users can share their passwords using the Airdrop Passwords feature.

iOS 12.0+

Gaming

Allow Game Center

Determines whether the user can access the Game Center. If disabled, the Game Center icon is removed from the Home screen.

iOS 6.0+

Allow adding Game Center friends

Determines whether game center friends can be added. This field will be enabled if the Allow Game Center option is enabled.

Allow keyboard shortcuts

Determines whether the user can use shortcuts from external keyboards.

iOS 9.0+

Allow spell check

Determines whether spell check is allowed on a user’s device.

iOS 8.1.3+

Music

Allow Music service

Determines whether Music Service is enabled on the device. If No is selected, then the Music Service is disabled and set to the classic mode.

iOS 9.3+ and macOS 10.12+

Allow Podcasts

Determines whether the user can access iTunes Podcasts.

iOS 8.0+

Allow AirPrint Credentials Storage

Determines whether or not AirPrint credentials can be stored in Keychain.

iOS 11.0+

Allow AirPrint iBeacon Discovery

Determines whether or not devices can discover the printer beacons. Using these ibeacons, printers can broadcast connection information, and devices can discover it to reduce setup time.

iOS 11.0+

Select number of days for delay

Select for how many days the software update should be delayed, after which the software update is visible to the user. The maximum number of days is 90 days and the default value is 30 days.

iOS 12.0+

Allow teacher to lock apps and devices

Determines whether a teacher can lock apps or the entire device without prompting the student.

iOS 12.0+

Allow teacher to observe device screen

Determines whether the device of a student enrolled in a managed course, can automatically give permission to that course’s teacher’s request to observe the student’s device screen, without prompting the student.

iOS 12.0+

Allow Find My Friends

Determines whether the Find My Device feature in the Find My app can be enabled or not.

iOS 13+

Files

Files app - Allow network drive access

Determines whether the user can connect to the network drive in the Files app.

iOS 13.1+

Devices

Allow camera

Determines whether the device camera should be enabled. If disabled on devices enrolled in the work profile mode, the camera can still be accessed from the device’s personal space. This setting does not remove the camera app. The camera app when opened, the camera will be blocked and the user cannot click photos or videos.

Android 5.0+

Allow debugging features

Determines whether or not debugging of the device can be enabled. USB debugging is often used by developers or IT support to connect/debug using Android studio and transfer data from an Android device to a computer. While this feature is useful, a device is not as secure when connected to a computer.

Android 5.0+

Allow cross-profile copy and paste

Determines whether the user can copy and paste data between the work profile and the personal space on the device.

Android 7.0+

Allow factory reset protection

Determines whether devices need to be protected from an unauthorized (hard) factory reset. If enabled, this setting provides the ability to whitelist one ore more corporate unlock accounts which can be used to provision devices after unauthorized factory resets such as from bootloader or fast boot.

Android 5.1+

Allow mounting of physical external media

Determines whether the user can connect their devices to external physical media.

Android 5.1+

Allow USB file transfer

Determines whether the user can transfer files over USB.

Android 5.1+

Allow cross-profile contact search

Determines whether the telephony or messaging apps in the personal space of a device can access work profile contacts.

Android 7.0+

Allow contact sharing with other bluetooth devices

Determines whether the user can share work contacts to other connected bluetooth devices such as hands-free calling in cars or headsets.

Android 7.0+

Set location services mode

Set the location services mode to any one of the following to estimate the device location faster and more accurately:

Android 5.0+

Allow data sharing from personal to work profile

Determines whether users can share data from the personal profile to the work profile. If enabled, users can share data from apps in the personal profile to work profile apps. Also, work profile apps can pick items from the personal profile, such as files or pictures.

Android 9.0+

Allow adding accounts

Determines whether the user can add or remove accounts to access work apps. However, this setting should be used with caution, as by enabling it users can also add their personal accounts to access work apps, which might make it difficult to contain corporate data within the workspace.

Android 5.0+

Allow Verify Apps enforcement

Determines whether Verify Apps can be enabled on the device. This feature scans apps for malware before and after the apps are installed, thereby securing corporate data from malicious apps.

Android 5.0+

Allow modifying of app data

Determines whether users can modify app data from the Settings menu such as uninstalling of apps, disabling of apps, clearing of app data and cache, force stopping apps, clearing app defaults and so on.

Android 5.0+

Allow editing of mobile network settings

Determines whether users can modify the mobile network settings from the Settings menu.

Android 7.0+

Allow cellular data while roaming

Determines whether device permits cellular data while roaming.

Android 7.0+

Allow sending and receiving of SMS messages

Determines whether the device can receive text messages or whether users can send text messages.

Android 7.0+

Set Wi-Fi timeout

Determines whether the device should disconnect from the connected Wi-Fi network, when the device is not in use. If the Not when plugged in option is selected, then the Wi-Fi will not timeout if the device is plugged-in.

Android 7.0+

Allow editing of ZENworks-provisioned Wi-Fi settings

Determines whether the user can modify the Wi-Fi settings that are provisioned by ZENworks.

Android 6.0+

Allow airplane mode

Determines whether users can set their devices in the airplane mode.

Android 9.0+

Allow editing of volume settings

Determines whether users can modify the device volume settings.

Android 5.0+

Date

Allow configuration of date, time and time zone

Determines whether the user can configure the date, time and timezone settings, either manually or automatically.

Android 9.0+

Allow automatic update of date and time

Determines whether the date and time should be automatically fetched from the network. If enabled, the user will not be able to set the date and time manually.

Android 5.0+

OS Update

Select OS update type

Select from any one of the following options to configure and apply over-the-air system updates for devices:

Android 6.0+

Allow trust agents

Determines whether trust agents such as Smart Lock can be enabled by the user to unlock the device keyguard. If you select Configure, then you can enable or disable specific Google Smart Lock trustlets in the Smart Lock field. If you select All, then all the Trust Agents will be automatically enabled for the user to configure on the device.

Android 5.0+

Allow redacted notifications

Determines whether the user can enable all notifications, including redacted (containing sensitive information) notifications, on the lock screen. If disabled, the user has the option to disable redacted notifications on the lock screen.

Android 5.0+

Allow all notifications

Determines whether all notifications are displayed on the lock screen.

Android 5.0+

Allow screen brightness

Determines whether the users can configure screen brightness on their devices.

Android 9.0+

Configure screen brightness percentage

Determines whether a specific backlight brightness percentage should be enforced. If enabled, you can set the percentage in the Set screen brightness percentage field. The brightness value on an Android device ranges from 0 to 255. When you define a percentage in the Set screen brightness percentage field, then the equivalent value is set on the device. For example, if 50% is set as the brightness percentage, then the brightness value is set as 127.5.

Android 9.0+