How to Configure Android Profiles

Android profiles ensure proper use of devices and protection of sensitive data. Profiles serve many different purposes, from letting you enforce corporate rules and procedures to tailoring and preparing Android devices for how they are used.

Android Versus Android Legacy Profiles

When deploying profiles, there are two Android profile types: Android and Android (Legacy). Select the Android profile option if you have completed the Android EMM Registration. If you have opted out of the EMM registration, then the Android (Legacy) profiles are available. When you select Android but have not walked through the Android EMM Registration, an error message displays prompting you to go to the settings page to complete EMM registration or proceed to Android (Legacy) profile deployment.

Work Profile vs. Work Managed Device Mode

A Work Profile is a special type of administrator tailored primarily for a BYOD use case. When the user already has a personal device configured with their own Google account, Workspace ONE UEM enrollment creates a Work Profile, where it installs the Workspace ONE Intelligent Hub. Workspace ONE UEM only controls the Work Profile. Managed apps install inside the Work Profile and display an orange briefcase badge to differentiate them from personal apps.

Work Managed device applies to devices enrolled from an unprovisioned or factory reset state. This mode is recommended for corporate owned devices. Workspace ONE Intelligent Hub is installed during the setup process and set as the device owner, meaning Workspace ONE UEM will have full control of the entire device.

Android profiles will display the following tags: Work Profile and Work Managed Device.

Profile options with the Work Profile tag only apply to the Work Profile settings and apps, and do not affect the user's personal apps or settings. For example, certain restrictions turn off access to the Camera or taking screen capture. These restrictions only affect the Android badged apps inside the Work Profile and will not impact personal apps. Profile options configured for Work Managed Device apply to the entire device. Each profile discussed in this section indicates which device type the profile affects.

Profiles Behavior

There are times when more than one profile needs to be implemented for various reasons. When duplicate profiles are deployed, the most restrictive policy takes priority. Therefore, if two profiles are installed, and one says to block camera and another says to allow camera, Intelligent Hub for Android combines the profiles and blocks the camera to choose the more secure option.

Configure Profile

In the Workspace ONE UEM console, you follow the same navigation path for each profile. The Preview section shows you Total Assigned Devices with a list view. You can see the added profiles on the Summary tab.

To configure profiles:

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Android.

2. Configure the settings:

   Settings	Description
   Name	Set the name for your profile and add a description that would be easily recognizable to you.
   Profile Scope	Set how the profile is used in your environment either on Production, Staging, or Both.
   OEM Settings	Turn on OEM settings to configure specific settings for Samsung or Zebra devices. Once you select the OEM, you will see additional profiles and settings display that are unique to either OEM.

3. Select the Add button for the desired profile and configure the settings as desired. You can use the drop-down and preview profile settings before selecting add.

4. Select Next to configure the general Assignment and Deployment profile settings as appropriate. Configure the following settings:

   Settings	Description
   Smart Group
   Allow Exclusion	When turned on, a new text box Exclude Group displays. You can then select those groups you want to exclude from the assignment of the device profile.
   Assignment Type	Determines how the profile is deployed to devices: Auto – The profile is deployed to all devices. Optional – An end user can optionally install the profile from the Self-Service Portal (SSP), or it can be deployed to individual devices at the administrator's discretion. End users can also install profiles representing Web applications, using a Web Clip or a Bookmark payload. And if you configure the payload to show in the App Catalog, then you can install it from the App Catalog. Compliance – The profile is applied to the device by the Compliance Engine when the user fails to take corrective action toward making their device compliant.
   Managed By	The organization group with administrative access to the profile.
   Install Area Only	Turn on to display geofencing option: Install only on devices inside selected areas: Enter an address anywhere in the world and a radius in kilometers or miles to make a 'perimeter of profile installation'.
   Schedule Install Time	Turn on to configure time schedule settings: Turn on Scheduling and install only during selected time periods:Specify a configured time schedule in which devices receive the profile only within that timeframe.

5. Select Save & Publish.

Passcode

Setting a passcode policy requires your end users to enter a passcode, providing a first layer of defense for sensitive data on devices.

The Work Profile passcode policies apply only to work apps, so users do not have to enter complex passwords each time they unlock their device when enrolled with a Work Profile. The Work keeps corporate app data protected and allows end users to access personal apps and data in any way they like. For Work Managed devices, this passcode policy applies to the device. The Work Passcode is available on Android 7.0 (Nougat) and above for Work Profile enrolled devices.

The Device Passcode policies apply to the whole device (enrolled with a Work Profile or as Work Managed). This passcode needs to be entered each time the device is unlocked and can be applied in addition to the work passcode.

By default, when creating new profiles, only the Work Passcode is Turn on (Device Passcode is disabled). The admin has to Turn on the device passcode manually.

Note: When Passcode profile is present on the device and the user does not set the passcode, no apps or profiles are pushed to the device until the device is compliant.

Once the passcode profile settings are established, the UEM console notifies the user through persistent notification to update the passcode settings when a passcode reaches minimum passcode age or passcode required change. Users are unable to use Intelligent Hub until they set up the passcode as required in the profile. On Samsung devices, the user is locked into lock screen setup wizard until they set a passcode meeting the passcode policy requirements. For Work Managed devices, users are unable to use the device. For Work Profile and COPE devices, users are unable to access work apps.

Passcode Complexity

When setting either the work or device passcode, you will determine the Passcode complexity before configuring additional settings. First, you will decide how granular your minimum passcode complexity requirements will be by setting passcode complexity controls to Basic or Advanced.

When you select Basic you can simply set the complexity as Low, Medium, or High. For Low, users can set a screen lock of any type. For Medium complexity, users will need to set a complex pin or passcode on their device with no minimum length requirement. When High is selected, users will need to set either:

• A complex pin with a minimum length of 8
• A password with a minimum length of 6

If you select Advanced you have to set the Passcode Content and Minimum Passcode Length settings listed in the profile settings.

The available settings for the Passcode profile are outlined below.

The following settings apply if you select Complex from the Passcode Content text box.

The following settings apply for setting a passcode on Samsung device.

These settings only display when OEM Settings in the General profile and Samsung from Select OEM dropdown are selected.

Configure lock screen Overlay (Android)

The lock screen Overlay option in the passcode profiles gives you the ability to overlay information over the screen lock image to provide information to the end user or anyone who may find a locked device. lock screen Overlay is a part of the Passcode profile.

lock screen Overlay is a native functionality for Android and available across several OEMs.

The lock screen Overlay settings for Android profiles on only displays when the OEM Settings field is toggled to Turn on and Samsung is selected from the Select OEM field. The OEM settings field in the General profile only applies to Android profiles and not Android (Legacy) configurations.

Configure the settings for Image Overlay as desired:

Configure the settings for Company Information as desired.

Chrome Browser Settings

The Chrome Browser Settings profile helps you to manage settings for the Work Chrome app.

Chrome is Google's web browser. Chrome offers a number of features such as search, the omnibox (one box to search and navigate), auto-fill, saved passwords, and Google account sign-in to instantly access recent tabs and searches across all your devices. The work Chrome app functions the same as the personal version of Chrome. Configuring this profile will not affect the user's personal Chrome app. You can push this profile in conjunction with a separate VPN or Credentials Wi-Fi payload to ensure end-users can authenticate and log in to your internal sites and systems. This will ensure that users must use the Work Chrome app for business purposes.

Chrome Browser Settings Matrix (Android)

The Chrome Browser Settings profile helps you to manage settings for the Work Chrome app. Configuring this profile will not affect the user's personal Chrome app. You can push this profile in conjunction with a separate VPN or Credentials or Wi-Fi payload to ensure end-users can authenticate and log in to your internal sites and systems.

This matrix details the available settings in the Chrome Browser profile:

Restrictions

The Restrictions profiles in the UEM console locks down native functionality of Android devices. The available restrictions and behavior vary based on device enrollment.

The Restrictions profile displays tags that indicate if the selected restriction applies towards the Work Profile, Work Managed Device, or both, however, that for Work Profile devices these only affect the Android badged apps. For example, when configuring restrictions for the Work Profile you can disable access to the work Camera. This only affects the Android badged camera and not the users personal camera.

Note, there are a handful of system apps included with the Work Profile by default such as Work Chrome, Google Play, Google settings, Contacts, and Camera – these can be hidden using the restrictions profile and does not affect the user's personal camera.

Restrictions on Using Non-Managed Google Accounts

You might want to allow people to add non-managed or personal Google accounts, to read personal emails example, but you still want to restrict the personal account from installing apps on the device. Your can set a list of accounts people can use in Google Play in the Workspace ONE UEM console.

Deploy a restrictions payload for added security on Android devices. Restrictions payloads devices can disable end-user access to device features to make sure devices are not tampered with.

Select the Restrictions profile and configure the settings:

Specific Restrictions for Android

This matrix provides a representational overview of the restrictions profile configurations available by device ownership type.

Exchange Active Sync

Workspace ONE UEM uses the Exchange ActiveSync (EAS) profile on Android devices to guarantee a secure connection to internal email, calendars, and contacts using mail clients. For example, the configured EAS email settings for the Work Profile affects any email apps downloaded from the Workspace ONE UEM Catalog with the badged icon and not the user's personal email.

Once each user has an email address and user name you can create an Exchange Active Sync profile.

Note: The Exchange Active Sync profile applies towards the Work Profile and Work Managed Device mode types.

Select the Exchange Active Sync profile and configure the following settings.

Public App Auto Update

The Public App Auto update profile allows you to configure auto updates and scheduling maintenance windows for public Android applications.

The Public app auto update profile uses Google API's to send profile data directly to devices. This profile will not be displayed in the Workspace ONE Intelligent Hub.

To configure the Public App Auto Update profile:

Note: If a profile contains a Public App Update payload, it cannot contain any other payloads.

Select Public App Auto Update from the payload list and configure the update settings:

• Public Apps Auto Update Policy: Specify when Google Play allows auto-date. Select Allow user to configure, Always auto update, Update on Wi-Fi only, or Never auto update.

The default selection is Allow user to configure.

• Start Time: Configure what the local time applications in the foreground should be allowed to auto update each day. Select a time between 00:30 to 23:30.

Note: Only applies if Update on Wi-Fi Only or Always auto update are selected.

• End Time: Configure what the local time applications in the foreground should be allowed to auto update each day. Select a time between 30 minutes to 24 hours.

Note: Only applies if Update on Wi-Fi Only and Always auto update are selected.

Based on time set, the applications only auto updates during the specified start and end times. For example, you would set kiosk devices to only update outside of business hours to not interrupt kiosk usage.

Credentials

For greater security, you can implement digital certificates to protect corporate assets. To do this, you must first define a certificate authority, then configure a Credentials payload alongside your Exchange ActiveSync (EAS), Wi-Fi or VPN payload.

Each payload has settings for associating the certificate authority defined in the Credentials payload. Credentials profiles deploy corporate certificates for user authentication to managed devices. The settings in this profile vary depending on the device ownership type. The Credentials profile applies towards the Work Profile and Work Managed Device mode types.

Devices must have a device pin code configured before Workspace ONE UEM can install identity certificates with a private key.

Credentials profiles deploy corporate certificates for user authentication to managed devices. The settings in this profile will vary depending on the device ownership type. The Credentials profile will apply towards the Work Profile and Work Managed Device mode types.

Select the Credentials profile and select Configure.

Use the drop-down menu to select either Upload or Defined Certificate Authority for the Credential Source. The remaining profile options are source-dependent. If you select Upload, you must enter a Credential Name and upload a new certificate. If you select Defined Certificate Authority, you must choose a predefined Certificate Authority and Template.

Allow Apps to Silently Access Certificates

When you choose Defined Certificate Authority as the Credential Source, you may also specify apps that can silently access the client certificate issued by this Certificate Authority. This option is called Allow silent access to apps. When activated, you may choose any Android Public and Internal Apps that you have previously added in the Workspace ONE UEM console.

Normally, Android applications require authorization from the end user before they can access client certificates in the Android Keystore. They request this authorization by presenting a dialog to the end user that asks them to choose from a list of client certificates. By choosing a certificate, the end user authorizes the application to access it.

Using Allow silent access to apps, you can administratively authorize applications to access the certificate in the Credentials Profile. If the application knows the alias of the certificate in advance, it can use the client certificate without prompting the end user. In the case of client certificates issued by a Defined Certificate Authority, the certificate alias is equivalent to the Subject of the Certificate Template selected in the Credentials Profile. The expected certificate alias can be set in many applications using Application Configuration. For example, while assigning a VPN application through the Workspace ONE UEM Console, the Application Configuration may support a field labeled "Certificate Alias" or similar. In this case, you would set this value to match the Subject in the Certificate Template selected in the Credentials Profile.

Manage Certificates With Custom XML

Certificates can be managed through the Workspace ONE Intelligent Hub for Android and by using custom XML in the UEM console. You can specify package names that allow you to manage your certificates on Android devices. You can add the package names through custom settings.

To push these packages:

1. Navigate to Groups & Settings > All Settings > Apps > Settings & Policies > Settings > Custom Settings.

2. Configure the custom XML accordingly:

   Setting	Description
   Custom Settings	Paste the following custom XML: { "AuthorizedCertInstaller" : "packagename" } and replace the placeholder package name with the actual package name of the app (usually in format: com.company.appname).

3. Save the Custom XML.

Custom Messages

The Custom Messages profile allows you configure messages that display on the device home screen when important information needs to be relayed to the user.

The Custom messages profile allows you to set a lock screen message, a message to display when users attempt to perform a blocked setting, or device user settings.

Select the Custom Messages profile and configure the messages settings:

|Set a lock screen Message|Enter a message to display on the device home screen when the device is locked. This is useful for a device that has been lost or stolen to display contact information of the user.| |Set a short message for blocked settings|Enter a message to be displayed when a user tries to perform actions on a device that is blocked. Use the custom message to explain why the feature is blocked.| |Set a long message for users to view in settings|Users can view this message on their device under Settings > Security > Device admins > Intelligent Hub.|

Application Control

The Application Control profile allows you to control approved applications and prevent uninstalling important apps. While the compliance engine can send alerts and takes administrative actions when a user installs or uninstalls certain applications, Application Control prevents users from even making those changes.

Warning: Enabling/ disabling critical system apps results in devices becoming unusable.

Even without an Application Control Profile, organizations already have some control over applications that can be installed on a managed device. By default, only Public Applications the administrator has assigned to the device via the Workspace ONE UEM Console will be available in the managed Play Store app catalog. In Work Profile and Corporate Owned Personally Enabled (COPE) devices, this applies the Play Store catalog in the Work Profile only.

Administrators can apply further application restrictions on managed devices.

Restricting Work Applications

For managed applications on Android devices, administrators can apply the restrictions in the table below.

The restrictions in the above table are applied as follows:

• Work Profile or COPE (Android 11+) Devices: Restrictions apply only to applications in the Work Profile.
• Work Managed Devices: Restrictions apply to the entire device as there is not separation of Work and personal applications.
• COPE (Android 10 and lower) Devices: If the Work Managed checkbox is enabled, restrictions apply to apps in the personal side of the device. If the Work Profile checkbox is enabled, restrictions apply to the Work Profile.

Restricting Personal Applications on Android 11+ COPE Devices

For devices enrolled in COPE mode and running Android 11 or higher, administrators have a separate setting - Personal Play Store Restrictions - to restrict what applications can be used in the personal side of the device.

Application Groups and Application Control Profile

Workspace ONE UEM applies Application Control settings to applications defined in Application Groups, which you create in the Workspace ONE UEM Console. An Application Group only applies to a device if the Application Group is assigned it. In other words, both Application Groups and Application Control Profiles must be assigned to the device for a setting in the Application Control Profile to take effect.

For example, to prevent uninstallation of a Work application, both should be assigned to the device:

• An App Group of type Required containing the application
• An Application Control Profile with Prevent Un-Installation of Required Apps

The order in which these are assigned to the device also matters. Changes to applications in an Application Group are not applied to the device until a matching Application Control Profile is next installed on the device. In the above example, to prevent uninstallation of another application, the application should first be added to the Application Group. The Application Control Profile should then be re-installed on the device.

Finally, multiple Application Groups of the same type can be assigned to a device. In this example, if two Application Groups of type Required containing different apps are assigned to the same device, the Prevent Un-Installation of Required Apps setting will apply to the applications defined in both App Groups on that device.

For more information on Application Groups, see the Mobile Application Management Documentation.

Proxy Settings

Proxy settings are configured to ensure that all the HTTP and HTTPS network traffic is passed only through it. This ensures data security since all the personal and corporate data will be filtered through the Proxy Settings profile.

Configure the Proxy settings as such:

System Updates

Use this profile to manage how Android device updates are handled when the device is enrolled into Workspace ONE UEM.

Select the System Updates profile.

Use the drop-down menu from the Automatic Updates field to select the update policy.

Wi-Fi

Configuring a Wi-Fi profile lets devices connect to corporate networks, even if they are hidden, encrypted, or protected.

The Wi-Fi profile can be useful for end users who travel to various office locations that have their own unique wireless networks or for automatically configuring devices to connect to the appropriate wireless network while in an office.

When pushing a Wi-Fi profile to devices running Android 6.0+, if a user already has their device connected to a Wi-Fi network through a manual setup; the Wi-Fi configuration cannot be changed by Workspace ONE UEM. For example, if the Wi-Fi password has been changed and you push the updated profile to enrolled devices, some users have to update their device with the new password manually.

To configure the profile:

Configure Wi-Fi settings, including:

VPN

A Virtual Private Network (VPN) provides devices with a secure and encrypted tunnel to access internal resources such as email, files, and content. VPN profiles Turn on each device to function as if it were connected through the on-site network.

Depending on the connection type and authentication method, use look-up values to auto-fill user name info to streamline the login process.

Note: The VPN profile applies for both the Work Profile and Work Managed Device mode types.

Configure VPN settings. The table below defines all settings that can be configured based on the VPN client.

Configure Per-App VPN Rules

You can force selected applications to connect through your corporate VPN. Your VPN provider must support this feature, and you must publish the apps as managed applications.

Note: Wi-Fi Proxy Auto Configuration is not supported using Per-App VPN.

1. Select the VPN payload from the list.

2. Select your VPN vendor from the Connection Type field.

3. Configure your VPN profile.

4. Select Per-App VPN Rules to Turn on the ability to associate the VPN profile to the desired applications. For Workspace ONE Tunnel client, this selection is Turn on by default. After the checkbox is Turn on, this profile is available for selection under the App Tunneling profiles dropdown in the application assignment page.

5. Select Save & Publish.

   If Per-App VPN rules are Turn on as an update to an existing VPN profile, the devices/applications that were previously using the VPN connection are affected. The VPN connection that was previously routing all apps traffic are disconnected and VPN only applies to applications associated with the updated profile.

To configure public apps to use the Per-App VPN profile, see Adding Public Applications for Android in the Application Management for Android publication.

Permissions

The Workspace ONE UEM console provides the admin the ability to view a list of all the permissions that an application is using and set the default action at run time of the app. The Permissions profile is available on Android 6.0+ devices using Work Managed device and Work Profile mode.

You can set run-time permission policies for each Android app. The latest permissions are retrieved when configuring an app at an individual app-level.

Note: All permissions used by an app are listed when you select the app from the Exceptions list, however permission policies from the Workspace ONE UEM console only apply to dangerous permissions as deemed by Google. Dangerous permissions cover areas where the app requests data that includes the user's personal information, or could potentially affect the user's stored data. For more information, please reference the Android Developer website.

Configure the Permissions settings, including:

Lock Task Mode

Lock Task Mode allows an app to pin itself to the foreground which allows for a single purpose such as kiosk mode. The app must support Lock Task Mode and is added through the Apps & Books setting to show in Whitelisted Apps. The app developer configures the lock task setting during app development and the Lock Task profile settings lets you configure the permissions and settings.

Note: For more information on supported applications, see the link in the Lock Task Mode profile in the Workspace ONE UEM console which directs you to the Google Developer site for specifics.

Configure the Lock Task Mode settings:

Best Practices for Lock Task Mode

Consider applying these policies and restrictions to ensure the best experience and maintenance for your single-purpose using lock task mode policies. These recommendations are useful if you are deploying a Lock Task Mode profile for devices in kiosk and digital signage use cases where an end user is not associated with the device.

Create a "Restrictions" profile and configure the following within the profile:

• Disable the following options under Device Functionality:

  • Allow Status Bar - This ensures an immersive experience when the device is locked into lock task mode.
  • Allow Keyguard - This ensures that the device does not get locked. This setting is ignored when a passcode is present on the device.

• Turn on the following options under Device Functionality:

  • Force Screen On when Plugged In on AC Charger
  • Force Screen On when Plugged In on USB Charge
  • Force Screen On when Plugged In on Wireless Charger These options ensure that the device screen is always turned on for interaction.

Deploy the System Update Policy profile to ensure the device receives the latest fixes with minimal manual intervention.

Date/Time for Android Devices

Configure the Date/Time sync settings to ensure devices always have the correct time across different regions. Supported on Android 9.0 or later devices.

Configure the Date/Time settings, including:

Date/Time for Samsung Devices

Configure the Date/Time sync settings to ensure devices always have the correct time across different regions.

This profile is available when OEM Settings is Turn on and the Select OEM field is set to Samsung in the General profile settings.

Note: The Date/Time profile only displays when the OEM Settings field is toggled to Turn on

Configure the Date/Time settings for Samsung, including:

Workspace ONE Launcher

Workspace ONE Launcher is an application launcher that lets you to lock down Android devices for individual use cases and customize the look and behavior of managed Android devices. The Workspace ONE Launcher application replaces your device interface with one that is custom- tailored to your business needs.

You can configure Android 6.0 Marshmallow and later devices as corporate-owned, single-use (COSU) mode. COSU mode allows you to configure devices for a single purpose such as kiosk mode by whitelisting supported internal and public applications. COSU mode is supported for Single App mode, Multi App Mode, and Template Mode. For more information on deploying Workspace ONE Launcher profile in COSU mode, see the Workspace ONE Launcher publication.

For a more comprehensive guide to configure Workspace ONE Launcher, see Workspace ONE Launcher Publication.

Firewall

The Firewall payload allows admins to configure firewall rules for Android devices. Each firewall rule type allows you to add multiple rules.

This profile is available when OEM Settings is Turn on and the Select OEM field is set to Samsung in the General profile settings.

Note: The Firewall payload only applies to SAFE 2.0+ devices.

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Android.

   The Firewall profile only displays for Android profiles when the OEM Settings field is Turn on and Samsung is selected from the Select OEM field. The OEM Settings field in the General profile only applies to Android profiles and not Android (Legacy) configurations.

2. Select Device to deploy your profile.

3. Configure the General profile settings.

   The General settings determine how the profile deploys and who receives it.

4. Select the Firewall profile.

5. Select the Add button under the desired rule to configure the settings:

   Setting	Description
   Allow Rules	Allows the device to send and receive from a specific network location.
   Deny Rules	Blocks the device from sending and receiving traffic from a specific network location.
   Reroute Rules	Redirects traffic from a specific network location to an alternate network. If an allowed website redirects to another URL, please add all redirected URLs to the Allow Rules section so it can be accessed.
   Redirect Exception Rules	Avoids traffic from being redirected.

6. Select Save & Publish.

APN

Configure Android devices Access Point Name (APN) settings to unify device fleet carrier settings and correct misconfigurations.

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Android.

2. Select Device to deploy your profile to a device.

3. Configure the profile's General settings. The APN profile only displays when the OEM Settings field is toggled to Turn on and Samsung is selected from the Select OEM field.

   The General profile settings determine how the profile deploys and who receives it.

4. Select the APN payload.

5. Configure the APN settings, including:

   Setting	Description
   Display Name	Provide a user friendly name of the access name.
   Access Point Name (APN)	Enter the APN provided by your carrier (For example: come.moto.cellular).
   Access Point Type	Specifies which types of data communication should use this APN configuration.
   Mobile Country Code (MCC)	Enter the 3-digit country code. This values checks whether devices are roaming on a different carrier than entered here. This is used in combination with a mobile network code (MNC) to uniquely identify a mobile network operator (carrier) using the GSM (including GSM-R), UMTS, and LTE mobile networks.
   Mobile Network Code (MNC)	Enter the 3-digit network code. This values checks whether devices are roaming on a different carrier than entered here. This is used in combination with a mobile country code (MCC) to uniquely identify a mobile network operator (carrier) using the GSM (including GSM-R), UMTS, and LTE mobile networks.
   MMS Server (MMSC)	Specify the server address.
   MMS Proxy Server	Enter the MMS port number.
   MMS Proxy Server Port	Enter the target port for the proxy server.
   Server	Enter the name or address used for the connection.
   Proxy Server	Enter the proxy server details.
   Proxy Server Port	Enter the proxy server port for all traffic.
   Access Point User Name	Specify the username that connects to the access point.
   Access Point Password	Specify the password that authenticates the access point.
   Authentication Type	Select the authentication protocol.
   Set as Preferred APN	Turn on to ensure all end user devices have the same APN settings and to prevent any changes being made from the device or carrier.

6. Select Save & Publish.

Enterprise Factory Reset Protection

Factory Reset Protection (FRP) is an Android security method that prevents use of a device after an unauthorized factory data reset.

When Turn on, the protected device cannot be used after a factory reset until you log in using the same Google account previously set up.

If a user has Turn on FRP, when the device is returned to the organization (user leaves the company, for example), you might be unable to set up the device again due to this device feature.

The Enterprise Factory Reset Protection profile uses a Google user ID which allows you to override the Google account after a factory reset to assign the device to another user. To get this Google user ID, visit People:get.

Generate Google user ID for the Factory Reset Protection Profile for Android Devices

This Google User ID allows you to reset the device without the original Google account. Obtain your Google user ID using the People:get API to configure the profile. Before you begin, you must get your Google user ID from the People:get website.

1. Navigate to People:get.

2. In the Try this API window, configure the following settings.

   Setting	Description
   resourceName	Enter people/me.
   personFields	Enter metadata,emailAddresses
   requestMask.includefield	Leave this field empty.
   Credentials	Turn on both the Google OAuth 2.0 and API Key fields.

3. Select Execute.

4. Sign into your Google account, if prompted. This is the account used to unlock devices when FRP is Turn on.

5. Select Allow to grant permissions.

6. Find the 21-digit in the application/json tab in the id field.

7. Return to the Workspace ONE UEM console and configure the Enterprise Factory Reset Protection profile.

Configure Enterprise Factory Reset Protection Profile for Android

Enter the Google user ID in the Enterprise Factory Reset Protection profile.

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Android.

2. Configure the General profile settings as appropriate.

3. Select the Enterprise Factory Reset Protection payload.

4. Configure the following settings to set the level of control for your application deployments:

   Setting	Description
   Google user IDs	Enter the Google user ID obtained from Google People:get.

5. Select Save & Publish.

Zebra MX

The Zebra MX profile allows you take advantage of the additional capabilities offered with the Zebra MX service app on Android devices. The Zebra MX Service app can be pushed from Google Play and from My Workspace ONE distributed it as an internal app in the Workspace ONE UEM console in conjunction with this profile.

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Android.

2. Configure the General profile settings as appropriate. Turn on the OEM Settings field and select Zebra from the Select OEM field to Turn on the Zebra MX profile.

3. Configure the Zebra MX profile settings:

   Setting	Description
   Include Fusion Settings	Turn on to expand Fusion options for use with Fusion Adapters for Motorola devices.
   Set Fusion 802.11d	Turn on to use the Fusion 802.11d to set the Fusion 802.11d settings.
   Turn on 802.11d	Turn on to use 802.11d wireless specification for operation in additional regulatory domains.
   Set Country Code	Turn on to set the Country Code for use in the 802.11d specifications.
   Set RF Band	Turn on to choose 2.4 GHz, 5 Ghz, or both bands and any channel masks applicable.
   Allow Airplane Mode	Turn on to allow access to the Airplane Mode settings screen.
   Allow Mock Locations	Turn on or disable Mock Locations (in Settings > Developer Options).
   Allow Background Data	Turn on or disable background data.
   Keep Wi-Fi on During Sleep	Always On - Wi-Fi stays on when device goes to sleep. Only When plugged in - Wi-Fi stays on when device goes to sleep only if the device is charging. Never On - Wi-Fi turns off when the device goes to sleep.
   Data Usage On Roaming	Turn on to allow data connection while roaming.
   Force Wi-Fi On	Turn on to force Wi-Fi on so user cannot turn it off.
   Allow Bluetooth	Turn on to allow the use of Bluetooth.
   Allow Clipboard	Turn on to allow copy/paste.
   Allow Network Monitoring notification	Turn on to allow Network Monitor Warning notification, which is normally displayed after installing certificates.
   Turn on Date/Time Settings	Turn on to set Date/Time settings
   	Date Format: Determine the order that the Month, Day, and Year displays.
   	Time Format: Choose 12 or 24 Hours.
   	Date/Time: Set which data source your devices will pull from for the date and time settings:
   	Automatic Sets the date and time based on native device settings.
   	Server Time – Sets the time based on the server time of the Workspace ONE UEM console .
   	Set Time Zone – Specify the time zone.
   	HTTP URL – Workspace ONE UEM Intelligent Hub reaches out to the URL and fetches the timestamp from the HTTP header. It then applies that time to the device. It does not handle sites that redirect
   	URL – Enter the web address the Date/Time schedule. Must include http://. Example: http://www.google.com / HTTPS not supported.
   	Turn on Periodic Sync – Turn on to set the device to check date/time periodically in days.
   	Set Time Zone – Specify the time zone.
   	SNTP Server: - The NTP settings are directly applied to the device.
   	URL – Enter the web address the NTP/SNTP server. For example, you could enter time.nist.gov for your use.
   	Turn on Periodic Sync – Turn on to set the device to check date/time periodically in days.
   Turn on Sound Settings	Turn on the sound settings configure audio settings on the device. - Music, Video, Games, & Other Media: Set the slider to the volume level you want to lock-in on the device.
   	Ringtones & Notifications: Set the slider the volume you want to lock-in on the device.
   	Voice Calls: Set the slider to the volume you want to lock-in on the device.
   	Turn on Default Notifications: Allows default notifications on the device to sound.
   	Turn on Dial Pad Touch Tones: Allows dial pad touch tones on the device to sound.
   	Turn on Touch Tones: Allows touch tones on the device to sound.
   	Turn on Screen Lock Sounds: Allows the device to play a sound when locked.
   	Turn on Vibrate on Touch**: Allows the vibrate settings to be activated.-
   Turn on Display Settings	Turn on to set display settings: - Display Brightness: Set the slider to the brightness level you want to lock-in on the device.
   	Turn on Auto-Rotate Screen: Use this option to lock the device orientation.
   	Set Sleep: Choose the amount of time before the screen will set to sleep mode.

4. Select Save & Publish.

Custom Settings

The Custom Settings payload can be used when new Android functionality releases or features that Workspace ONE UEM console does not currently support through its native payloads. Use the Custom Settings payload and XML code to manually Turn on or disable certain settings.

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Android.

2. Configure the profile's General settings.

3. Configure the applicable payload (for example, Restrictions or Passcode).

   You can work on a copy of your profile, saved under a "test" organization group, to avoid affecting other users before you are ready to Save and Publish.

4. Save, but do not publish, your profile.

5. Select the radio button from the Profiles List View for the row of the profile you want to customize.

6. Select the XML button at the top to view the profile XML.

7. For the Profile Payload that you configured previously, copy the section of XML code enclosed in the and tags (including these tags). If the Profile has multiple Payloads, identify the tags for the payload you wish to copy XML code for. For example, a Passcode Profile will have the a tag with a "type" value of com.airwatch.android.androidwork.apppasswordpolicy.

8. Copy this section of text and close the XML View. Open your profile.

9. Select the Custom Settings payload and select Configure. Paste the XML you copied in the text box. The XML code you paste should contain the complete block of code, from  to .

   • This XML should contain the complete block of code as listed for each custom XML.
   • Administrators should configure each setting from to as desired.
   • If certificates are required, then configure a Certificate payload within the profile and reference the Payload UUID in the Custom Settings payload.

10. Remove the original payload you configured by selecting the base payload section and selecting the minus [-] button. You can now enhance the profile by adding custom XML code for the new functionality.

    • When applying custom settings for Launcher profile, make sure you are using the right characteristic type for your profile type:

      • For Android profiles, use characteristic type = "com.airwatch.android.androidwork.launcher".
      • For Android (Legacy) profiles, use characteristic type = "com.airwatch.android.kiosk.settings".

    Any device not upgraded to the latest version ignores the enhancements you create. Since the code is now custom, you should test the profile devices with older versions to verify expected behavior.

11. Select Save & Publish.

Push Application Configuration for Applications

You can push Application Configuration key-value pairs through the Android Custom Settings profile. To do so, follow the template below and provide:

• The application package ID
• For each Application Configuration key-value pair, the key name, value, and value data type

    <characteristic uuid="a0a4acc3-9de1-493b-b611-eb824ffed00f" type="com.airwatch.android.androidwork.app:packageID" target="1">
    <parm name="key1" value="string" type="string" />
    <parm name="key2" value="1" type="integer" />
    <parm name="key3" value="False" type="boolean" />
        </characteristic>

Example

<characteristic uuid="a0a4acc3-9de1-493b-b611-eb824ffed00f" type="com.airwatch.android.androidwork.app:com.airwatch.testapp" target="1">
    <parm name="server_hostname" value="test.com" type="string" />
    <parm name="connection_timeout" value="60" type="integer" />
    <parm name="feature_flag" value="True" type="boolean" />
</characteristic>

Note: Application Configuration can be added while assigning Android applications. See Add Assignments and Exclusions to your Applications for more information.

Allowlist VPN Application for Always-On VPN

To allowlist a VPN client for Always-On VPN, push a Custom Settings profile payload using this template and providing the application PackageID

<characteristic uuid="a0a4acc3-9de1-493b-b611-eb824ffed00f" type="com.airwatch.android.androidwork.app:packageID" target="1">
    <parm name="EnableAlwaysOnVPN" value="True" type="boolean" />
</characteristic>

Note: To push both Application Configuration and turn on Always-on VPN for an application, combine this key-value pair with the Application Configuration key-value pairs and deploy as a single Custom Settings payload.

Custom XML for Android Devices

In Android 11, customers using third party custom attributes need to use the Custom Settings profile to specify an alternate location for storing the custom attribute files. Customers apps will also need to target this same folder location, which may require changes to their app.

Example Custom XML (Value can differ based on customer preference):

<characteristic type="com.android.agent.miscellaneousSettingsGroup" uuid="2c787565-1c4a-4eaa-8cd4-3bca39b8e98b">
<parm name="attributes_file_path" value="/storage/emulated/0/Documents/Attributes"/></characteristic>

Specific Profiles Features for Android

These features matrices are a representative overview of the key OS specific functionality available, highlighting the most important features available for device administration for Android.