The Android Security Policy lets administrators manage security, privacy, encryption, permission, lock screen, developer, and application trust settings on managed Android devices.

Use this policy to:

This policy supports both company-owned and BYOD Android devices running Android 9 or later.

The MTE Policy setting requires Android 12 or later and compatible hardware.

Before deploying this policy:

For most managed Android environments, consider the following baseline:

For BYOD devices, apply restrictions carefully to avoid unnecessarily affecting the user's personal profile.

When enabled, users can access Android debugging tools, including:

The default is disabled.

For production devices, keep this setting disabled unless developers need temporary debugging access.

Allowing debugging features may increase the risk of:

The Developer Settings control is available under Advanced Security Overrides.

Recommended value:

Use DEVELOPER_SETTINGS_ALLOWED only for approved development or testing devices.

The Default Permission Policy defines how Android handles runtime permission requests.

The default is:

Use Permission Grants to override the default policy for specific Android permissions.

Each entry includes:

Supported policy values are:

Common permission examples include:

Explicit permission grants override the Default Permission Policy.

Only grant sensitive permissions to trusted applications with a documented business requirement.

The Encryption Policy controls whether device encryption is required.

Recommended value for most managed devices:

This provides stronger protection for data at rest.

Encryption behavior may depend on:

For stronger security, pair this setting with an Android Password Policy.

When enabled, users cannot take screenshots or screen recordings of managed content.

Use this setting for:

Enabling this control may affect:

Test before applying it broadly.

When enabled, users cannot share device location with apps or other users.

Use this when location sharing is not required and privacy is a priority.

Before enabling it, confirm that it will not interfere with:

When enabled, Android may show a user interface allowing the user to select a private key alias if no configured private key rule matches.

The default is disabled.

Enable this only when users need to manually choose certificates for:

Leaving this disabled provides more centralized certificate control.

When enabled, Android disables the lock screen on primary or secondary displays.

This setting is supported only in dedicated device management mode.

Do not enable it on general-purpose employee devices.

Typical use cases include:

Disabling the lock screen reduces local access protection and should only be used in controlled environments.

This setting allows administrators to disable individual features on the secure lock screen.

Available options include:

For devices handling sensitive data, consider disabling:

Use biometric restrictions only when required by your organization’s security policy.

Common Criteria Mode enables additional device security controls intended for environments with specialized certification requirements.

Enable this only when required by a security standard, government environment, or device certification requirement.

Device and manufacturer support may vary.

This setting controls whether Google Play Protect verifies installed applications.

Recommended value:

Google Play Protect helps detect potentially harmful applications and unsafe installation behavior.

This setting controls whether apps from outside approved application sources may be installed.

Recommended value for company-owned devices:

For BYOD deployments, ALLOW_INSTALL_IN_PERSONAL_PROFILE_ONLY may preserve personal flexibility while protecting the managed work profile.

Allowing untrusted applications device-wide increases exposure to:

The Memory Tagging Extension, or MTE, setting controls a hardware-assisted memory safety protection available on supported Android 12+ devices.

MTE can help detect certain memory corruption issues.

Before enforcing it:

Unsupported devices may ignore the setting or report a policy issue.

This setting controls Android content protection behavior.

Use:

when supported and appropriate for devices handling sensitive company data.

This setting identifies personal-profile applications that are allowed to read notifications from the managed work profile.

Enter package names such as:

Leave this list empty unless there is a documented business requirement.

Allowing personal applications to read work notifications can expose:

Only approve trusted applications after a security review.

This provides a balanced security baseline for general company-owned devices.

Add explicit permission grants for required business applications.

This protects the work profile while limiting impact on the personal profile.

Use Disable Keyguard only when the device is enrolled in dedicated-device mode and is physically secured.

Explicit permission grants override the default permission policy.

For example:

In this case, camera access is granted while other runtime permissions are denied by default.

Review explicit grants carefully to avoid unintentionally weakening the baseline.

Some settings may behave differently based on enrollment mode.

For BYOD devices:

Dedicated devices may support stronger controls such as disabling the keyguard.

Because these devices often operate without regular user interaction, also consider:

Check:

Some advanced settings may be ignored on unsupported hardware.

Check:

Restarting the device may be required before some developer settings fully change.

Check:

Add an explicit GRANT only after confirming that the application requires the permission.

Check:

Behavior may differ between the personal and work profiles.

Check:

For company-owned devices, use managed Google Play whenever possible.

Check Keyguard Disabled Features for:

Remove the applicable restriction and redeploy the policy if biometric authentication should be allowed.

Check Keyguard Disabled Features for:

UNREDACTED_NOTIFICATIONS may allow notification indicators while hiding sensitive content.

Check:

Not all Android 12+ devices support MTE.

Review:

Remove unsupported settings, redeploy the policy, and check the device again.

The Android Security Policy helps organizations:

These controls can help support endpoint security requirements associated with frameworks such as SOC 2, ISO 27001, HIPAA, NIST, NIS2, CIS, and CMMC.

Use the Android Security Policy to centrally manage security and privacy controls on Android 9+ devices.

For most environments: