Overview
The Android Application Policy lets administrators manage how applications are installed, updated, configured, permitted, blocked, and used on managed Android devices.
Use this policy to:
Force-install required business applications
Make approved apps available to users
Block or disable unauthorized applications
Control app permissions
Apply managed app configurations
Prevent users from installing or uninstalling apps
Restrict input methods and accessibility services
Control app behavior across work and personal profiles
Enforce minimum application versions
The policy supports both company-owned and BYOD Android devices running Android 9 or later.
Supported Platforms
Platform | Minimum Supported Version |
Android | Android 9+ |
Before You Begin
Before deploying the policy:
Confirm the Android device is enrolled in Swif.
Identify the application package name.
Decide how the app should be installed or made available.
Review the app’s required Android permissions.
Test the policy on a small device group before broad deployment.
For managed configurations, confirm the configuration keys supported by the application vendor.
Steps
In Swif, go to Device Management.
Open Policies.
Create or edit a policy.
Select Android Application Policy.
Add one or more applications.
Configure each application’s installation, permission, update, and management settings.
Configure any device-wide application restrictions.
Assign the policy to the appropriate Android device group.
Save and deploy the policy.
Application Settings
Package Name
Enter the Android package name of the application.
Example:
com.google.android.apps.docs
The package name is required and must match the application’s package identifier in managed Google Play or the application package.
Install Type
The Install Type setting determines how the application is installed or presented to the user.
Install Type | Behavior |
| No explicit installation behavior is defined |
| The app is preinstalled but may not remain installed |
| The app is automatically installed and managed |
| The app is blocked and cannot be installed or used |
| The app is available for users to install |
| The app is required during device setup |
| The app is used as the kiosk application |
| The app is installed as a custom application |
Recommended Use
Use
FORCE_INSTALLEDfor required security, productivity, or compliance apps. f you are usingFORCE_INSTALLED, and as shown below, the app cannot be uninstalled.
Use
AVAILABLEfor optional approved apps.Use
BLOCKEDfor prohibited applications.Use
KIOSKonly for dedicated-device scenarios.Use
CUSTOMonly when you have the required signing certificate information.
Important: Installation constraints cannot be used when Install Type is blank or set to INSTALL_TYPE_UNSPECIFIED.
Default Permission Policy
The Default Permission Policy defines the default behavior for all runtime permissions requested by the app.
Value | Behavior |
| Uses the platform default |
| Prompts the user |
| Automatically grants permissions |
| Automatically denies permissions |
Use explicit permission grants when individual permissions require different behavior.
For example, set Default Permission Policy to "GRANT" for Google Chrome. Then go to Settings → Apps → Chrome → Permissions. When you open each permission, you’ll see that all of them are allowed and greyed out, meaning the user cannot modify them. Here is one example:
Disable Application
When enabled, the application is disabled on the device.
The user cannot open or use it, but the application’s data and settings are preserved. If the app is re-enabled later, its previous data remains available.
Use this when you need to temporarily prevent use without uninstalling the app.
Minimum Version Code
Set the minimum app version allowed to run on the device.
If the installed application is below the required version, the device attempts to update it. If the update does not complete, the device may report the application as non-compliant with the reason:
APP_NOT_UPDATED
Use the application’s numeric Android version code, not the user-facing version name.
Auto Update Mode
The Auto Update Mode controls how the application receives updates.
Value | Behavior |
| Uses the default update behavior |
| Postpones automatic updates |
| Installs updates with high priority |
Use high-priority updates for security-critical or operationally important apps.
Permission Management
Permission Grants
Use Permission Grants to explicitly allow, deny, or prompt for individual Android permissions.
Each permission entry includes:
Permission — the Android permission or permission group
Policy —
PROMPT,GRANT, orDENY
Example permission:
android.permission.READ_CALENDAR
Example permission group:
android.permission_group.CALENDAR
Explicit permission grants override the app’s Default Permission Policy.
Example
Permission | Policy |
|
|
|
|
Use automatic permission grants carefully. Only grant permissions required for the app’s approved business function.
For example, when you tap Microphone in Google Chrome’s permissions, a pop-up appears indicating that microphone access is restricted, as shown below.
Managed Application Configuration
Managed Configuration
Managed configurations allow administrators to apply vendor-supported settings directly to an application.
Each configuration entry includes:
Application package name
Configuration key
Configuration value
Example:
Package Name: com.example.app
Configuration Key: server_url
Configuration Value: https://example.company.com
Configuration keys must match the managed properties defined by the application developer.
Use managed configurations to:
Preconfigure server addresses
Disable consumer features
Set organization identifiers
Configure login behavior
Apply security settings
Reduce manual setup for users
Incorrect configuration keys may be ignored by the app.
App Installation Constraints
Install constraints let you control when a managed application may be installed.
Only one installation constraint can be configured per application.
Charging Constraint
Value | Behavior |
| Installation can occur on battery power |
| Installation only occurs while charging |
Device Idle Constraint
Value | Behavior |
| Installation can occur while the device is in use |
| Installation waits until the device is idle |
Network Type Constraint
Value | Behavior |
| Installation can use any network |
| Installation waits for an unmetered network |
These settings help reduce user disruption, battery consumption, and mobile data usage.
Installation constraints require an explicit Install Type. They cannot be used with an unspecified install type.
Work Profile Controls
Connected Work and Personal App
This setting controls whether the application can communicate across the work and personal profiles.
Value | Behavior |
| Cross-profile communication is blocked |
| Cross-profile communication is allowed |
For BYOD deployments, disallow cross-profile communication unless it is required for a documented business workflow.
Work Profile Widgets
Controls whether an app installed in the work profile can add widgets to the device home screen.
Value | Behavior |
| Work profile widgets are allowed |
| Work profile widgets are blocked |
Application Security Controls
Always-On VPN Lockdown Exemption
Controls whether an application is exempt from always-on VPN lockdown.
Value | Behavior |
| The app must use the enforced VPN |
| The app may bypass VPN lockdown  |
Use exemptions sparingly. Allowing an app to bypass the VPN may send traffic outside your organization’s monitored network path.
Delegated Scopes
Delegated scopes allow a trusted application to perform selected device-management functions.
Available scopes include:
Certificate installation
Managed configurations
Block uninstall
Permission grants
Package access
Enable system apps
Network activity logs
Security logs
Certificate selection
Only assign delegated scopes to trusted applications with a documented requirement. Delegated apps may gain access to sensitive device-management functions.
Extension Config
An app can be configured as an extension application capable of interacting with Android Device Policy while offline.
Only one extension app can be configured.
Configuration may include:
Notification receiver class
SHA-256 signing key fingerprints
The application must either:
Be distributed through Google Play, or
Have valid signing certificate fingerprints configured
Incorrect or missing signing information may cause the device to report an INVALID_VALUE non-compliance condition.
Signing Key Certificates
Signing key certificates may be required when:
The app uses
CUSTOMinstall typeThe app is not available in Google Play
The app uses extension capabilities
The app requires roles but is not Play-distributed
Enter the SHA-256 fingerprint of the application signing certificate as a 64-character hexadecimal value.
Credential Provider Policy
This setting allows an approved app to act as a credential provider.
Use:
CREDENTIAL_PROVIDER_ALLOWED
only for trusted password managers or credential applications approved by your organization.
User Control Settings
Controls whether users can manage or control the application.
Value | Behavior |
| Users may control supported app behavior |
| User control is restricted |
Use USER_CONTROL_DISALLOWED for mandatory applications that must remain active and consistently configured.
When userControlSettings is set to USER_CONTROL_DISALLOWED, go to Settings → Apps → Chrome. The expected behavior is that the Force stop, Disable, and Clear data buttons should all be disabled. When these options are tapped, the following screen appears (as shown in the screenshot below):
Preferential Network ID
Assigns the application to a preferred enterprise network.
Available values include:
No preferential network
Preferential network one through five
Use this only when your Android deployment has configured enterprise network slicing or preferential network support.
Accessible Track IDs
Specify which application release tracks the device may access.
Examples:
production
beta
If no tracks are specified, the device may have access to all available tracks.
Use this setting to control staged releases, internal testing, or beta deployment.
Device-Wide Application Restrictions
Allow Installation from Unknown Sources
When enabled, users can install APK files from outside Google Play.
The default is disabled.
Allowing unknown sources increases the risk of:
Malware installation
Unapproved software
Unverified application signatures
Bypassing managed Google Play controls
For managed production devices, keep this setting disabled unless there is a specific business requirement.
Disable User App Installation
When enabled, users cannot install applications from Google Play or other sources.
Administrators can still install applications through policy.
Use this for:
Kiosk devices
Shared devices
Regulated environments
Devices that must use an approved application allowlist
Disable App Uninstallation
When enabled, users cannot remove applications from the device.
Use this to keep required security, authentication, VPN, or productivity applications installed.
Permitted Input Methods
Restrict which keyboard and input-method applications may be used.
Enter the package names of approved input methods.
If this setting is not configured, any input method is allowed.
This can help reduce the risk of untrusted keyboards capturing sensitive input.
List of input method packages that the app is permitted to use. Creates a whitelist of keyboards/input methods (like Gboard, SwiftKey), blocking all keyboards not in the list. If you install Microsoft Swiftkey AI Key, then apply the policy input below, a pop up occurs to disable the keyboard installed as it is not listed in the policy input. You can check the screenshot.
Sample configuration:
"permittedInputMethods": {
"packageNames": [
"com.google.android.inputmethod.latin"
]
}
Permitted Accessibility Services
Restrict which accessibility services may run on the device.
Enter the package names of approved accessibility services.
If this setting is configured, only listed accessibility services are permitted.
Accessibility services can observe screen content and user interactions, so only allow trusted and required applications.
App Functions
Controls whether application functions are allowed on the device.
Value | Behavior |
| Application functions are allowed |
| Application functions are blocked |
If app functions are disallowed, do not configure cross-profile app functions as allowed. Android may reject conflicting policy settings.
Recommended Baseline Configuration
For most managed Android environments:
Setting | Recommended Value |
Required business apps |
|
Optional approved apps |
|
Prohibited apps |
|
Unknown sources | Disabled |
User app installation | Allowed or disabled based on ownership model |
App uninstallation | Disabled for required apps |
Default permission policy |
|
Explicit sensitive permissions | Grant or deny individually |
Auto update mode |
|
Minimum version code | Set for security-critical apps |
Cross-profile communication | Disallowed unless required |
VPN lockdown exemption | Not exempt |
Accessibility services | Restrict to approved apps |
Input methods | Restrict to approved keyboards where required |
For BYOD devices, avoid controls that unnecessarily affect the personal profile.
Common Use Cases
Force-Install a Required Application
Configure:
Install Type: FORCE_INSTALLED
Optionally configure:
Auto Update Mode: AUTO_UPDATE_HIGH_PRIORITY
Use this for:
VPN clients
Password managers
Security agents
Authentication apps
Required business applications
Block an Unauthorized Application
Configure:
Install Type: BLOCKED
Use this to prevent installation or use of applications that violate company security or compliance policies.
Publish an Optional Approved Application
Configure:
Install Type: AVAILABLE
The application becomes available for the user to install through managed Google Play.
Keep an App at a Minimum Version
Set:
Minimum Version Code: <required version code>
The device attempts to update the application. Devices that remain below the required version may be marked non-compliant.
Apply App-Specific Settings
Use Managed Configuration to provide the package name, supported configuration key, and value.
Always verify supported keys with the application vendor.
Notes
Package names must be entered exactly.
Some options require the application to be available through managed Google Play.
Custom and extension apps may require signing certificate fingerprints.
Permission grants override the default permission policy.
Installation constraints support a maximum of one constraint object per app.
Conflicting policy settings may cause Android to reject the policy.
Test restrictive settings before applying them broadly.
Policy behavior may differ between company-owned and BYOD devices.
Troubleshooting
The Application Is Not Installing
Check:
The package name is correct
The application is available in managed Google Play
The device is online and checking in
The policy is assigned to the correct device group
The selected install type supports installation
Installation constraints are not delaying installation
The device meets the Android 9+ minimum requirement
The Policy Reports INVALID_VALUE
Check:
Custom app signing certificates are configured
Signing fingerprints are valid SHA-256 values
Extension app configuration is complete
Only one installation constraint is configured
Install constraints are not used with an unspecified install type
Managed configuration keys match the app’s supported properties
The App Is Installed but Marked Non-Compliant
Check:
The installed version meets the Minimum Version Code
The app update is available to the configured release track
The device has network access
The auto-update mode is not postponed
Google Play services are functioning correctly
Managed Configuration Is Not Applying
Check:
The package name matches the intended app
The configuration key is supported by the app
The value uses the format expected by the vendor
The app has received the updated policy
The app supports Android managed configurations
Users Can Still Install Apps
Check:
Disable User App Installation is enabled
The policy is assigned to the correct ownership type
The device has received the latest policy
Unknown-source installation is disabled
Users Can Still Remove a Required App
Check:
The app is configured as
FORCE_INSTALLEDDisable App Uninstallation is enabled if required
A delegated app is not overriding uninstall behavior
The device has received the latest policy
Security and Compliance Impact
The Android Application Policy helps organizations:
Maintain an approved application inventory
Prevent unauthorized software installation
Keep required applications installed and updated
Restrict sensitive app permissions
Reduce risks from untrusted keyboards and accessibility services
Enforce work-profile separation
Support audit readiness with consistent application controls
These controls can support endpoint-management requirements associated with frameworks such as SOC 2, ISO 27001, HIPAA, NIST, NIS2, and CMMC.
Summary
Use the Android Application Policy to centrally control application installation, updates, permissions, configuration, and user access on Android 9+ devices.
For most environments:
Force-install required apps.
Make optional approved apps available.
Block prohibited apps.
Disable unknown-source installation.
Configure permissions explicitly for sensitive apps.
Enforce minimum versions for security-critical software.
Test the policy before broad deployment.