Policy settings reference

This page lists every setting in the security policy editor, card by card, in the order you see them. Use it to look up what a setting does before you change it.

Who: all roles can view policies. Changing settings needs Owner or Admin.

How to read the tables.

• Android is the oldest Android version the setting works on. The editor shows the same label under each setting, for example “Android 9+ · company-owned devices”.
• Company-owned only means the setting needs a fully managed, company-owned device. Every device you enroll with NounDesk today is company-owned, so this matters only for future personal-phone support.
• Standard Business is the value in the recommended template. The Custom template starts with the same values.
• Devices that are too old for a setting simply don’t apply it. The editor warns you under Some settings need newer devices, and the device’s Security tab explains it. See Fix compliance issues.

Your edits are saved as a draft and reach devices only when you publish. See Policy versions and publishing.

Name

Setting	What it does
Policy name	The name you see in lists. Each policy needs its own.
Description	Optional note on who the policy is for (up to 300 characters).

Security

What employees must do and what they can’t change.

Setting	Options	What it does	Android	Company-owned only	Standard Business
Screen lock	Not required, Any lock (pattern, PIN or password), 4-digit PIN or stronger, 6-digit PIN or stronger, 8+ character password, Strong password (Android 12+)	The minimum screen lock employees must set.	5.0+ (Strong password needs 12+)	No	6-digit PIN or stronger
Auto-lock after (minutes)	1 to 60, or empty for Device default	Locks the screen after this many minutes without use.	5.0+	No	5
Camera	Allowed, Blocked	Turns the camera off for every app.	5.0+	No	Allowed
Screenshots	Allowed, Blocked	Stops screenshots and screen recording. Blocking also hides notification details on the lock screen.	5.0+	No	Allowed
Apps from outside Google Play	Blocked (recommended), Allowed	Whether employees can install apps from files or other app stores.	5.0+	No	Blocked
Developer options	Blocked (recommended), Allowed	Hides Android’s developer settings, including USB debugging.	5.0+	Yes	Blocked
Factory reset by employee	Blocked (recommended), Allowed	Whether employees can reset the device from Settings.	5.0+	Yes	Blocked
Factory reset protection	Up to 10 Google account email addresses, or empty	If the device is reset without NounDesk, it stays locked until one of these accounts signs in. Empty turns it off. See Factory reset protection.	5.1+	Yes	Empty (off)
USB data transfer	Allowed, File transfer blocked, All data transfer blocked	Controls what a USB cable can do besides charging.	5.0+ (All data transfer blocked needs 12+; older devices block file transfer only)	Yes	File transfer blocked
Printing	Allowed, Blocked	Stops printing from every app.	9+	No	Allowed
SD cards and USB drives	Allowed, Blocked	Stops the device using memory cards and USB storage.	5.0+	Yes	Allowed
Google Play Protect	Always on (recommended), Employee decides	Keeps Google’s app scanning switched on.	5.0+	No	Always on
Storage encryption	Required, Not enforced	Requires the device storage to be encrypted.	5.0+	Yes	Required
Location services	Employee decides, Always on (recommended for lost devices), Always off	The device’s location switch. With Always off, a lost device can’t report where it is. NounDesk only sees a location while a device is in lost mode.	5.0+	Yes	Employee decides
Fingerprint and face unlock	Allowed, Blocked (PIN or password only)	Whether employees can unlock with a fingerprint or their face.	9+ to block	No	Allowed
Password expires after (days)	1 to 365, or empty for Never	Makes employees choose a new PIN or password this often.	5.0+	No	Never
Previous passwords that cannot be reused	1 to 24, or empty for No limit	Stops employees going back to a recent PIN or password.	5.0+	No	No limit
Erase device after failed unlock attempts	4 to 20, or empty for Never	The device erases itself after this many wrong PINs or passwords in a row.	5.0+	No	Never

The last three settings appear only when Screen lock is not Not required.

Strong password needs Android 12 or newer. Older devices with this setting show as needing attention, because Android can’t apply it.

Network

Wi-Fi networks pushed to devices, VPN, and what employees can change themselves. Details and tips are in Network settings.

Setting	Options	What it does	Android	Company-owned only	Standard Business
Wi-Fi networks	Up to 20 networks, each with Network name (SSID), Security (WPA/WPA2 password or Open (no password)), Password, Auto-connect and Hidden network	Adds these networks to every device, so employees never type the password.	5.0+	Yes	None
Employees can add or change Wi-Fi networks	Allowed, Blocked	Whether employees can add, change or forget Wi-Fi networks.	5.0+	Yes	Allowed
Hotspot / tethering	Allowed, Blocked	Whether the device can share its mobile data as a hotspot.	5.0+	Yes	Allowed
Bluetooth file sharing	Allowed, Blocked	Whether files can be sent or received over Bluetooth.	5.0+	Yes	Allowed
Always-on VPN	Route all traffic through a VPN app (on or off)	Keeps the device connected through your VPN app.	7.0+	No	Off
VPN app package name	For example com.company.vpn	The VPN app to use. NounDesk installs it automatically. Shown when Always-on VPN is on.	7.0+	No	—
Block traffic when the VPN is down	Lockdown mode (on or off)	Blocks all internet traffic whenever the VPN isn’t connected.	7.0+	No	On, once VPN is turned on
Private DNS	Device default, Automatic, Employee decides, Specific host	Controls the device’s Private DNS setting.	10+	Yes	Device default
Private DNS host	For example dns.google	The DNS service to use. Shown when Private DNS is Specific host.	10+	Yes	—

Updates

Keep devices patched without interrupting the workday. Details are in System and app updates.

Setting	Options	What it does	Android	Company-owned only	Standard Business
System updates	Install automatically, Install during a maintenance window, Postpone up to 30 days	When Android system updates install.	6.0+	Yes	Install during a maintenance window
Maintenance window (device local time)	Start and end time as HH:MM	The daily time range for system updates. Shown with the maintenance window option.	6.0+	Yes	01:00 to 05:00
App updates	Always, Wi-Fi only, Employee decides	When Google Play updates apps.	5.0+	No	Wi-Fi only

Apps

Which apps install automatically, which are optional, and which are blocked. See Apps and Managed Google Play.

Setting	Options	What it does	Android	Company-owned only	Standard Business
Google Play on the device	All apps except blocked ones, Only the apps listed here	Whether employees can install any Play app you haven’t blocked, or only the apps in this policy.	5.0+	No	All apps except blocked ones
App rules (one row per app)	Required (installs automatically), Available (employee can install), Blocked	What happens to each app. Add rows with Add from your apps… or by typing a package name.	5.0+	No	No app rules
Minimum version code (per app)	A number, or empty for Any	Devices with an older version of the app count as outdated.	5.0+	No	Any
Remote support	Off, On	Installs and links your remote support vendor’s app. Choose the vendor on the Organization page first. See Remote support.	7.0+	Yes	Off

• Required apps get the permissions they ask for granted automatically, so employees aren’t interrupted with prompts.
• With Only the apps listed here, employees see only the apps in this list in Google Play. Add every app they need.

Website filtering

Block websites, or allow only the ones you list. The rules apply in Google Chrome. Details are in Website filtering.

Setting	Options	What it does	Android	Company-owned only	Standard Business
Websites	No filtering, Block the websites listed, Allow only the websites listed	Turns website rules on in Chrome.	7.0+	No	No filtering
Blocked websites / Allowed websites	One website per line, up to 1,000	The list. example.com covers its subdomains; add a path such as example.com/games to match part of a site.	7.0+	No	—
Incognito tabs	Turn off (recommended) (ticked or not)	Stops private tabs, which could be used to get around the rules.	7.0+	No	Ticked when you turn filtering on
Other browsers	Block them (recommended) (ticked or not)	Blocks other browsers so the rules can’t be bypassed.	7.0+	No	Ticked when you turn filtering on

Kiosk mode

Kiosk settings are managed on the Kiosk page, not in this editor. See Kiosk mode.

• If the policy isn’t a kiosk, the card says This policy is not a kiosk and offers Set up a kiosk with this policy.
• If it is a kiosk, the card shows the Mode, Kiosk app, Navigation and Status bar, with Manage kiosk settings on the Kiosk page and Turn off kiosk mode. Turning kiosk mode off returns devices to the normal home screen after you publish.

Kiosk mode needs company-owned devices. Screen brightness and screen timeout need Android 9 or newer.

What each template changes

Every template starts from Standard Business. This table lists only the settings each one changes.

Setting	Standard Business	Maximum Security	Field Worker	Kiosk / Dedicated Device
Screen lock	6-digit PIN or stronger	Strong password (Android 12+)	4-digit PIN or stronger	Not required
Auto-lock after	5 minutes	2 minutes	10 minutes	5 minutes
Camera	Allowed	Blocked	Allowed	Allowed
Screenshots	Allowed	Blocked	Allowed	Blocked
USB data transfer	File transfer blocked	All data transfer blocked	Allowed	All data transfer blocked
Printing	Allowed	Blocked	Allowed	Allowed
SD cards and USB drives	Allowed	Blocked	Allowed	Allowed (blocked by the kiosk’s shared-device settings)
Password expires after	Never	90 days	Never	Not used (no screen lock)
Previous passwords that cannot be reused	No limit	5	No limit	Not used
Erase device after failed unlock attempts	Never	10	Never	Not used
Hotspot / tethering	Allowed	Blocked	Allowed	Allowed
Bluetooth file sharing	Allowed	Blocked	Allowed	Allowed
System updates	Maintenance window, 01:00 to 05:00	Install automatically	Maintenance window, 01:00 to 05:00	Maintenance window, 01:00 to 05:00
App updates	Wi-Fi only	Always	Wi-Fi only	Wi-Fi only
Google Play on the device	All apps except blocked ones	Only the apps listed here	All apps except blocked ones	Only the apps listed here
Kiosk mode	Off	Off	Off	Single app

The Kiosk / Dedicated Device template also sets these kiosk options, which you change on the Kiosk page:

• Navigation buttons hidden, status bar hidden, power button allowed, device settings blocked, system error dialogs muted.
• Automatic screen brightness, screen timeout of 10 minutes, and the screen stays awake while charging.
• Bluetooth, outgoing calls, text messages, USB storage, wallpaper changes and new accounts blocked. Volume stays adjustable.

The kiosk template starts with a placeholder app. Choose your real kiosk app on the Kiosk page before you roll it out.

Settings no template changes (they stay as in Standard Business): apps from outside Google Play blocked, developer options blocked, factory reset by employee blocked, factory reset protection off, Google Play Protect always on, storage encryption required, location services employee decides, fingerprint and face unlock allowed, no Wi-Fi networks, no VPN, Private DNS device default, no website filtering and remote support off.