(Android) Types and Details of Profile Settings

The profile settings that can be applied to Android differ depending on the management type.

Work Profile

Some profiles have usage requirements.
The requirements are listed in "EMM Settings (whether EMM settings are required for the unit)", "OS Ver. (supported OS versions)", and "BizGo!MDM Ver. (version of the MDM agent app)". Check them before you configure a profile.

Item	Description	EMM Settings	OS Ver.	BizGo! MDM Ver.
Password Policy (Device) This is the password policy for locking the device.
Number of Failed Attempts Allowed	(Only when a password is required) Specify the number of password attempts allowed before the device is wiped (all data on the device is erased).
Time Until Device Lock	(Only when a password is required) Specify the time until the device locks.
Minimum Password Length	(Only when a password is required) Specify the minimum password length.
Password Type	(Only when a password is required) Specify the password type from the following. Complex (letters, numbers, and symbols are required) Something (`pattern` can also be used) Numeric (allows `PIN`) Alphabetic Alphanumeric
Password Expiration	(Only when a password is required and the type is other than `Something`) Specify the number of changes required before the same password can be reused.
Password History	(Only when a password is required and the type is other than `Something`) Specify the number of changes required before the same password can be reused.
Password Policy (Work Profile) This is the password policy for locking the information in the work profile (work area). Note: If this policy is set and the device does not meet the passcode requirements, work apps (marked with a briefcase icon) are hidden or grayed out and cannot be used. When the passcode requirements are met, you can access the work apps. You must enter the password when you use them.
Number of Failed Attempts Allowed	(Only when a password is required) Specify the number of password attempts allowed before the device is wiped (all data on the device is erased).	Required	7.0+	2.0+
Time Until Device Lock	(Only when a password is required) Specify the time until the device locks.	Required	7.0+	2.0+
Minimum Password Length	(Only when a password is required) Specify the minimum password length.	Required	7.0+	2.0+
Password Type	(Only when a password is required) Specify the password type from the following. Complex (letters, numbers, and symbols are required) Something (`pattern` can also be used) Numeric (allows `PIN`) Alphabetic Alphanumeric	Required	7.0+	2.0+
Password Expiration	The expiration period for forcing periodic password changes. Specify the number of days as a number from 1 to 730.	Required	7.0+	2.0+
Password History	(Only when a password is required and the type is other than `Something`) Specify the number of changes required before the same password can be reused.	Required	7.0+	2.0+
Configuration Policy
Hide Callers in Work Profile	When a call comes in, names registered in the work profile contact list are not shown on the incoming call screen.
Mute Master Volume	The master volume of the device is set to `silent`, and the device stays silent even when the volume buttons are pressed.
Filter Intents Between Profiles	You can set whether information can be shared from the user profile to the work profile within applications.
Force Specific `Always Open` Apps	You can specify the app that is always used to open files of a specific format.
Restriction Policy
Disable Camera	Specify whether the device camera can be used.
Disable Screenshots	The screenshot function is disabled only in apps within the work profile.
User Restriction: Disable Changing Application Settings	Users can no longer change the settings of installed applications in the work profile (for example, force-stopping or uninstalling applications).
User Restriction: Disable Pasting Between Different Profiles	Copy and paste between the user profile and the work profile is no longer possible. (Example) A URL copied in Chrome in the user profile cannot be pasted into Chrome in the work profile.
User Restriction: Disable Installing Applications	Users can no longer install new Google Play Store apps or in-house apps in the work profile. To prohibit use of the Google Play Store, set `Prohibit Google Play Store use by non-EMM accounts`. If this restriction is enabled, apps from the MDM cannot be installed either.
User Restriction: Disable Installing Apps from Unknown Sources	Installing apps from third-party stores and the web is uniformly prohibited, except for the Play Store and in-house apps distributed via the MDM.
User Restriction: Disable Adding and Removing Accounts	Accounts can no longer be added to or removed from the device in the work profile.
User Restriction: Disable Changing Location Settings	You can prohibit changing the location settings of the device.
User Restriction: Disable Location Sharing	You can turn off the location settings of the device.
User Restriction: Disable Uninstalling Applications	Applications installed in the work profile can no longer be uninstalled.
User Restriction: Disable Turning Off App Verification	Prevents Google Play Protect app scanning from being turned off. Google always checks for malicious behavior, even in apps downloaded from third-party app markets.
User Restriction: Disable Changing Debugging Settings	The USB debugging mode setting of the device can no longer be changed.
Disable Accessibility	Settings for third-party accessibility apps can no longer be configured. The accessibility apps themselves can still be installed.
Permitted Input Methods	An allowlist of input methods that can be used in addition to the standard input method preinstalled on the device. You can select from the following options. Enable all Disable all except the standard one Specify manually (if you select this option, click the [Add Permitted Input Method] button and enter the package name of the input method)
Disable Adding Accounts	If the application specified in this item is installed in the work profile, the account name can no longer be added on the device.
Google Play Store Usage Restriction	The Google Play Store can no longer be used by non-EMM accounts.	Required		2.3.3+
Work Profile Lock Screen Feature Restrictions (keyguard)	Restricts operations while the work area is locked. Ignore trust agents (Smart Lock) Disable fingerprint unlock Allow only notifications with hidden content
Lock Screen Feature Restrictions (keyguard)	The operations specified in this item can no longer be performed on the lock screen. Ignore trust agents (Smart Lock) Disable fingerprint unlock
Certificates Caution Users can delete certificates installed through a profile on the device. Deleted certificates are not reinstalled automatically. We recommend also using the restriction policy `Disable Changing Credentials Settings` to prevent deletion.
Certificate	You can upload root certificates (.pem or .cer file extension) and client certificates (.p12 or .pfx file extension). Note: Register certificates used for Wi-Fi in the `Wi-Fi` payload.
Wi-Fi
SSID	Specify the SSID of the Wi-Fi network to use. (Required)
MAC Address Randomization	Specify whether to use the fixed MAC address unique to the device or a temporarily generated random address when connecting to a Wi-Fi network.
Hidden Network	Turn this on if the Wi-Fi network to use is open or does not broadcast its SSID.
Security Type	Specify the type of encryption used when connecting to the Wi-Fi network. Note: The settings below, such as `Password`, vary depending on the security type.
EAP Type	Select the authentication method.
Unique Name	Specify the credentials for connecting to the Wi-Fi network. You can select a certificate uploaded in the `Certificate` payload.
Inner Authentication	Specify the inner authentication method required by the outer authentication method selected in EAP Type.
Password	Specify the password of the Wi-Fi network to connect to.
Client Certificate	You can upload a client certificate (.p12 file extension).
CA Certificate	You can upload a CA certificate (.cer file extension).
Domain Suffix Match	Enter this to verify the EAP server certificate by domain (DNS) suffix. On Android 11 and later, you must set either `Domain Suffix Match` or `Subject Alternative Name (SAN) Match`.
Subject Alternative Name (SAN) Match	Enter this to verify the EAP server certificate by subject alternative name. On Android 11 and later, you must set either `Subject Alternative Name (SAN) Match` or `Domain Suffix Match`.
Security Settings
Default Input Method	Specify the default input method on the device. If left blank, the default input method of the device is applied. Notes Before applying this setting to a device, you must first set up the specified input method on the device (install the keyboard app). If you apply this setting before setting up the input method on the device, keyboard input becomes completely unavailable.
Application Configuration
Apps to Hide	Specify the apps to hide. Specified apps are hidden on the device and stop working completely. Switching apps between hidden and shown may cause unstable behavior. This method is not recommended if you control app availability by switching templates with Geofence or Time-based Management. The following apps cannot be hidden. ・Google Play services (com.google.android.gms) ・Settings app (com.android.settings) ・Google Play (com.android.vending) ・Google (com.google.android.googlequicksearchbox) ・Phone app (com.android.dialer)
Apps to Suspend	Specify the apps to suspend. Suspended apps have grayed-out icons and cannot be launched. This method is recommended if you control app availability by switching templates with Geofence or Time-based Management. The following apps cannot be suspended. ・Google Play services (com.google.android.gms) ・Settings app (com.android.settings) ・Google Play (com.android.vending) ・Google (com.google.android.googlequicksearchbox) ・Phone app (com.android.dialer)
Per App Settings	Specify the configuration information required for the app to operate. ・Information to specify: app package name, configuration information ・Input format (with EMM): The configurable items are displayed automatically when you specify the app (package name) in the profile. ・Input format (without EMM): JSON format For configurable items and setting values, contact the app provider. For details on how to configure this, see Per App Settings (Distributing App Configuration Information).	Required		2.0+
Managed Apps Allowed to Use Widgets	An allowlist for enabling widgets of managed apps in the work profile. Only the widgets of the managed apps specified here can be used.
System App Settings	Enables (shows) preinstalled apps that the OS automatically disables (hides) when the device is enrolled in the MDM, so that they can be used. If you enroll using a BizMobile Go! QR code with "Show system apps" specified, all preinstalled apps become available after enrollment, so this setting is not needed.		8.0+
Apps That Cannot Be Uninstalled	You can specify apps that are prohibited from being uninstalled in the work profile.
Permission Request Policy You can specify how permission requests are handled when an app starts. (Example) When you distribute a Line Camera app, allowing camera use in advance prevents the permission pop-up from appearing on the device. Note: Support for this feature depends on the app. You can also specify whether app notifications are allowed.
Overall Permission Request Policy	You can specify how permission requests are handled when an app starts.			2.0+
Per App Runtime Permission Policy	You can specify how permission requests are handled when an app starts, for each app.			2.0+
VPN Note: Displayed only when the profile type `Custom` is selected. For the profile configuration procedure, see Steps to create a VPN profile.
Connection Name★	Enter the connection name. (Required)	Recommended	6.0+	2.1.0+
Connection Type	As of 2019/05/29, only connections using the `F5 Acess` app are supported.	Recommended	6.0+	2.1.0+
Server★	Enter the host name or IP address of the VPN server.	Recommended	6.0+	2.1.0+
Account	Enter the user account for authenticating the connection. Optional (if ID and password are required for authentication) Enclose any value in {{ and }}. (Example) {{id}}	Recommended	6.0+	2.1.0+
User Authentication	Select the VPN authentication type. Select `Certificate` for certificate-only authentication, or `Password + Certificate` for authentication with a certificate plus an ID and password.	Recommended	6.0+	2.1.0+
Password Displayed only when `Password+Certificate` is selected for User Authentication	Enter the password for connection authentication. Optional (if ID and password are required for authentication) Enclose any value in {{ and }}. (Example) {{pw}}	Recommended	6.0+	2.1.0+

Device Owner

Item	Description	EMM Settings	OS Ver.	BizGo! MDM Ver.
Password Policy (Device) This is the password policy for locking the device.
Number of Failed Attempts Allowed	(Only when a password is required) Specify the number of password attempts allowed before the device is wiped (all data on the device is erased).
Time Until Device Lock	(Only when a password is required) Specify the time until the device locks.
Minimum Password Length	(Only when a password is required) Specify the minimum password length.
Password Type	(Only when a password is required) Specify the password type from the following. Complex (letters, numbers, and symbols are required) Something (`pattern` can also be used) Numeric (allows `PIN`) Alphabetic Alphanumeric
Password Expiration	(Only when a password is required and the type is other than `Something`) Specify the number of changes required before the same password can be reused.
Password History	(Only when a password is required and the type is other than `Something`) Specify the number of changes required before the same password can be reused.
System Settings
Sleep Time	You can specify the time until the device goes to sleep.
Configuration Policy
Proxy Server and Port	Specify the URL and port of the global proxy used on the device. Caution If this setting is incorrect, the device cannot communicate at all and must be reset to factory settings to recover. Note Communication to the MDM server and to the following Google servers required for the basic MDM functions does not go through the proxy server. accounts.google.com play.google.com android.clients.google.com .googleapis.com .gstatic.com .googleusercontent.com .gvt1.com .ggpht.com .android.clients.google.com Caution The following destination required for in-house app distribution is not covered by the proxy bypass described above. You must allow this traffic on the proxy server. bizmo-libra.s3.amazonaws.com
Mute Master Volume	The master volume of the device is set to `silent`, and the device stays silent even when the volume buttons are pressed.
Force Specific `Always Open` Apps	You can specify the app that is always used to open files of a specific format.
Restriction Policy
Disable Camera	Specify whether the device camera can be used.
Disable Manual Time Setting	The time on the device can no longer be set manually.
Disable Screenshots	The screenshot function is disabled on the entire device.
User Restriction: Disable Changing Application Settings	Users can no longer change the settings of installed applications (for example, force-stopping or uninstalling applications).
User Restriction: Disable Pop-up Windows	You can prevent applications from displaying pop-ups.
User Restriction: Disable Installing Applications	Users can no longer install new Google Play Store apps or in-house apps. To prohibit use of the Google Play Store, set `Prohibit Google Play Store use by non-EMM accounts`. If this restriction is enabled, apps from the MDM cannot be installed either.
User Restriction: Disable Installing Apps from Unknown Sources	Installing apps from third-party stores and the web is uniformly prohibited, except for the Play Store and in-house apps distributed via the MDM.
User Restriction: Disable Adding and Removing Accounts	Accounts can no longer be added to or removed from the device.
User Restriction: Disable Changing Location Settings	You can prohibit changing the location settings of the device.
User Restriction: Disable Location Sharing	You can turn off the location settings of the device.
User Restriction: Disable Uninstalling Applications	Applications installed on the device can no longer be uninstalled.
User Restriction: Disable Turning Off App Verification	Prevents Google Play Protect app scanning from being turned off. Google always checks for malicious behavior, even in apps downloaded from third-party app markets.
User Restriction: Disable Adding Users	New device users can no longer be added.
User Restriction: Disable Adjusting Volume	The volume of the device can no longer be adjusted.
User Restriction: Disable Bluetooth	Bluetooth can no longer be used.
User Restriction: Disable Sending Files via Bluetooth	Files can no longer be sent using Bluetooth.
User Restriction: Disable Changing Bluetooth Settings	Bluetooth settings can no longer be changed.
User Restriction: Disable Changing Emergency Alert Settings	Emergency alert settings can no longer be changed.
User Restriction: Disable Changing Credentials Settings	Users can no longer install certificates from storage or delete installed certificates.
User Restriction: Disable Changing Mobile Network Settings	Mobile network settings can no longer be changed.
User Restriction: Disable Changing Tethering & Hotspot Settings	Tethering and portable access point settings can no longer be changed.
User Restriction: Disable Changing VPN Settings	VPN settings can no longer be changed.
User Restriction: Disable Changing Wi-Fi Settings	The Wi-Fi destination and connection settings can no longer be changed.
User Restriction: Disable Changing Debugging Settings	The USB debugging mode setting of the device can no longer be changed.
User Restriction: Disable Factory Reset	The device can no longer be reset to factory settings.
User Restriction: Disable External Media	You can prohibit connecting external media (such as SD cards) to the device. Note: Some devices do not support external media at all. On those devices, this setting cannot be enabled.
User Restriction: Disable Outgoing Calls	Note: To use this feature, you must apply for the Call Allowlist option. This is an allowlist that restricts outgoing calls. You can select from the following options. Do not disable outgoing calls Disable outgoing calls to all phone numbers (except emergency calls) Disable outgoing calls to phone numbers that are not permitted (except emergency calls) Note: When you enable this option, the Phone Number and Remarks fields appear. Fill them in. Enter phone numbers without hyphens and with the first digit removed (because the international dialing code is added).
User Restriction: Disable Removing Users	Users registered on the device can no longer be removed.
User Restriction: Disable Sending SMS	SMS can no longer be sent.
User Restriction: Disable Unmuting the Microphone	Users can no longer unmute the microphone for applications that access it.
User Restriction: Disable Sending and Receiving Files via USB	Files can no longer be sent to or received from external devices via a USB cable.
User Restriction: Disable Sending Data via NFC Note: Supported only on Android 5.1 and later	Data such as the phonebook can no longer be shared with other devices via NFC.		5.1+
Allow Backup Service	You can allow the Google backup service.
Disable Accessibility	Settings for third-party accessibility apps can no longer be configured. The accessibility apps themselves can still be installed.
Permitted Input Methods	An allowlist of input methods that can be used in addition to the standard input method preinstalled on the device. You can select from the following options. Enable all Disable all except the standard one Specify manually (if you select this option, click the [Add Permitted Input Method] button and enter the package name of the input method)
Disable Adding Accounts	Account names for the application specified in this item can no longer be added on the device.
Google Play Store Usage Restriction	The Google Play Store can no longer be used by non-EMM accounts.	Required		2.3.3+
Lock Screen Feature Restrictions (keyguard)	The operations specified in this item can no longer be performed on the lock screen. Disable all lock screen features Ignore trust agents (Smart Lock) Disable fingerprint unlock Disable camera Disable notifications Allow only notifications with hidden content
Certificates
Certificate	You can upload root certificates (.pem or .cer file extension) and client certificates (.p12 or .pfx file extension). Note: Register certificates used for Wi-Fi in the `Wi-Fi` payload.
Wi-Fi
SSID	Specify the SSID of the Wi-Fi network to use. (Required)
MAC Address Randomization	Specify whether to use the fixed MAC address unique to the device or a temporarily generated random address when connecting to a Wi-Fi network.
Hidden Network	Turn this on if the Wi-Fi network to use is open or does not broadcast its SSID.
Security Type	Specify the type of encryption used when connecting to the Wi-Fi network. Note: The settings below, such as `Password`, vary depending on the security type.
EAP Type	Select the authentication method.
Unique Name	Specify the credentials for connecting to the Wi-Fi network. You can select a certificate uploaded in the `Certificate` payload.
Password	Specify the password of the Wi-Fi network to connect to.
Client Certificate	You can upload a client certificate (.p12 file extension).
CA Certificate	You can upload a CA certificate (.cer file extension).
Domain Suffix Match	Enter this to verify the EAP server certificate by domain (DNS) suffix. On Android 11 and later, you must set either `Domain Suffix Match` or `Subject Alternative Name (SAN) Match`.
Subject Alternative Name (SAN) Match	Enter this to verify the EAP server certificate by subject alternative name. On Android 11 and later, you must set either `Subject Alternative Name (SAN) Match` or `Domain Suffix Match`.
Wi-Fi SSID Policy
Policy Type	Allowlist: Allows connections only to the specified SSIDs. Denylist: Prohibits connections to the specified SSIDs.
Global Settings Note: If you select `Not specified`, the default setting of the device is applied.
Enable ADB	You can specify whether to enable or disable use of the USB debugging mode of the device.
Enable Bluetooth	You can specify whether to enable or disable use of Bluetooth.
Enable Data Roaming	You can specify whether to enable or disable use of data roaming.
Enable Developer Options	You can specify whether to enable or disable use of developer options.
Enable Wi-Fi	You can specify whether to enable or disable use of Wi-Fi. Notes Set this to `Disable` only on devices that use 3G/LTE communication (exclusively or in addition to Wi-Fi). If you specify `Disable` for a device that uses only Wi-Fi communication, the device can no longer communicate externally at all.
Wi-Fi During Sleep	You can specify the Wi-Fi behavior while the device is asleep.
Security Settings
Default Input Method	Specify the default input method on the device. If left blank, the default input method of the device is applied. Notes Before applying this setting to a device, you must first set up the specified input method on the device (install the keyboard app). If you apply this setting before setting up the input method on the device, keyboard input becomes completely unavailable.
Location Acquisition Method	You can specify the location acquisition mode of the device.
Application Configuration
Apps to Hide	Specify the apps to hide. Specified apps are hidden on the device and stop working completely. Switching apps between hidden and shown may cause unstable behavior. This method is not recommended if you control app availability by switching templates with Geofence or Time-based Management. The following apps cannot be hidden. ・Google Play services (com.google.android.gms) ・Settings app (com.android.settings) ・Google Play (com.android.vending) ・Google (com.google.android.googlequicksearchbox) ・Phone app (com.android.dialer)
Apps to Suspend	Specify the apps to suspend. Suspended apps have grayed-out icons and cannot be launched. This method is recommended if you control app availability by switching templates with Geofence or Time-based Management. The following apps cannot be suspended. ・Google Play services (com.google.android.gms) ・Settings app (com.android.settings) ・Google Play (com.android.vending) ・Google (com.google.android.googlequicksearchbox) ・Phone app (com.android.dialer)
Per App Settings	Specify the settings for each app. Enter the app package name and the settings (JSON format). You can also set values from the profile. For how to configure this, see Distributing Application Settings (Per App Settings).	Required
System App Settings	Enables (shows) preinstalled apps that the OS automatically disables (hides) when the device is enrolled in the MDM, so that they can be used. If you enroll using a BizMobile Go! QR code with "Show system apps" specified, all preinstalled apps become available after enrollment, so this setting is not needed.		8.0+
Apps That Cannot Be Uninstalled	You can specify apps that are prohibited from being uninstalled.
Allowed Lock Task Mode Applications	Specify the app used for device lock. Once the specified app is installed on the device, it can be used for device lock.		8.0 or earlier
Permission Request Policy You can specify how permission requests are handled when an app starts. (Example) When you distribute a Line Camera app, allowing camera use in advance prevents the permission pop-up from appearing on the device. Note: Support for this feature depends on the app. You can also specify whether app notifications are allowed.
Overall Permission Request Policy	You can specify how permission requests are handled when an app starts.			2.0+
Per App Runtime Permission Policy	You can specify how permission requests are handled when an app starts, for each app.			2.0+
System Update
System Update Policy	Select how OS updates are run from the following options. Not specified Updates are performed automatically in the background when all three conditions are met: connected to Wi-Fi, charging, and idle (does not interfere with the user's operation) Automatic install Installation starts as soon as an update becomes available, regardless of the above conditions (the user's work may be interrupted) Automatic install during a specified time window A time restriction is added to the conditions for `Automatic install` Postpone for 30 days When the postponement period ends, the device switches to the default operation mode `Not specified`			2.0+
Kiosk Settings Use this feature when the device is used as a dedicated device. Only the apps you specify are displayed on the home screen. For detailed steps, see Set Up Kiosk Mode.
Apps	Specify the apps to display on the home screen. You can also display multiple apps. You also need to complete some steps on the device. After configuring the profile settings, open the BizGo!MDM agent app on the device, select `Kiosk mode`, and configure Kiosk mode by following the on-screen instructions.		9.0+	2.0+
Passcode★	Specify the password required to exit Kiosk mode on the device. (Required) To exit Kiosk mode, tap the Back button on the device several times. When the `Exit Kiosk mode` pop-up appears, enter the passcode specified here.		9.0+	2.0+
Lock Screen Message
Lock Screen Message	Configure the text displayed on the lock screen. The maximum number of characters is 60.		7+	2.6.6+
VPN Note: Displayed only when the profile type `Custom` is selected. For the profile configuration procedure, see Steps to create a VPN profile.
Connection Name★	Enter the connection name. (Required)	Recommended	6.0+	2.1.0+
Connection Type	As of 2019/05/29, only connections using the `F5 Acess` app are supported.	Recommended	6.0+	2.1.0+
Server★	Enter the host name or IP address of the VPN server.	Recommended	6.0+	2.1.0+
Account	Enter the user account for authenticating the connection. Optional (if ID and password are required for authentication) Enclose any value in {{ and }}. (Example) {{id}}	Recommended	6.0+	2.1.0+
User Authentication	Select the VPN authentication type. Select `Certificate` for certificate-only authentication, or `Password + Certificate` for authentication with a certificate plus an ID and password.	Recommended	6.0+	2.1.0+
Password Displayed only when `Password+Certificate` is selected for User Authentication	Enter the password for connection authentication. Optional (if ID and password are required for authentication) Enclose any value in {{ and }}. (Example) {{pw}}	Recommended	6.0+	2.1.0+