Updates or creates a policy.
Path parameters
The name of the policy in the form enterprises/{enterpriseId}/policies/{policyId}.
Query parameters
The field mask indicating the fields to update. If not set, all modifiable fields will be modified.
Request body
If camera_access is set to any value other than CAMERA_ACCESS_UNSPECIFIED, this has no effect. Otherwise this field controls whether cameras are disabled: If true, all cameras are disabled, otherwise they are available. For fully managed devices this field applies for all apps on the device. For work profiles, this field applies only to apps in the work profile, and the camera access of apps outside the work profile is unaffected.
Optional. Wipe flags to indicate what data is wiped when a device or profile wipe is triggered due to any reason (for example, non-compliance). This does not apply to the enterprises.devices.delete method. . This list must not have duplicates.
Whether configuring Wi-Fi networks is disabled. Supported on fully managed devices and work profiles on company-owned devices. For fully managed devices, setting this to true removes all configured networks and retains only the networks configured using openNetworkConfiguration. For work profiles on company-owned devices, existing configured networks are not affected and the user is not allowed to add, remove, or modify Wi-Fi networks. If configureWifi is set to anything other than CONFIGURE_WIFI_UNSPECIFIED, this setting is ignored. Note: If a network connection can't be made at boot time and configuring Wi-Fi is disabled then network escape hatch will be shown in order to refresh the device policy (see networkEscapeHatchEnabled).
This is deprecated.
Optional. Controls whether AssistContent (https://developer.android.com/reference/android/app/assist/AssistContent) is allowed to be sent to a privileged app such as an assistant app. AssistContent includes screenshots and information about an app, such as package name. This is supported on Android 15 and above.
The version of the policy. This is a read-only field. The version is incremented each time the policy is updated.
Whether using NFC to beam data from apps is disabled.
Whether configuring mobile networks is disabled.
Whether sending and receiving SMS messages is disabled.
Whether adding or removing accounts is disabled.
Whether bluetooth contact sharing is disabled.
If true, this disables the Lock Screen (https://source.android.com/docs/core/display/multi_display/lock-screen) for primary and/or secondary displays. This policy is supported only in dedicated device management mode.
Whether the network escape hatch is enabled. If a network connection can't be made at boot time, the escape hatch prompts the user to temporarily connect to a network in order to refresh the device policy. After applying policy, the temporary network will be forgotten and the device will continue booting. This prevents being unable to connect to a network if there is no suitable network in the last policy and the device boots into an app in lock task mode, or the user is otherwise unable to reach device settings.Note: Setting wifiConfigDisabled to true will override this setting under specific circumstances. Please see wifiConfigDisabled for further details. Setting configureWifi to DISALLOW_CONFIGURING_WIFI will override this setting under specific circumstances. Please see DISALLOW_CONFIGURING_WIFI for further details.
Controls the use of the camera and whether the user has access to the camera access toggle.
The default permission policy for runtime permission requests.
Whether transferring files over USB is disabled. This is supported only on company-owned devices.
Whether rebooting the device into safe boot is disabled.
Whether configuring tethering and portable hotspots is disabled. If tetheringSettings is set to anything other than TETHERING_SETTINGS_UNSPECIFIED, this setting is ignored.
Whether configuring VPN is disabled.
This field has no effect.
Optional. Controls whether printing is allowed. This is supported on devices running Android 9 and above. .
Network configuration for the device. See configure networks for more information.
Whether roaming data services are disabled.
This field has no effect.
Optional. Controls whether the enterpriseDisplayName is visible on the device (e.g. lock screen message on company-owned devices).
Whether adjusting the master volume is disabled. Also mutes the device. The setting has effect only on fully managed devices.
Disabled keyguard customizations, such as widgets.
Whether the status bar is disabled. This disables notifications, quick settings, and other screen overlays that allow escape from full-screen mode. DEPRECATED. To disable the status bar on a kiosk device, use InstallType KIOSK or kioskCustomLauncherEnabled.
Whether configuring cell broadcast is disabled.
Whether outgoing calls are disabled.
Whether app verification is force-enabled.
Whether bluetooth is disabled. Prefer this setting over bluetooth_config_disabled because bluetooth_config_disabled can be bypassed by the user.
Whether screen capture is disabled. This also blocks Circle to Search (https://support.google.com/android/answer/14508957).
Maximum time in milliseconds for user activity until the device locks. A value of 0 means there is no restriction.
Whether the user is allowed to have fun. Controls whether the Easter egg game in Settings is disabled.
Controls whether preferential network service is enabled on the work profile or on fully managed devices. For example, an organization may have an agreement with a carrier that all of the work data from its employees' devices will be sent via a network service dedicated for enterprise use. An example of a supported preferential network service is the enterprise slice on 5G networks. This policy has no effect if preferentialNetworkServiceSettings or ApplicationPolicy.preferentialNetworkId is set on devices running Android 13 or above.
Optional. Controls whether apps on the device for fully managed devices or in the work profile for devices with work profiles are allowed to expose app functions.
This mode controls which apps are available to the user in the Play Store and the behavior on the device when apps are removed from the policy.
Whether the user mounting physical external media is disabled.
Whether encryption is enabled
The minimum allowed Android API level.
Whether configuring user credentials is disabled.
Whether configuring bluetooth is disabled.
Whether USB storage is enabled. Deprecated.
Whether auto time is required, which prevents the user from manually setting the date and time. If autoDateAndTimeZone is set, this field is ignored.
If microphone_access is set to any value other than MICROPHONE_ACCESS_UNSPECIFIED, this has no effect. Otherwise this field controls whether microphones are disabled: If true, all microphones are disabled, otherwise they are available. This is available only on fully managed devices.
Whether resetting network settings is disabled. This applies only on fully managed devices. A NonComplianceDetail with MANAGEMENT_MODE is reported for other management modes.
Whether the kiosk custom launcher is enabled. This replaces the home screen with a launcher that locks down the device to the apps installed via the applications setting. Apps appear on a single page in alphabetical order. Use kioskCustomization to further configure the kiosk device behavior.
Optional. The policy for the autofill service.
The name of the policy in the form enterprises/{enterpriseId}/policies/{policyId}.
Account types that can't be managed by the user.
Whether the user is allowed to enable debugging features.
Optional. Controls which apps are allowed to act as credential providers on Android 14 and above. These apps store credentials, see this (https://developer.android.com/training/sign-in/passkeys) and this (https://developer.android.com/reference/androidx/credentials/CredentialManager) for details. See also credentialProviderPolicy.
The battery plugged in modes for which the device stays on. When using this setting, it is recommended to clear maximum_time_to_lock so that the device doesn't lock itself while it stays on.
Flag to skip hints on the first use. Enterprise admin can enable the system recommendation for apps to skip their user tutorial and other introductory hints on first start-up.
Whether auto date, time, and time zone are enabled on a company-owned device. If this is set, then autoTimeRequired is ignored.
Whether user installation of apps is disabled.
Whether location sharing is disabled.
Email addresses of device administrators for factory reset protection. When the device is factory reset, it will require one of these admins to log in with the Google account email and password to unlock the device. If no admins are specified, the device won't provide factory reset protection.
The degree of location detection enabled.
Whether changing the wallpaper is disabled.
This setting is not supported. Any value is ignored.
Recommended alternative: autoUpdateMode which is set per app, provides greater flexibility around update frequency.When autoUpdateMode is set to AUTO_UPDATE_POSTPONED or AUTO_UPDATE_HIGH_PRIORITY, this field has no effect.The app auto update policy, which controls when automatic app updates can be applied.
Whether creating windows besides app windows is disabled.
Whether removing other users is disabled.
Whether changing the user icon is disabled. This applies only on devices running Android 7 and above.
Whether factory resetting from settings is disabled.
Whether user uninstallation of applications is disabled. This prevents apps from being uninstalled, even those removed using applications
Allows showing UI on a device for a user to choose a private key alias if there are no matching rules in ChoosePrivateKeyRules. For devices below Android P, setting this may leave enterprise keys vulnerable. This value will have no effect if any application has CERT_SELECTION delegation scope.
Controls the use of the microphone and whether the user has access to the microphone access toggle. This applies only on fully managed devices.
Whether adding new users and profiles is disabled. For devices where managementMode is DEVICE_OWNER this field is ignored and the user is never allowed to add or remove users.
Response
Successful response