Android MDM policies

A policy is a set of rules OpsMerge enforces on an Android device. One policy covers eleven areas; you turn on the ones you need and leave the rest off.

The eleven rule types

• Passcode — screen-lock complexity, minimum length, wipe-after-N-failures, expiry.
• Encryption — require full-device encryption with a password.
• Apps — a list of mandatory, force-installed apps. All other apps are blocked.
• Location — location reporting mode.
• Lost mode — whether the user can factory-reset the device.
• Wi-Fi — networks pushed to the device automatically.
• OS updates — automatic, windowed, or postponed updates.
• Kiosk — lock the device into dedicated-device (kiosk) mode.
• Security — hardening baseline: block sideloading, developer settings, and USB data transfer; force Play Protect; disable camera, microphone, screen capture, or 2G; require a minimum Wi-Fi security level; and set factory-reset protection admin accounts so a stolen, wiped device can't be re-set-up.
• Enforcement — automatic remediation when a device stays non-compliant with its passcode policy: apps are blocked after a number of days (the user sees how to fix it) and the device is wiped after a longer threshold.
• BYOD — boundaries for work profiles on employee-owned devices: cross-profile copy/paste and data sharing, work contacts visibility, widget permissions, maximum days with the work profile paused, and personal-side camera/screen-capture restrictions. Only applies to devices enrolled in work-profile (BYOD) mode.

Edit a policy under Settings → MDM → Devices → Policies. Toggle each rule on in the left list and fill in its form on the right, then Save.

Every policy also enables device-health reporting (battery and temperature telemetry) and on-device security event logging (failed unlock attempts, ADB access, certificate installs, and similar). Android shows device users a notice that activity may be logged - that notice is part of Google's required disclosure, so leave your users' questions pointed at it. Events appear on the device's Compliance tab, and lost-mode GPS fixes on its Location tab.

Choosing mandatory apps

In the Apps rule, click Browse Google Play to open the Managed Google Play picker. Approve the apps you want and they're added to the force-installed list. You can also add an app directly by its package name (for example com.example.app).

App templates

The quick-add templates below the app list add curated bundles of essential apps in one click - Google essentials (Chrome, Gmail, Calendar, Contacts, Messages, Files, Gboard, Photos, Clock, Calculator), Communication (Messages, Gmail, Meet, Phone) and Microsoft 365 (Outlook, Teams, OneDrive, Microsoft 365). Templates only add packages that aren't already listed; remove any you don't want before saving.

Whitelisted apps are force-installed and the Play Store is restricted to the list. Pre-installed system apps (such as the manufacturer's camera) are not affected by the whitelist and stay available.

Device shows most apps disabled after enrolment?

If the policy requires a passcode, Android disables apps until the user sets a compliant PIN or password on the device. Set the PIN and the apps re-enable.

Kiosk mode

The Kiosk rule locks a device into dedicated-device (kiosk) mode: the keyguard and status bar are disabled so it behaves like an appliance. There are two modes:

• Single app — the device is locked to one app. Enter that app's package name (for example com.example.kiosk).
• Multi-app launcher — the device shows a locked launcher built from the Apps rule's force-installed list. Turn on the Apps rule as well and add the apps you want on the launcher; a multi-app kiosk with no force-installed apps is rejected.

The Lockdown section hardens the kiosk further: block the power menu and the Settings app, mute system error dialogs, restrict system navigation (home only, or none), and fix screen brightness and timeout for signage (Android 15+). The network escape hatch deserves a special mention: leave it on for any kiosk that might move location, or a device that can't reach a known Wi-Fi network after a reset is effectively bricked until someone can drive to it.

The OS updates rule also supports annual freeze windows (up to 90 days each, e.g. over Christmas trading) during which no OTA updates are applied, and the Wi-Fi rule supports WPA-EAP (802.1X PEAP) enterprise networks with a username and password alongside WPA-PSK.

Rolling a policy out to devices ("groups")

Android applies exactly one policy per device. OpsMerge resolves which one using a hierarchy:

1. A policy assigned directly to the device (on its detail page) wins.
2. Otherwise, the device's site default applies.
3. Otherwise, the organisation default applies.

So the way to apply a policy to a group of devices is to set it as a site default: every device in that site picks it up. Set org and site defaults under Settings → MDM → Devices → Policies, in the Assign policies to devices section. OpsMerge pushes the change to affected devices automatically.

There's no separate "app group" — apps live inside each policy. If two groups of devices need different apps, make two policies.