DevicePolicyManager

public class DevicePolicyManager
extends Object

java.lang.Object
   ↳ android.app.admin.DevicePolicyManager

Manages device policy and restrictions applied to the user of the device or apps running on the device.

This class contains three types of methods:

  1. Those aimed at managing apps
  2. Those aimed at the Device Policy Management Role Holder
  3. Those aimed at apps which wish to respect device policy

The intended caller for each API is indicated in its Javadoc.

Managing Apps

Apps can be made capable of setting device policy ("Managing Apps") either by being set as a Device Administrator, being set as a Device Policy Controller, or by holding the appropriate Permissions.

A Device Administrator is an app which is able to enforce device policies that it has declared in its device admin XML file. An app can prompt the user to give it device administator privileges using the ACTION_ADD_DEVICE_ADMIN action.

For more information about Device Administration, read the Device Administration developer guide.

Device Administrator apps can also be recognised as Device Policy Controllers. Device Policy Controllers can be one of two types:

  • A Device Owner, which only ever exists on the System User or Main User, is the most powerful type of Device Policy Controller and can affect policy across the device.
  • A Profile Owner, which can exist on any user, can affect policy on the user it is on, and when it is running on a profile has limited ability to affect policy on its parent.

Additional capabilities can be provided to Device Policy Controllers in the following circumstances:

For more information, see Building a Device Policy Controller.

Permissions are generally only given to apps fulfilling particular key roles on the device (such as managing device locks).

Device Policy Management Role Holder

One app on the device fulfills the Device Policy Management Role and is trusted with managing the overall state of Device Policy. This has access to much more powerful methods than managing apps.

Querying Device Policy

In most cases, regular apps do not need to concern themselves with device policy, and restrictions will be enforced automatically. There are some cases where an app may wish to query device policy to provide a better user experience. Only a small number of policies allow apps to query them directly. These APIs will typically have no special required permissions.

Managed Provisioning

Managed Provisioning is the process of recognising an app as a Device Owner or Profile Owner. It involves presenting education and consent screens to the user to ensure they are aware of the capabilities this grants the Device Policy Controller

For more information on provisioning, see Building a Device Policy Controller.

A Managed Profile enables data separation. For example to use a device both for personal and corporate usage. The managed profile and its parent share a launcher.

Affiliation

Using the setAffiliationIds(ComponentName, Set) method, a Device Owner can set a list of affiliation ids for the System User. Any Profile Owner on the same device can also call setAffiliationIds(ComponentName, Set) to set affiliation ids for the user it is on. When there is the same ID present in both lists, the user is said to be "affiliated" and we can refer to the Profile Owner as a "profile owner on an affiliated user" or an "affiliated profile owner". Becoming affiliated grants the Profile Owner capabilities similar to that of the Device Owner. It also allows use of the bindDeviceAdminServiceAsUser(ComponentName, Intent, ServiceConnection, BindServiceFlags, UserHandle) APIs for direct communication between the Device Owner and affiliated Profile Owners.

Organization Owned

An organization owned device is one which is not owned by the person making use of the device and is instead owned by an organization such as their employer or education provider. These devices are recognised as being organization owned either by the presence of a device owner or of a profile which has a profile owner is marked as organization owned.

Profile owners running on an organization owned device can exercise additional capabilities using the getParentProfileInstance(android.content.ComponentName) API which apply to the parent user. Each API will indicate if it is usable in this way.

Android Automotive

On "Android Automotive builds", some methods can throw "an exception" if an action is unsafe (for example, if the vehicle is moving). Callers running on "Android Automotive builds" should always check for this exception.
Restricted for SDK Runtime environment in API level 34.
Requires the PackageManager#FEATURE_DEVICE_ADMIN feature which can be detected using PackageManager.hasSystemFeature(String).

Summary

Nested classes

class DevicePolicyManager.InstallSystemUpdateCallback

Callback used in DevicePolicyManager.installSystemUpdate(ComponentName, Uri, Executor, InstallSystemUpdateCallback) to indicate that there was an error while trying to install an update. 

interface DevicePolicyManager.OnClearApplicationUserDataListener

Callback used in DevicePolicyManager.clearApplicationUserData(ComponentName, String, Executor, OnClearApplicationUserDataListener) to indicate that the clearing of an application's user data is done. 

Constants

String ACTION_ADD_DEVICE_ADMIN

Activity action: ask the user to add a new device administrator to the system.

String ACTION_ADMIN_POLICY_COMPLIANCE

Activity action: Starts the administrator to show policy compliance for the provisioning.

String ACTION_APPLICATION_DELEGATION_SCOPES_CHANGED

Broadcast Action: Sent after application delegation scopes are changed.

String ACTION_CHECK_POLICY_COMPLIANCE

Activity action: launch the DPC to check policy compliance.

String ACTION_DEVICE_ADMIN_SERVICE

Service action: Action for a service that device owner and profile owner can optionally own.

String ACTION_DEVICE_FINANCING_STATE_CHANGED

Broadcast Action: Broadcast sent to indicate that the device financing state has changed.

String ACTION_DEVICE_OWNER_CHANGED

Broadcast action: sent when the device owner is set, changed or cleared.

String ACTION_DEVICE_POLICY_RESOURCE_UPDATED

Broadcast action: notify system apps (e.g. settings, SysUI, etc) that the device management resources with IDs EXTRA_RESOURCE_IDS has been updated, the updated resources can be retrieved using DevicePolicyResourcesManager.getDrawable and DevicePolicyResourcesManager.getString.

String ACTION_GET_PROVISIONING_MODE

Activity action: Starts the administrator to get the mode for the provisioning.

String ACTION_MANAGED_PROFILE_PROVISIONED

Broadcast Action: This broadcast is sent to indicate that provisioning of a managed profile has completed successfully.

String ACTION_PROFILE_OWNER_CHANGED

Broadcast action: sent when the profile owner is set, changed or cleared.

String ACTION_PROVISIONING_SUCCESSFUL

Activity action: This activity action is sent to indicate that provisioning of a managed profile or managed device has completed successfully.

String ACTION_PROVISION_MANAGED_DEVICE

This constant was deprecated in API level 31. to support Build.VERSION_CODES.S and later, admin apps must implement activities with intent filters for the ACTION_GET_PROVISIONING_MODE and ACTION_ADMIN_POLICY_COMPLIANCE intent actions; using ACTION_PROVISION_MANAGED_DEVICE to start provisioning will cause the provisioning to fail; to additionally support pre-Build.VERSION_CODES.S, admin apps must also continue to use this constant.

String ACTION_PROVISION_MANAGED_PROFILE

Activity action: Starts the provisioning flow which sets up a managed profile.

String ACTION_SET_NEW_PARENT_PROFILE_PASSWORD

Activity action: have the user enter a new password for the parent profile.

String ACTION_SET_NEW_PASSWORD

Activity action: have the user enter a new password.

String ACTION_START_ENCRYPTION

Activity action: begin the process of encrypting data on the device.

String ACTION_SYSTEM_UPDATE_POLICY_CHANGED

Broadcast action: notify that a new local system update policy has been set by the device owner.

int APP_FUNCTIONS_DISABLED

Indicates that AppFunctionManager is controlled and disabled by policy, i.e.

int APP_FUNCTIONS_DISABLED_CROSS_PROFILE

Indicates that AppFunctionManager is controlled and disabled by a policy for cross profile interactions only, i.e.

int APP_FUNCTIONS_NOT_CONTROLLED_BY_POLICY

Indicates that AppFunctionManager is not controlled by policy.

int AUTO_TIME_DISABLED

Specifies the "disabled" auto time state.

int AUTO_TIME_ENABLED

Specifies the "enabled" auto time state.

int AUTO_TIME_NOT_CONTROLLED_BY_POLICY

Specifies that the auto time state is not controlled by device policy.

int AUTO_TIME_ZONE_DISABLED

Specifies the "disabled" auto time zone state.

int AUTO_TIME_ZONE_ENABLED

Specifies the "enabled" auto time zone state.

int AUTO_TIME_ZONE_NOT_CONTROLLED_BY_POLICY

Specifies that the auto time zone state is not controlled by device policy.

int CONTENT_PROTECTION_DISABLED

Indicates that content protection is controlled and disabled by a policy (default).

int CONTENT_PROTECTION_ENABLED

Indicates that content protection is controlled and enabled by a policy.

int CONTENT_PROTECTION_NOT_CONTROLLED_BY_POLICY

Indicates that content protection is not controlled by policy, allowing user to choose.

String DELEGATION_APP_RESTRICTIONS

Delegation of application restrictions management.

String DELEGATION_BLOCK_UNINSTALL

Delegation of application uninstall block.

String DELEGATION_CERT_INSTALL

Delegation of certificate installation and management.

String DELEGATION_CERT_SELECTION

Grants access to selection of KeyChain certificates on behalf of requesting apps.

String DELEGATION_ENABLE_SYSTEM_APP

Delegation for enabling system apps.

String DELEGATION_INSTALL_EXISTING_PACKAGE

Delegation for installing existing packages.

String DELEGATION_KEEP_UNINSTALLED_PACKAGES

Delegation of management of uninstalled packages.

String DELEGATION_NETWORK_LOGGING

Grants access to setNetworkLoggingEnabled(ComponentName, boolean), isNetworkLoggingEnabled(ComponentName) and retrieveNetworkLogs(ComponentName, long).

String DELEGATION_PACKAGE_ACCESS

Delegation of package access state.

String DELEGATION_PERMISSION_GRANT

Delegation of permission policy and permission grant state.

String DELEGATION_SECURITY_LOGGING

Grants access to setSecurityLoggingEnabled(ComponentName, boolean), isSecurityLoggingEnabled(ComponentName), retrieveSecurityLogs(ComponentName), and retrievePreRebootSecurityLogs(ComponentName).

int ENCRYPTION_STATUS_ACTIVATING

This constant was deprecated in API level 34. This result code has never actually been used, so there is no reason for apps to check for it.

int ENCRYPTION_STATUS_ACTIVE

Result code for setStorageEncryption(ComponentName, boolean) and getStorageEncryptionStatus(): indicating that encryption is active.

int ENCRYPTION_STATUS_ACTIVE_DEFAULT_KEY

Result code for getStorageEncryptionStatus(): indicating that encryption is active, but the encryption key is not cryptographically protected by the user's credentials.

int ENCRYPTION_STATUS_ACTIVE_PER_USER

Result code for getStorageEncryptionStatus(): indicating that encryption is active and the encryption key is tied to the user or profile.

int ENCRYPTION_STATUS_INACTIVE

Result code for setStorageEncryption(ComponentName, boolean) and getStorageEncryptionStatus(): indicating that encryption is supported, but is not currently active.

int ENCRYPTION_STATUS_UNSUPPORTED

Result code for setStorageEncryption(ComponentName, boolean) and getStorageEncryptionStatus(): indicating that encryption is not supported.

String EXTRA_ADD_EXPLANATION

An optional CharSequence providing additional explanation for why the admin is being added.

String EXTRA_DELEGATION_SCOPES

An ArrayList<String> corresponding to the delegation scopes given to an app in the ACTION_APPLICATION_DELEGATION_SCOPES_CHANGED broadcast.

String EXTRA_DEVICE_ADMIN

The ComponentName of the administrator component.

String EXTRA_DEVICE_PASSWORD_REQUIREMENT_ONLY

A boolean extra for ACTION_SET_NEW_PARENT_PROFILE_PASSWORD requesting that only device password requirement is enforced during the parent profile password enrolment flow.

String EXTRA_PASSWORD_COMPLEXITY

An integer indicating the complexity level of the new password an app would like the user to set when launching the action ACTION_SET_NEW_PASSWORD.

String EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE

An Account extra holding the account to migrate during managed profile provisioning.

String EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE

A Parcelable extra of type PersistableBundle that is passed directly to the Device Policy Controller after provisioning.

String EXTRA_PROVISIONING_ALLOWED_PROVISIONING_MODES

An ArrayList of Integer extra specifying the allowed provisioning modes.

String EXTRA_PROVISIONING_ALLOW_OFFLINE

A boolean extra indicating whether offline provisioning should be used.

String EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME

A ComponentName extra indicating the device admin receiver of the application that will be set as the Device Policy Controller.

String EXTRA_PROVISIONING_DEVICE_ADMIN_MINIMUM_VERSION_CODE

An int extra holding a minimum required version code for the device admin package.

String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM

A String extra holding the URL-safe base64 encoded SHA-256 hash of the file at download location specified in EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION.

String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_COOKIE_HEADER

A String extra holding a http cookie header which should be used in the http request to the url specified in EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION.

String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION

A String extra holding a url that specifies the download location of the device admin package.

String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME

This constant was deprecated in API level 23. Use EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME.

String EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM

A String extra holding the URL-safe base64 encoded SHA-256 checksum of any signature of the android package archive at the download location specified in EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION.

String EXTRA_PROVISIONING_DISCLAIMERS

A Bundle[] extra consisting of list of disclaimer headers and disclaimer contents.

String EXTRA_PROVISIONING_DISCLAIMER_CONTENT

A Uri extra pointing to disclaimer content.

String EXTRA_PROVISIONING_DISCLAIMER_HEADER

A String extra of localized disclaimer header.

String EXTRA_PROVISIONING_EMAIL_ADDRESS

This constant was deprecated in API level 26. From Build.VERSION_CODES.O, never used while provisioning the device.

String EXTRA_PROVISIONING_IMEI

A string extra holding the IMEI (International Mobile Equipment Identity) of the device.

String EXTRA_PROVISIONING_KEEP_ACCOUNT_ON_MIGRATION

Boolean extra to indicate that the migrated account should be kept.

String EXTRA_PROVISIONING_KEEP_SCREEN_ON

This constant was deprecated in API level 34. from Build.VERSION_CODES.UPSIDE_DOWN_CAKE, the flag wouldn't be functional. The screen is kept on throughout the provisioning flow.

String EXTRA_PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED

A Boolean extra that can be used by the mobile device management application to skip the disabling of system apps during provisioning when set to true.

String EXTRA_PROVISIONING_LOCALE

A String extra holding the Locale that the device will be set to.

String EXTRA_PROVISIONING_LOCAL_TIME

A Long extra holding the wall clock time (in milliseconds) to be set on the device's AlarmManager.

String EXTRA_PROVISIONING_LOGO_URI

This constant was deprecated in API level 33. Logo customization is no longer supported in the provisioning flow.

String EXTRA_PROVISIONING_MAIN_COLOR

This constant was deprecated in API level 31. Color customization is no longer supported in the provisioning flow.

String EXTRA_PROVISIONING_MODE

An intent extra holding the provisioning mode returned by the administrator.

String EXTRA_PROVISIONING_SENSORS_PERMISSION_GRANT_OPT_OUT

A boolean extra indicating the admin of a fully-managed device opts out of controlling permission grants for sensor-related permissions, see setPermissionGrantState(android.content.ComponentName, java.lang.String, java.lang.String, int).

String EXTRA_PROVISIONING_SERIAL_NUMBER

A string extra holding the serial number of the device.

String EXTRA_PROVISIONING_SHOULD_LAUNCH_RESULT_INTENT

A boolean extra that determines whether the provisioning flow should launch the resulting launch intent, if one is supplied by the device policy management role holder via EXTRA_RESULT_LAUNCH_INTENT.

String EXTRA_PROVISIONING_SKIP_EDUCATION_SCREENS

A boolean extra indicating if the education screens from the provisioning flow should be skipped.

String EXTRA_PROVISIONING_SKIP_ENCRYPTION

A boolean extra indicating whether device encryption can be skipped as part of provisioning.

String EXTRA_PROVISIONING_SKIP_USER_CONSENT

This constant was deprecated in API level 31. this extra is no longer relevant as device owners cannot create managed profiles

String EXTRA_PROVISIONING_TIME_ZONE

A String extra holding the time zone AlarmManager that the device will be set to.

String EXTRA_PROVISIONING_USE_MOBILE_DATA

A boolean extra indicating if mobile data should be used during the provisioning flow for downloading the admin app.

String EXTRA_PROVISIONING_WIFI_ANONYMOUS_IDENTITY

The anonymous identity of the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_CA_CERTIFICATE

The CA certificate of the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_DOMAIN

The domain of the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_EAP_METHOD

The EAP method of the wifi network in EXTRA_PROVISIONING_WIFI_SSID and could be one of PEAP, TLS, TTLS, PWD, SIM, AKA or AKA_PRIME.

String EXTRA_PROVISIONING_WIFI_HIDDEN

A boolean extra indicating whether the wifi network in EXTRA_PROVISIONING_WIFI_SSID is hidden or not.

String EXTRA_PROVISIONING_WIFI_IDENTITY

The identity of the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_PAC_URL

A String extra holding the proxy auto-config (PAC) URL for the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_PASSWORD

A String extra holding the password of the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_PHASE2_AUTH

The phase 2 authentication of the wifi network in EXTRA_PROVISIONING_WIFI_SSID and could be one of NONE, PAP, MSCHAP, MSCHAPV2, GTC, SIM, AKA or AKA_PRIME.

String EXTRA_PROVISIONING_WIFI_PROXY_BYPASS

A String extra holding the proxy bypass for the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_PROXY_HOST

A String extra holding the proxy host for the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_PROXY_PORT

An int extra holding the proxy port for the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_PROVISIONING_WIFI_SECURITY_TYPE

A String extra indicating the security type of the wifi network in EXTRA_PROVISIONING_WIFI_SSID and could be one of NONE, WPA, WEP or EAP.

String EXTRA_PROVISIONING_WIFI_SSID

A String extra holding the ssid of the wifi network that should be used during nfc device owner provisioning for downloading the mobile device management application.

String EXTRA_PROVISIONING_WIFI_USER_CERTIFICATE

The user certificate of the wifi network in EXTRA_PROVISIONING_WIFI_SSID.

String EXTRA_RESOURCE_IDS

An integer array extra for ACTION_DEVICE_POLICY_RESOURCE_UPDATED to indicate which resource IDs (i.e.

String EXTRA_RESOURCE_TYPE

An int extra for ACTION_DEVICE_POLICY_RESOURCE_UPDATED to indicate the type of the resource being updated, the type can be EXTRA_RESOURCE_TYPE_DRAWABLE or EXTRA_RESOURCE_TYPE_STRING

int EXTRA_RESOURCE_TYPE_DRAWABLE

A int value for EXTRA_RESOURCE_TYPE to indicate that a resource of type Drawable is being updated.

int EXTRA_RESOURCE_TYPE_STRING

A int value for EXTRA_RESOURCE_TYPE to indicate that a resource of type String is being updated.

String EXTRA_RESULT_LAUNCH_INTENT

An Intent result extra specifying the Intent to be launched after provisioning is finalized.

int FLAG_EVICT_CREDENTIAL_ENCRYPTION_KEY

Flag for lockNow(int): also evict the user's credential encryption key from the keyring.

int FLAG_MANAGED_CAN_ACCESS_PARENT

Flag used by addCrossProfileIntentFilter(ComponentName, IntentFilter, int) to allow activities in the managed profile to access intents sent from the parent profile.

int FLAG_PARENT_CAN_ACCESS_MANAGED

Flag used by addCrossProfileIntentFilter(ComponentName, IntentFilter, int) to allow activities in the parent profile to access intents sent from the managed profile.

int ID_TYPE_BASE_INFO

Specifies that the device should attest its manufacturer details.

int ID_TYPE_IMEI

Specifies that the device should attest its IMEI.

int ID_TYPE_INDIVIDUAL_ATTESTATION

Specifies that the device should attest using an individual attestation certificate.

int ID_TYPE_MEID

Specifies that the device should attest its MEID.

int ID_TYPE_SERIAL

Specifies that the device should attest its serial number.

int INSTALLKEY_REQUEST_CREDENTIALS_ACCESS

Specifies that the calling app should be granted access to the installed credentials immediately.

int INSTALLKEY_SET_USER_SELECTABLE

Specifies that a user can select the key via the Certificate Selection prompt.

int KEYGUARD_DISABLE_BIOMETRICS

Disable all biometric authentication on keyguard secure screens (e.g. PIN/Pattern/Password).

int KEYGUARD_DISABLE_FACE

Disable face authentication on keyguard secure screens (e.g. PIN/Pattern/Password).

int KEYGUARD_DISABLE_FEATURES_ALL

Disable all current and future keyguard customizations.

int KEYGUARD_DISABLE_FEATURES_NONE

Widgets are enabled in keyguard

int KEYGUARD_DISABLE_FINGERPRINT

Disable fingerprint authentication on keyguard secure screens (e.g. PIN/Pattern/Password).

int KEYGUARD_DISABLE_IRIS

Disable iris authentication on keyguard secure screens (e.g. PIN/Pattern/Password).

int KEYGUARD_DISABLE_REMOTE_INPUT

This constant was deprecated in API level 33. This flag was added in version Build.VERSION_CODES.N, but it never had any effect.

int KEYGUARD_DISABLE_SECURE_CAMERA

Disable the camera on secure keyguard screens (e.g. PIN/Pattern/Password)

int KEYGUARD_DISABLE_SECURE_NOTIFICATIONS

Disable showing all notifications on secure keyguard screens (e.g. PIN/Pattern/Password)

int KEYGUARD_DISABLE_SHORTCUTS_ALL

Disable all keyguard shortcuts.

int KEYGUARD_DISABLE_TRUST_AGENTS

Disable trust agents on secure keyguard screens (e.g. PIN/Pattern/Password).

int KEYGUARD_DISABLE_UNREDACTED_NOTIFICATIONS

Only allow redacted notifications on secure keyguard screens (e.g. PIN/Pattern/Password)

int KEYGUARD_DISABLE_WIDGETS_ALL

Disable all keyguard widgets.

int LEAVE_ALL_SYSTEM_APPS_ENABLED

Flag used by createAndManageUser(ComponentName, String, ComponentName, PersistableBundle, int) to specify that the newly created user should skip the disabling of system apps during provisioning.

int LOCK_TASK_FEATURE_BLOCK_ACTIVITY_START_IN_TASK

Enable blocking of non-allowlisted activities from being started into a locked task.

int LOCK_TASK_FEATURE_GLOBAL_ACTIONS

Enable the global actions dialog during LockTask mode.

int LOCK_TASK_FEATURE_HOME

Enable the Home button during LockTask mode.

int LOCK_TASK_FEATURE_KEYGUARD

Enable the keyguard during LockTask mode.

int LOCK_TASK_FEATURE_NONE

Disable all configurable SystemUI features during LockTask mode.

int LOCK_TASK_FEATURE_NOTIFICATIONS

Enable notifications during LockTask mode.

int LOCK_TASK_FEATURE_OVERVIEW

Enable the Overview button and the Overview screen during LockTask mode.

int LOCK_TASK_FEATURE_SYSTEM_INFO

Enable the system info area in the status bar during LockTask mode.

int MAKE_USER_EPHEMERAL

Flag used by createAndManageUser(ComponentName, String, ComponentName, PersistableBundle, int) to specify that the user should be created ephemeral.

String MIME_TYPE_PROVISIONING_NFC

This MIME type is used for starting the device owner provisioning.

int MTE_DISABLED

Require that MTE be disabled on the device.

int MTE_ENABLED

Require that MTE be enabled on the device, if supported.

int MTE_NOT_CONTROLLED_BY_POLICY

Allow the user to choose whether to enable MTE on the device.

int NEARBY_STREAMING_DISABLED

Indicates that nearby streaming is disabled.

int NEARBY_STREAMING_ENABLED

Indicates that nearby streaming is enabled.

int NEARBY_STREAMING_NOT_CONTROLLED_BY_POLICY

Indicates that nearby streaming is not controlled by policy, which means nearby streaming is allowed.

int NEARBY_STREAMING_SAME_MANAGED_ACCOUNT_ONLY

Indicates that nearby streaming is enabled only to devices offering a comparable level of security, with the same authenticated managed account.

int OPERATION_SAFETY_REASON_DRIVING_DISTRACTION

Indicates that a UnsafeStateException was thrown because the operation would distract the driver of the vehicle.

int PASSWORD_COMPLEXITY_HIGH

Constant for getPasswordComplexity() and setRequiredPasswordComplexity(int).

int PASSWORD_COMPLEXITY_LOW

Constant for getPasswordComplexity() and setRequiredPasswordComplexity(int).

int PASSWORD_COMPLEXITY_MEDIUM

Constant for getPasswordComplexity() and setRequiredPasswordComplexity(int).

int PASSWORD_COMPLEXITY_NONE

Constant for getPasswordComplexity() and setRequiredPasswordComplexity(int): no password.

int PASSWORD_QUALITY_ALPHABETIC

Constant for setPasswordQuality(ComponentName, int): the user must have entered a password containing at least alphabetic (or other symbol) characters.

int PASSWORD_QUALITY_ALPHANUMERIC

Constant for setPasswordQuality(ComponentName, int): the user must have entered a password containing at least both> numeric and alphabetic (or other symbol) characters.

int PASSWORD_QUALITY_BIOMETRIC_WEAK

Constant for setPasswordQuality(ComponentName, int): the policy allows for low-security biometric recognition technology.

int PASSWORD_QUALITY_COMPLEX

Constant for setPasswordQuality(ComponentName, int): allows the admin to set precisely how many characters of various types the password should contain to satisfy the policy.

int PASSWORD_QUALITY_NUMERIC

Constant for setPasswordQuality(ComponentName, int): the user must have entered a password containing at least numeric characters.

int PASSWORD_QUALITY_NUMERIC_COMPLEX

Constant for setPasswordQuality(ComponentName, int): the user must have entered a password containing at least numeric characters with no repeating (4444) or ordered (1234, 4321, 2468) sequences.

int PASSWORD_QUALITY_SOMETHING

Constant for setPasswordQuality(ComponentName, int): the policy requires some kind of password or pattern, but doesn't care what it is.

int PASSWORD_QUALITY_UNSPECIFIED

Constant for setPasswordQuality(ComponentName, int): the policy has no requirements for the password.

int PERMISSION_GRANT_STATE_DEFAULT

Runtime permission state: The user can manage the permission through the UI.

int PERMISSION_GRANT_STATE_DENIED

Runtime permission state: The permission is denied to the app and the user cannot manage the permission through the UI.

int PERMISSION_GRANT_STATE_GRANTED

Runtime permission state: The permission is granted to the app and the user cannot manage the permission through the UI.

int PERMISSION_POLICY_AUTO_DENY

Permission policy to always deny new permission requests for runtime permissions.

int PERMISSION_POLICY_AUTO_GRANT

Permission policy to always grant new permission requests for runtime permissions.

int PERMISSION_POLICY_PROMPT

Permission policy to prompt user for new permission requests for runtime permissions.

int PERSONAL_APPS_NOT_SUSPENDED

Return value for getPersonalAppsSuspendedReasons(ComponentName) when personal apps are not suspended.

int PERSONAL_APPS_SUSPENDED_EXPLICITLY

Flag for getPersonalAppsSuspendedReasons(ComponentName) return value.

int PERSONAL_APPS_SUSPENDED_PROFILE_TIMEOUT

Flag for getPersonalAppsSuspendedReasons(ComponentName) return value.

String POLICY_DISABLE_CAMERA

Constant to indicate the feature of disabling the camera.

String POLICY_DISABLE_SCREEN_CAPTURE

Constant to indicate the feature of disabling screen captures.

int PRIVATE_DNS_MODE_OFF

Specifies that Private DNS was turned off completely.

int PRIVATE_DNS_MODE_OPPORTUNISTIC

Specifies that the device owner requested opportunistic DNS over TLS

int PRIVATE_DNS_MODE_PROVIDER_HOSTNAME

Specifies that the device owner configured a specific host to use for Private DNS.

int PRIVATE_DNS_MODE_UNKNOWN

Specifies that the Private DNS setting is in an unknown state.

int PRIVATE_DNS_SET_ERROR_FAILURE_SETTING

General failure to set the Private DNS mode, not due to one of the reasons listed above.

int PRIVATE_DNS_SET_ERROR_HOST_NOT_SERVING

If the privateDnsHost provided was of a valid hostname but that host was found to not support DNS-over-TLS.

int PRIVATE_DNS_SET_NO_ERROR

The selected mode has been set successfully.

int PROVISIONING_MODE_FULLY_MANAGED_DEVICE

The provisioning mode for fully managed device.

int PROVISIONING_MODE_MANAGED_PROFILE

The provisioning mode for managed profile.

int PROVISIONING_MODE_MANAGED_PROFILE_ON_PERSONAL_DEVICE

The provisioning mode for a managed profile on a personal device.

int RESET_PASSWORD_DO_NOT_ASK_CREDENTIALS_ON_BOOT

Flag for resetPasswordWithToken(ComponentName, String, byte, int) and resetPassword(String, int): don't ask for user credentials on device boot.

int RESET_PASSWORD_REQUIRE_ENTRY

Flag for resetPasswordWithToken(ComponentName, String, byte, int) and resetPassword(String, int): don't allow other admins to change the password again until the user has entered it.

int SKIP_SETUP_WIZARD

Flag used by createAndManageUser(ComponentName, String, ComponentName, PersistableBundle, int) to skip setup wizard after creating a new user.

int WIFI_SECURITY_ENTERPRISE_192

Constant for getMinimumRequiredWifiSecurityLevel() and setMinimumRequiredWifiSecurityLevel(int): enterprise 192 bit network.

int WIFI_SECURITY_ENTERPRISE_EAP

Constant for getMinimumRequiredWifiSecurityLevel() and setMinimumRequiredWifiSecurityLevel(int): enterprise EAP network.

int WIFI_SECURITY_OPEN

Constant for getMinimumRequiredWifiSecurityLevel() and setMinimumRequiredWifiSecurityLevel(int): no minimum security level.

int WIFI_SECURITY_PERSONAL

Constant for getMinimumRequiredWifiSecurityLevel() and setMinimumRequiredWifiSecurityLevel(int): personal network such as WEP, WPA2-PSK.

int WIPE_EUICC

Flag for wipeData(int): also erase the device's eUICC data.

int WIPE_EXTERNAL_STORAGE

Flag for wipeData(int): also erase the device's adopted external storage (such as adopted SD cards).

int WIPE_RESET_PROTECTION_DATA

Flag for wipeData(int): also erase the factory reset protection data.

int WIPE_SILENTLY

Flag for wipeData(int): won't show reason for wiping to the user.

Public methods

void acknowledgeDeviceCompliant()

Called by a profile owner of an organization-owned managed profile to acknowledge that the device is compliant and the user can turn the profile off if needed according to the maximum time off policy.

void addCrossProfileIntentFilter(ComponentName admin, IntentFilter filter, int flags)

Called by the profile owner of a managed profile so that some intents sent in the managed profile can also be resolved in the parent, or vice versa.

boolean addCrossProfileWidgetProvider(ComponentName admin, String packageName)

Called by the profile owner of a managed profile or a holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_PROFILE_INTERACTION to enable widget providers from a given package to be available in the parent profile.

int addOverrideApn(ComponentName admin, ApnSetting apnSetting)

Called by device owner or managed profile owner to add an override APN.

void addPersistentPreferredActivity(ComponentName admin, IntentFilter filter, ComponentName activity)

Called by a profile owner or device owner or holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_LOCK_TASK.

void addUserRestriction(ComponentName admin, String key)

Called by a profile owner, device owner or a holder of any permission that is associated with a user restriction to set a user restriction specified by the key.

void addUserRestrictionGlobally(String key)

Called by a profile owner, device owner or a holder of any permission that is associated with a user restriction to set a user restriction specified by the provided key globally on all users.

boolean bindDeviceAdminServiceAsUser(ComponentName admin, Intent serviceIntent, ServiceConnection conn, int flags, UserHandle targetUser)

Called by a device owner to bind to a service from a secondary managed user or vice versa.

boolean bindDeviceAdminServiceAsUser(ComponentName admin, Intent serviceIntent, ServiceConnection conn, Context.BindServiceFlags flags, UserHandle targetUser)

See bindDeviceAdminServiceAsUser(android.content.ComponentName, android.content.Intent, android.content.ServiceConnection, int, android.os.UserHandle).

boolean canAdminGrantSensorsPermissions()

Returns true if the caller is running on a device where an admin can grant permissions related to device sensors.

boolean canUsbDataSignalingBeDisabled()

Returns whether enabling or disabling USB data signaling is supported on the device.

void clearApplicationUserData(ComponentName admin, String packageName, Executor executor, DevicePolicyManager.OnClearApplicationUserDataListener listener)

Called by the device owner or profile owner to clear application user data of a given package.

void clearCrossProfileIntentFilters(ComponentName admin)

Called by a profile owner of a managed profile to remove the cross-profile intent filters that go from the managed profile to the parent, or from the parent to the managed profile.

void clearDeviceOwnerApp(String packageName)

This method was deprecated in API level 26. This method is expected to be used for testing purposes only. The device owner will lose control of the device and its data after calling it. In order to protect any sensitive data that remains on the device, it is advised that the device owner factory resets the device instead of calling this method. See wipeData(int).

void clearPackagePersistentPreferredActivities(ComponentName admin, String packageName)

Called by a profile owner or device owner or holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_LOCK_TASK to remove all persistent intent handler preferences associated with the given package that were set by addPersistentPreferredActivity(ComponentName, IntentFilter, ComponentName).

void clearProfileOwner(ComponentName admin)

This method was deprecated in API level 26. This method is expected to be used for testing purposes only. The profile owner will lose control of the user and its data after calling it. In order to protect any sensitive data that remains on this user, it is advised that the profile owner deletes it instead of calling this method. See wipeData(int).

boolean clearResetPasswordToken(ComponentName admin)

Called by a profile, device owner or holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_RESET_PASSWORD to revoke the current password reset token.

void clearUserRestriction(ComponentName admin, String key)

Called by a profile owner, device owner or a holder of any permission that is associated with a user restriction to clear a user restriction specified by the key.

Intent createAdminSupportIntent(String restriction)

Called by any app to display a support dialog when a feature was disabled by an admin.

UserHandle createAndManageUser(ComponentName admin, String name, ComponentName profileOwner, PersistableBundle adminExtras, int flags)

Called by a device owner to create a user with the specified name and a given component of the calling package as profile owner.

int enableSystemApp(ComponentName admin, Intent intent)

Re-enable system apps by intent that were disabled by default when the user was initialized.

void enableSystemApp(ComponentName admin, String packageName)

Re-enable a system app that was disabled by default when the user was initialized.

AttestedKeyPair generateKeyPair(ComponentName admin, String algorithm, KeyGenParameterSpec keySpec, int idAttestationFlags)

This API can be called by the following to generate a new private/public key pair:

If the device supports key generation via secure hardware, this method is useful for creating a key in KeyChain that never left the secure hardware.

String[] getAccountTypesWithManagementDisabled()

Gets the array of accounts for which account management is disabled by the profile owner or device owner.

List<ComponentName> getActiveAdmins()

Return a list of all currently active device administrators' component names.

Set<String> getAffiliationIds(ComponentName admin)

Returns the set of affiliation ids previously set via setAffiliationIds(ComponentName, Set), or an empty set if none have been set.

Set<String> getAlwaysOnVpnLockdownWhitelist(ComponentName admin)

Called by device or profile owner to query the set of packages that are allowed to access the network directly when always-on VPN is in lockdown mode but not connected.

String getAlwaysOnVpnPackage(ComponentName admin)

Called by a device or profile owner to read the name of the package administering an always-on VPN connection for the current user.

int getAppFunctionsPolicy()

Returns the current AppFunctionManager policy.

Bundle getApplicationRestrictions(ComponentName admin, String packageName)

Retrieves the application restrictions for a given target application running in the calling user.

String getApplicationRestrictionsManagingPackage(ComponentName admin)

This method was deprecated in API level 26. From Build.VERSION_CODES.O. Use getDelegatePackages(ComponentName, String) with the DELEGATION_APP_RESTRICTIONS scope instead.

boolean getAutoTimeEnabled(ComponentName admin)

Returns true if auto time is enabled on the device.

int getAutoTimePolicy()

Returns current auto time policy's state.

boolean getAutoTimeRequired()

This method was deprecated in API level 30. From Build.VERSION_CODES.R. Use getAutoTimeEnabled(ComponentName)

boolean getAutoTimeZoneEnabled(ComponentName admin)

Returns true if auto time zone is enabled on the device.

int getAutoTimeZonePolicy()

Returns auto time zone policy's current state.

List<UserHandle> getBindDeviceAdminTargetUsers(ComponentName admin)

Returns the list of target users that the calling device owner or owner of secondary user can use when calling bindDeviceAdminServiceAsUser(ComponentName, Intent, ServiceConnection, BindServiceFlags, UserHandle).

boolean getBluetoothContactSharingDisabled(ComponentName admin)

Called by a profile owner of a managed profile to determine whether or not Bluetooth devices cannot access enterprise contacts.

boolean getCameraDisabled(ComponentName admin)

Determine whether or not the device's cameras have been disabled for this user, either by the calling admin, if specified, or all admins.

String getCertInstallerPackage(ComponentName admin)

This method was deprecated in API level 26. From Build.VERSION_CODES.O. Use getDelegatePackages(ComponentName, String) with the DELEGATION_CERT_INSTALL scope instead.

int getContentProtectionPolicy(ComponentName admin)

Returns the current content protection policy.

PackagePolicy getCredentialManagerPolicy()

Called by a device owner or profile owner of a managed profile to retrieve the credential manager policy.

Set<String> getCrossProfileCalendarPackages(ComponentName admin)

This method was deprecated in API level 34. Use setCrossProfilePackages(android.content.ComponentName, java.util.Set).

boolean getCrossProfileCallerIdDisabled(ComponentName admin)

This method was deprecated in API level 34. starting with Build.VERSION_CODES.UPSIDE_DOWN_CAKE, use getManagedProfileCallerIdAccessPolicy() instead

boolean getCrossProfileContactsSearchDisabled(ComponentName admin)

This method was deprecated in API level 34. From Build.VERSION_CODES.UPSIDE_DOWN_CAKE use getManagedProfileContactsAccessPolicy()

Set<String> getCrossProfilePackages(ComponentName admin)

Returns the set of package names that the admin has previously set as allowed to request user consent for cross-profile communication, via setCrossProfilePackages(android.content.ComponentName, java.util.Set).

List<String> getCrossProfileWidgetProviders(ComponentName admin)

Called by the profile owner of a managed profile or a holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_PROFILE_INTERACTION to query providers from which packages are available in the parent profile.

int getCurrentFailedPasswordAttempts()

Retrieve the number of times the user has failed at entering a password since that last successful password entry.

List<String> getDelegatePackages(ComponentName admin, String delegationScope)

Called by a profile owner or device owner to retrieve a list of delegate packages that were granted a delegation scope.

List<String> getDelegatedScopes(ComponentName admin, String delegatedPackage)

Called by a profile owner or device owner to retrieve a list of the scopes given to a delegate package.

CharSequence getDeviceOwnerLockScreenInfo()
String getDevicePolicyManagementRoleHolderPackage()

Returns the package name of the device policy management role holder.

CharSequence getEndUserSessionMessage(ComponentName admin)

Returns the user session end message.

String getEnrollmentSpecificId()

Returns an enrollment-specific identifier of this device, which is guaranteed to be the same value for the same device, enrolled into the same organization by the same managing app.

FactoryResetProtectionPolicy getFactoryResetProtectionPolicy(ComponentName admin)

Callable by device owner or profile owner of an organization-owned device, to retrieve the current factory reset protection (FRP) policy set previously by setFactoryResetProtectionPolicy(ComponentName, FactoryResetProtectionPolicy).

String getGlobalPrivateDnsHost(ComponentName admin)

Returns the system-wide Private DNS host.

int getGlobalPrivateDnsMode(ComponentName admin)

Returns the system-wide Private DNS mode.

List<byte[]> getInstalledCaCerts(ComponentName admin)

Returns all CA certificates that are currently trusted, excluding system CA certificates.

List<String> getKeepUninstalledPackages(ComponentName admin)

Get the list of apps to keep around as APKs even if no user has currently installed it.

Map<Integer, Set<String>> getKeyPairGrants(String alias)

Called by a device or profile owner, or delegated certificate chooser (an app that has been delegated the DELEGATION_CERT_SELECTION privilege), to query which apps have access to a given KeyChain key.

int getKeyguardDisabledFeatures(ComponentName admin)

Determine whether or not features have been disabled in keyguard either by the calling admin, if specified, or all admins that set restrictions on this user and its participating profiles.

int getLockTaskFeatures(ComponentName admin)

Gets which system features are enabled for LockTask mode.

String[] getLockTaskPackages(ComponentName admin)

Returns the list of packages allowed to start the lock task mode.

CharSequence getLongSupportMessage(ComponentName admin)

Called by a device admin to get the long support message.

PackagePolicy getManagedProfileCallerIdAccessPolicy()

Called by a profile owner of a managed profile to retrieve the caller id policy.

PackagePolicy getManagedProfileContactsAccessPolicy()

Called by a profile owner of a managed profile to determine the current policy applied to managed profile contacts.

long getManagedProfileMaximumTimeOff(ComponentName admin)

Called by a profile owner of an organization-owned managed profile to get maximum time the profile is allowed to be turned off.

ManagedSubscriptionsPolicy getManagedSubscriptionsPolicy()

Returns the current ManagedSubscriptionsPolicy.

int getMaximumFailedPasswordsForWipe(ComponentName admin)

Retrieve the current maximum number of login attempts that are allowed before the device or profile is wiped, for a particular admin or all admins that set restrictions on this user and its participating profiles.

long getMaximumTimeToLock(ComponentName admin)

Retrieve the current maximum time to unlock for a particular admin or all admins that set restrictions on this user and its participating profiles.

List<String> getMeteredDataDisabledPackages(ComponentName admin)

Called by a device or profile owner to retrieve the list of packages which are restricted by the admin from using metered data.

int getMinimumRequiredWifiSecurityLevel()

Returns the current Wi-Fi minimum security level.

int getMtePolicy()

Called by a device owner, profile owner of an organization-owned device to get the Memory Tagging Extension (MTE) policy Learn more about MTE

int getNearbyAppStreamingPolicy()

Returns the current runtime nearby app streaming policy set by the device or profile owner.

int getNearbyNotificationStreamingPolicy()

Returns the current runtime nearby notification streaming policy set by the device or profile owner.

int getOrganizationColor(ComponentName admin)

This method was deprecated in API level 31. From Build.VERSION_CODES.R, the organization color is never used as the background color of the confirm credentials screen.

CharSequence getOrganizationName(ComponentName admin)

Called by the device owner (since API 26) or profile owner (since API 24) or holders of the permission {@link android.Manifest.permission#MANAGE_DEVICE_POLICY_ORGANIZATION_IDENTITY to retrieve the name of the organization under management.

List<ApnSetting> getOverrideApns(ComponentName admin)

Called by device owner or managed profile owner to get all override APNs inserted by device owner or managed profile owner previously using addOverrideApn(ComponentName, ApnSetting).

DevicePolicyManager getParentProfileInstance(ComponentName admin)

Called by the profile owner of a managed profile or other apps in a managed profile to obtain a DevicePolicyManager whose calls act on the parent profile.

int getPasswordComplexity()

Returns how complex the current user's screen lock is.

long getPasswordExpiration(ComponentName admin)

Get the current password expiration time for a particular admin or all admins that set restrictions on this user and its participating profiles.

long getPasswordExpirationTimeout(ComponentName admin)

Get the password expiration timeout for the given admin.

int getPasswordHistoryLength(ComponentName admin)

Retrieve the current password history length for a particular admin or all admins that set restrictions on this user and its participating profiles.

int getPasswordMaximumLength(int quality)

Return the maximum password length that the device supports for a particular password quality.

int getPasswordMinimumLength(ComponentName admin)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

int getPasswordMinimumLetters(ComponentName admin)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

int getPasswordMinimumLowerCase(ComponentName admin)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

int getPasswordMinimumNonLetter(ComponentName admin)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

int getPasswordMinimumNumeric(ComponentName admin)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

int getPasswordMinimumSymbols(ComponentName admin)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

int getPasswordMinimumUpperCase(ComponentName admin)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

int getPasswordQuality(ComponentName admin)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

SystemUpdateInfo getPendingSystemUpdate(ComponentName admin)

Get information about a pending system update.

int getPermissionGrantState(ComponentName admin, String packageName, String permission)

Returns the current grant state of a runtime permission for a specific application.

int getPermissionPolicy(ComponentName admin)

Returns the current runtime permission policy set by the device or profile owner.

List<String> getPermittedAccessibilityServices(ComponentName admin)

Returns the list of permitted accessibility services set by this device or profile owner.

List<String> getPermittedCrossProfileNotificationListeners(ComponentName admin)

Returns the list of packages installed on the primary user that allowed to use a NotificationListenerService to receive notifications from this managed profile, as set by the profile owner.

List<String> getPermittedInputMethods(ComponentName admin)

Returns the list of permitted input methods set by this device or profile owner.

int getPersonalAppsSuspendedReasons(ComponentName admin)

Called by profile owner of an organization-owned managed profile to check whether personal apps are suspended.

List<PreferentialNetworkServiceConfig> getPreferentialNetworkServiceConfigs()

Get preferential network configuration

int getRequiredPasswordComplexity()

Gets the password complexity requirement set by setRequiredPasswordComplexity(int), for the current user.

long getRequiredStrongAuthTimeout(ComponentName admin)

Determine for how long the user will be able to use secondary, non strong auth for authentication, since last strong method authentication (password, pin or pattern) was used.

DevicePolicyResourcesManager getResources()

Returns a DevicePolicyResourcesManager containing the required APIs to set, reset, and get device policy related resources.

boolean getScreenCaptureDisabled(ComponentName admin)

Determine whether or not screen capture has been disabled by the calling admin, if specified, or all admins.

List<UserHandle> getSecondaryUsers(ComponentName admin)

Called by a device owner to list all secondary users on the device.

CharSequence getShortSupportMessage(ComponentName admin)

Called by a device admin or holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_SUPPORT_MESSAGE to get the short support message.

CharSequence getStartUserSessionMessage(ComponentName admin)

Returns the user session start message.

boolean getStorageEncryption(ComponentName admin)

This method was deprecated in API level 30. This method only returns the value set by setStorageEncryption(ComponentName, boolean). It does not actually reflect the storage encryption status. Use getStorageEncryptionStatus() for that. Called by an application that is administering the device to determine the requested setting for secure storage.

int getStorageEncryptionStatus()

Called by an application that is administering the device to determine the current encryption status of the device.

Set<Integer> getSubscriptionIds()

Returns the subscription ids of all subscriptions which were downloaded by the calling admin.

SystemUpdatePolicy getSystemUpdatePolicy()

Retrieve a local system update policy set previously by setSystemUpdatePolicy(ComponentName, SystemUpdatePolicy).

PersistableBundle getTransferOwnershipBundle()

Returns the data passed from the current administrator to the new administrator during an ownership transfer.

List<PersistableBundle> getTrustAgentConfiguration(ComponentName admin, ComponentName agent)

Gets configuration for the given trust agent based on aggregating all calls to setTrustAgentConfiguration(android.content.ComponentName, android.content.ComponentName, android.os.PersistableBundle) for all device admins.

List<String> getUserControlDisabledPackages(ComponentName admin)

Returns the list of packages over which user control is disabled by a device or profile owner or holders of the permission Manifest.permission.MANAGE_DEVICE_POLICY_APPS_CONTROL.

Bundle getUserRestrictions(ComponentName admin)

Called by an admin to get user restrictions set by themselves with addUserRestriction(android.content.ComponentName, java.lang.String).

Bundle getUserRestrictionsGlobally()

Called by a profile or device owner to get global user restrictions set with addUserRestrictionGlobally(java.lang.String).

String getWifiMacAddress(ComponentName admin)

Called by a device owner or profile owner on organization-owned device to get the MAC address of the Wi-Fi device.

WifiSsidPolicy getWifiSsidPolicy()

Returns the current Wi-Fi SSID policy.

boolean grantKeyPairToApp(ComponentName admin, String alias, String packageName)

Called by a device or profile owner, or delegated certificate chooser (an app that has been delegated the DELEGATION_CERT_SELECTION privilege), to grant an application access to an already-installed (or generated) KeyChain key.

boolean grantKeyPairToWifiAuth(String alias)

Called by a device or profile owner, or delegated certificate chooser (an app that has been delegated the DELEGATION_CERT_SELECTION privilege), to allow using a KeyChain key pair for authentication to Wifi networks.

boolean hasCaCertInstalled(ComponentName admin, byte[] certBuffer)

Returns whether this certificate is installed as a trusted CA.

boolean hasGrantedPolicy(ComponentName admin, int usesPolicy)

Returns true if an administrator has been granted a particular device policy.

boolean hasKeyPair(String alias)

This API can be called by the following to query whether a certificate and private key are installed under a given alias:

If called by the credential management app, the alias must exist in the credential management app's AppUriAuthenticationPolicy.

boolean hasLockdownAdminConfiguredNetworks(ComponentName admin)

Called by a device owner or a profile owner of an organization-owned managed profile to determine whether the user is prevented from modifying networks configured by the admin.

boolean installCaCert(ComponentName admin, byte[] certBuffer)

Installs the given certificate as a user CA.

boolean installExistingPackage(ComponentName admin, String packageName)

Install an existing package that has been installed in another user, or has been kept after removal via setKeepUninstalledPackages(ComponentName, List).

boolean installKeyPair(ComponentName admin, PrivateKey privKey, Certificate[] certs, String alias, int flags)

This API can be called by the following to install a certificate chain and corresponding private key for the leaf certificate:

All apps within the profile will be able to access the certificate chain and use the private key, given direct user approval (if the user is allowed to select the private key).

boolean installKeyPair(ComponentName admin, PrivateKey privKey, Certificate[] certs, String alias, boolean requestAccess)

This API can be called by the following to install a certificate chain and corresponding private key for the leaf certificate:

All apps within the profile will be able to access the certificate chain and use the private key, given direct user approval.

boolean installKeyPair(ComponentName admin, PrivateKey privKey, Certificate cert, String alias)

This API can be called by the following to install a certificate and corresponding private key:

All apps within the profile will be able to access the certificate and use the private key, given direct user approval.

void installSystemUpdate(ComponentName admin, Uri updateFilePath, Executor executor, DevicePolicyManager.InstallSystemUpdateCallback callback)

Called by device owner or profile owner of an organization-owned managed profile to install a system update from the given file.

boolean isActivePasswordSufficient()

Determines whether the calling user's current password meets policy requirements (e.g. quality, minimum length).

boolean isActivePasswordSufficientForDeviceRequirement()

Called by profile owner of a managed profile to determine whether the current device password meets policy requirements set explicitly device-wide.

boolean isAdminActive(ComponentName admin)

Return true if the given administrator component is currently active (enabled) in the system.

boolean isAffiliatedUser()

Returns whether this user is affiliated with the device.

boolean isAlwaysOnVpnLockdownEnabled(ComponentName admin)

Called by device or profile owner to query whether current always-on VPN is configured in lockdown mode.

boolean isApplicationHidden(ComponentName admin, String packageName)

Determine if a package is hidden.

boolean isBackupServiceEnabled(ComponentName admin)

Return whether the backup service is enabled by the device owner or profile owner for the current user, as previously set by setBackupServiceEnabled(android.content.ComponentName, boolean).

boolean isCallerApplicationRestrictionsManagingPackage()

This method was deprecated in API level 26. From Build.VERSION_CODES.O. Use getDelegatedScopes(ComponentName, String) instead.

boolean isCommonCriteriaModeEnabled(ComponentName admin)

Returns whether Common Criteria mode is currently enabled.

boolean isComplianceAcknowledgementRequired()

Called by a profile owner of an organization-owned managed profile to query whether it needs to acknowledge device compliance to allow the user to turn the profile off if needed according to the maximum profile time off policy.

boolean isDeviceFinanced()

Returns true if this device is marked as a financed device.

boolean isDeviceIdAttestationSupported()

Returns true if the device supports attestation of device identifiers in addition to key attestation.

boolean isDeviceOwnerApp(String packageName)

Used to determine if a particular package has been registered as a Device Owner app.

boolean isEphemeralUser(ComponentName admin)

Checks if the profile owner is running in an ephemeral user.

boolean isKeyPairGrantedToWifiAuth(String alias)

Called by a device or profile owner, or delegated certificate chooser (an app that has been delegated the DELEGATION_CERT_SELECTION privilege), to query whether a KeyChain key pair can be used for authentication to Wifi networks.

boolean isLockTaskPermitted(String pkg)

This function lets the caller know whether the given component is allowed to start the lock task mode.

boolean isLogoutEnabled()

Returns whether logout is enabled by a device owner.

boolean isManagedProfile(ComponentName admin)

Return if this user is a managed profile of another user.

boolean isMasterVolumeMuted(ComponentName admin)

Called by profile or device owners to check whether the global volume mute is on or off.

static boolean isMtePolicyEnforced()

Get the current MTE state of the device.

boolean isNetworkLoggingEnabled(ComponentName admin)

Return whether network logging is enabled by a device owner or profile owner of a managed profile.

boolean isOrganizationOwnedDeviceWithManagedProfile()

Apps can use this method to find out if the device was provisioned as organization-owend device with a managed profile.

boolean isOverrideApnEnabled(ComponentName admin)

Called by device owner to check if override APNs are currently enabled.

boolean isPackageSuspended(ComponentName admin, String packageName)

Determine if a package is suspended.

boolean isPreferentialNetworkServiceEnabled()

Indicates whether preferential network service is enabled.

boolean isProfileOwnerApp(String packageName)

Used to determine if a particular package is registered as the profile owner for the user.

boolean isProvisioningAllowed(String action)

Returns whether it is possible for the caller to initiate provisioning of a managed profile or device, setting itself as the device or profile owner.

boolean isResetPasswordTokenActive(ComponentName admin)

Called by a profile, device owner or a holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_RESET_PASSWORD to check if the current reset password token is active.

boolean isSafeOperation(int reason)

Checks if it's safe to run operations that can be affected by the given reason.

boolean isSecurityLoggingEnabled(ComponentName admin)

Return whether security logging is enabled or not by the admin.

boolean isStatusBarDisabled()

Returns whether the status bar is disabled/enabled, see setStatusBarDisabled(ComponentName, boolean).

boolean isUninstallBlocked(ComponentName admin, String packageName)

Check whether the user has been blocked by device policy from uninstalling a package.

boolean isUniqueDeviceAttestationSupported()

Returns true if the StrongBox Keymaster implementation on the device was provisioned with an individual attestation certificate and can sign attestation records using it (as attestation using an individual attestation certificate is a feature only Keymaster implementations with StrongBox security level can implement).

boolean isUsbDataSignalingEnabled()

Returns whether USB data signaling is currently enabled.

boolean isUsingUnifiedPassword(ComponentName admin)

When called by a profile owner of a managed profile returns true if the profile uses unified challenge with its parent user.

List<UserHandle> listForegroundAffiliatedUsers()

Gets the list of affiliated users running on foreground.

void lockNow()

Make the device lock immediately, as if the lock screen timeout has expired at the point of this call.

void lockNow(int flags)

Make the device lock immediately, as if the lock screen timeout has expired at the point of this call.

int logoutUser(ComponentName admin)

Called by a profile owner of secondary user that is affiliated with the device to stop the calling user and switch back to primary user (when the user was switchUser(android.content.ComponentName, android.os.UserHandle) switched to) or stop the user (when it was started in background.

void reboot(ComponentName admin)

Called by device owner to reboot the device.

void removeActiveAdmin(ComponentName admin)

Remove a current administration component.

boolean removeCrossProfileWidgetProvider(ComponentName admin, String packageName)

Called by the profile owner of a managed profile or a holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_PROFILE_INTERACTION to disable widget providers from a given package to be available in the parent profile.

boolean removeKeyPair(ComponentName admin, String alias)

This API can be called by the following to remove a certificate and private key pair installed under a given alias:

  • Device owner
  • Profile owner
  • Delegated certificate installer
  • Credential management app

From Android Build.VERSION_CODES.S, the credential management app can call this API.

boolean removeOverrideApn(ComponentName admin, int apnId)

Called by device owner or managed profile owner to remove an override APN.

boolean removeUser(ComponentName admin, UserHandle userHandle)

Called by a device owner to remove a user/profile and all associated data.

boolean requestBugreport(ComponentName admin)

Called by a device owner to request a bugreport.

boolean resetPassword(String password, int flags)

This method was deprecated in API level 30. Please use resetPasswordWithToken(ComponentName, String, byte, int) instead.

boolean resetPasswordWithToken(ComponentName admin, String password, byte[] token, int flags)

Called by device or profile owner to force set a new device unlock password or a managed profile challenge on current user.

List<NetworkEvent> retrieveNetworkLogs(ComponentName admin, long batchToken)

Called by device owner, profile owner of a managed profile or delegated app with DELEGATION_NETWORK_LOGGING to retrieve the most recent batch of network logging events.

List<SecurityLog.SecurityEvent> retrievePreRebootSecurityLogs(ComponentName admin)

Called by device owner or profile owner of an organization-owned managed profile to retrieve device logs from before the device's last reboot.

List<SecurityLog.SecurityEvent> retrieveSecurityLogs(ComponentName admin)

Called by device owner or profile owner of an organization-owned managed profile to retrieve all new security logging entries since the last call to this API after device boots.

boolean revokeKeyPairFromApp(ComponentName admin, String alias, String packageName)

Called by a device or profile owner, or delegated certificate chooser (an app that has been delegated the DELEGATION_CERT_SELECTION privilege), to revoke an application's grant to a KeyChain key pair.

boolean revokeKeyPairFromWifiAuth(String alias)

Called by a device or profile owner, or delegated certificate chooser (an app that has been delegated the DELEGATION_CERT_SELECTION privilege), to deny using a KeyChain key pair for authentication to Wifi networks.

void setAccountManagementDisabled(ComponentName admin, String accountType, boolean disabled)

Called by a device owner or profile owner to disable account management for a specific type of account.

void setAffiliationIds(ComponentName admin, Set<String> ids)

Indicates the entity that controls the device.

void setAlwaysOnVpnPackage(ComponentName admin, String vpnPackage, boolean lockdownEnabled)

Called by a device or profile owner to configure an always-on VPN connection through a specific application for the current user.

void setAlwaysOnVpnPackage(ComponentName admin, String vpnPackage, boolean lockdownEnabled, Set<String> lockdownAllowlist)

A version of setAlwaysOnVpnPackage(android.content.ComponentName, java.lang.String, boolean) that allows the admin to specify a set of apps that should be able to access the network directly when VPN is not connected.

void setAppFunctionsPolicy(int policy)

Sets the AppFunctionManager policy which controls app functions operations on the device.

boolean setApplicationHidden(ComponentName admin, String packageName, boolean hidden)

Hide or unhide packages.

void setApplicationRestrictions(ComponentName admin, String packageName, Bundle settings)

Sets the application restrictions for a given target application running in the calling user.

void setApplicationRestrictionsManagingPackage(ComponentName admin, String packageName)

This method was deprecated in API level 26. From Build.VERSION_CODES.O. Use setDelegatedScopes(ComponentName, String, List) with the DELEGATION_APP_RESTRICTIONS scope instead.

void setAutoTimeEnabled(ComponentName admin, boolean enabled)

Called by a device owner, a profile owner for the primary user or a profile owner of an organization-owned managed profile to turn auto time on and off.

void setAutoTimePolicy(int policy)

Called by a device owner, a profile owner for the primary user or a profile owner of an organization-owned managed profile to turn auto time on and off i.e.

void setAutoTimeRequired(ComponentName admin, boolean required)

This method was deprecated in API level 30. From Build.VERSION_CODES.R. Use setAutoTimeEnabled(ComponentName, boolean) to turn auto time on or off and use UserManager.DISALLOW_CONFIG_DATE_TIME to prevent the user from changing this setting.

void setAutoTimeZoneEnabled(ComponentName admin, boolean enabled)

Called by a device owner, a profile owner for the primary user or a profile owner of an organization-owned managed profile to turn auto time zone on and off.

void setAutoTimeZonePolicy(int policy)

Called by a device owner, a profile owner for the primary user or a profile owner of an organization-owned managed profile to turn auto time zone on and off.

void setBackupServiceEnabled(ComponentName admin, boolean enabled)

Allows the device owner or profile owner to enable or disable the backup service.

void setBluetoothContactSharingDisabled(ComponentName admin, boolean disabled)

Called by a profile owner of a managed profile to set whether bluetooth devices can access enterprise contacts.

void setCameraDisabled(ComponentName admin, boolean disabled)

Called by an application that is administering the device to disable all cameras on the device, for this user.

void setCertInstallerPackage(ComponentName admin, String installerPackage)

This method was deprecated in API level 26. From Build.VERSION_CODES.O. Use setDelegatedScopes(ComponentName, String, List) with the DELEGATION_CERT_INSTALL scope instead.

void setCommonCriteriaModeEnabled(ComponentName admin, boolean enabled)

Called by device owner or profile owner of an organization-owned managed profile to toggle Common Criteria mode for the device.

void setConfiguredNetworksLockdownState(ComponentName admin, boolean lockdown)

Called by a device owner or a profile owner of an organization-owned managed profile to control whether the user can change networks configured by the admin.

void setContentProtectionPolicy(ComponentName admin, int policy)

Sets the content protection policy which controls scanning for deceptive apps.

void setCredentialManagerPolicy(PackagePolicy policy)

Called by a device owner or profile owner of a managed profile to set the credential manager policy.

void setCrossProfileCalendarPackages(ComponentName admin, Set<String> packageNames)

This method was deprecated in API level 34. Use setCrossProfilePackages(android.content.ComponentName, java.util.Set).

void setCrossProfileCallerIdDisabled(ComponentName admin, boolean disabled)

This method was deprecated in API level 34. starting with Build.VERSION_CODES.UPSIDE_DOWN_CAKE, use setManagedProfileCallerIdAccessPolicy(android.app.admin.PackagePolicy) instead

void setCrossProfileContactsSearchDisabled(ComponentName admin, boolean disabled)

This method was deprecated in API level 34. From Build.VERSION_CODES.UPSIDE_DOWN_CAKE use setManagedProfileContactsAccessPolicy(android.app.admin.PackagePolicy)

void setCrossProfilePackages(ComponentName admin, Set<String> packageNames)

Sets the set of admin-allowlisted package names that are allowed to request user consent for cross-profile communication.

void setDefaultDialerApplication(String packageName)

Must be called by a device owner or a profile owner of an organization-owned managed profile to set the default dialer application for the calling user.

void setDefaultSmsApplication(ComponentName admin, String packageName)

Must be called by a device owner or a profile owner of an organization-owned managed profile to set the default SMS application.

void setDelegatedScopes(ComponentName admin, String delegatePackage, List<String> scopes)

Called by a profile owner or device owner to grant access to privileged APIs to another app.

void setDeviceOwnerLockScreenInfo(ComponentName admin, CharSequence info)

Sets the device owner information to be shown on the lock screen.

void setEndUserSessionMessage(ComponentName admin, CharSequence endUserSessionMessage)

Called by a device owner to specify the user session end message.

void setFactoryResetProtectionPolicy(ComponentName admin, FactoryResetProtectionPolicy policy)

Callable by device owner or profile owner of an organization-owned device, to set a factory reset protection (FRP) policy.

int setGlobalPrivateDnsModeOpportunistic(ComponentName admin)

Sets the global Private DNS mode to opportunistic.

int setGlobalPrivateDnsModeSpecifiedHost(ComponentName admin, String privateDnsHost)

Sets the global Private DNS host to be used.

void setGlobalSetting(ComponentName admin, String setting, String value)

This method is mostly deprecated.

void setKeepUninstalledPackages(ComponentName admin, List<String> packageNames)

Set a list of apps to keep around as APKs even if no user has currently installed it.

boolean setKeyPairCertificate(ComponentName admin, String alias, List<Certificate> certs, boolean isUserSelectable)

This API can be called by the following to associate certificates with a key pair that was generated using generateKeyPair(ComponentName, String, KeyGenParameterSpec, int), and set whether the key is available for the user to choose in the certificate selection prompt:

  • Device owner
  • Profile owner
  • Delegated certificate installer
  • Credential management app

From Android Build.VERSION_CODES.S, the credential management app can call this API.

boolean setKeyguardDisabled(ComponentName admin, boolean disabled)

Called by a device owner or profile owner of secondary users that is affiliated with the device to disable the keyguard altogether.

void setKeyguardDisabledFeatures(ComponentName admin, int which)

Called by an application that is administering the device to disable keyguard customizations, such as widgets.

void setLocationEnabled(ComponentName admin, boolean locationEnabled)

Called by device owners to set the user's global location setting.

void setLockTaskFeatures(ComponentName admin, int flags)

Sets which system features are enabled when the device runs in lock task mode.

void setLockTaskPackages(ComponentName admin, String[] packages)

Sets which packages may enter lock task mode.

void setLogoutEnabled(ComponentName admin, boolean enabled)

Called by a device owner to specify whether logout is enabled for all secondary users.

void setLongSupportMessage(ComponentName admin, CharSequence message)

Called by a device admin to set the long support message.

void setManagedProfileCallerIdAccessPolicy(PackagePolicy policy)

Called by a profile owner of a managed profile to set the packages that are allowed to lookup contacts in the managed profile based on caller id information.

void setManagedProfileContactsAccessPolicy(PackagePolicy policy)

Called by a profile owner of a managed profile to set the packages that are allowed access to the managed profile contacts from the parent user.

void setManagedProfileMaximumTimeOff(ComponentName admin, long timeoutMillis)

Called by a profile owner of an organization-owned managed profile to set maximum time the profile is allowed to be turned off.

void setManagedSubscriptionsPolicy(ManagedSubscriptionsPolicy policy)

Called by a profile owner of an organization-owned device to specify ManagedSubscriptionsPolicy

Managed subscriptions policy controls how SIMs would be associated with the managed profile.

void setMasterVolumeMuted(ComponentName admin, boolean on)

Called by profile or device owners to set the global volume mute on or off.

void setMaximumFailedPasswordsForWipe(ComponentName admin, int num)

Setting this to a value greater than zero enables a policy that will perform a device or profile wipe after too many incorrect device-unlock passwords have been entered.

void setMaximumTimeToLock(ComponentName admin, long timeMs)

Called by an application that is administering the device to set the maximum time for user activity until the device will lock.

List<String> setMeteredDataDisabledPackages(ComponentName admin, List<String> packageNames)

Called by a device or profile owner to restrict packages from using metered data.

void setMinimumRequiredWifiSecurityLevel(int level)

Called by device owner or profile owner of an organization-owned managed profile to specify the minimum security level required for Wi-Fi networks.

void setMtePolicy(int policy)

Called by a device owner, profile owner of an organization-owned device, to set the Memory Tagging Extension (MTE) policy.

void setNearbyAppStreamingPolicy(int policy)

Called by a device/profile owner to set nearby app streaming policy.

void setNearbyNotificationStreamingPolicy(int policy)

Called by a device/profile owner to set nearby notification streaming policy.

void setNetworkLoggingEnabled(ComponentName admin, boolean enabled)

Called by a device owner, profile owner of a managed profile or delegated app with DELEGATION_NETWORK_LOGGING to control the network logging feature.

void setOrganizationColor(ComponentName admin, int color)

This method was deprecated in API level 31. From Build.VERSION_CODES.R, the organization color is never used as the background color of the confirm credentials screen.

void setOrganizationId(String enterpriseId)

Sets the Enterprise ID for the work profile or managed device.

void setOrganizationName(ComponentName admin, CharSequence title)

Called by the device owner (since API 26) or profile owner (since API 24) to set the name of the organization under management.

void setOverrideApnsEnabled(ComponentName admin, boolean enabled)

Called by device owner to set if override APNs should be enabled.

String[] setPackagesSuspended(ComponentName admin, String[] packageNames, boolean suspended)

Called by device or profile owners to suspend packages for this user.

void setPasswordExpirationTimeout(ComponentName admin, long timeout)

Called by a device admin to set the password expiration timeout.

void setPasswordHistoryLength(ComponentName admin, int length)

Called by an application that is administering the device to set the length of the password history.

void setPasswordMinimumLength(ComponentName admin, int length)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

void setPasswordMinimumLetters(ComponentName admin, int length)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

void setPasswordMinimumLowerCase(ComponentName admin, int length)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

void setPasswordMinimumNonLetter(ComponentName admin, int length)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

void setPasswordMinimumNumeric(ComponentName admin, int length)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

void setPasswordMinimumSymbols(ComponentName admin, int length)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

void setPasswordMinimumUpperCase(ComponentName admin, int length)

This method was deprecated in API level 31. see setPasswordQuality(android.content.ComponentName, int) for details.

void setPasswordQuality(ComponentName admin, int quality)

This method was deprecated in API level 31. Prefer using setRequiredPasswordComplexity(int), to require a password that satisfies a complexity level defined by the platform, rather than specifying custom password requirement. Setting custom, overly-complicated password requirements leads to passwords that are hard for users to remember and may not provide any security benefits given as Android uses hardware-backed throttling to thwart online and offline brute-forcing of the device's screen lock. Company-owned devices (fully-managed and organization-owned managed profile devices) are able to continue using this method, though it is recommended that setRequiredPasswordComplexity(int) should be used instead.

boolean setPermissionGrantState(ComponentName admin, String packageName, String permission, int grantState)

Sets the grant state of a runtime permission for a specific application.

void setPermissionPolicy(ComponentName admin, int policy)

Set the default response for future runtime permission requests by applications.

boolean setPermittedAccessibilityServices(ComponentName admin, List<String> packageNames)

Called by a profile or device owner to set the permitted AccessibilityService.

boolean setPermittedCrossProfileNotificationListeners(ComponentName admin, List<String> packageList)

Called by a profile owner of a managed profile to set the packages that are allowed to use a NotificationListenerService in the primary user to see notifications from the managed profile.

boolean setPermittedInputMethods(ComponentName admin, List<String> packageNames)

Called by a profile or device owner or holder of the Manifest.permission.MANAGE_DEVICE_POLICY_INPUT_METHODS permission to set the permitted input methods services for this user.

void setPersonalAppsSuspended(ComponentName admin, boolean suspended)

Called by a profile owner of an organization-owned managed profile to suspend personal apps on the device.

void setPreferentialNetworkServiceConfigs(List<PreferentialNetworkServiceConfig> preferentialNetworkServiceConfigs)

Sets preferential network configurations.

void setPreferentialNetworkServiceEnabled(boolean enabled)

Sets whether preferential network service is enabled.

void setProfileEnabled(ComponentName admin)

Sets the enabled state of the profile.

void setProfileName(ComponentName admin, String profileName)

Sets the name of the profile.

void setRecommendedGlobalProxy(ComponentName admin, ProxyInfo proxyInfo)

Set a network-independent global HTTP proxy.

void setRequiredPasswordComplexity(int passwordComplexity)

Sets a minimum password complexity requirement for the user's screen lock.

void setRequiredStrongAuthTimeout(ComponentName admin, long timeoutMs)

Called by a device/profile owner to set the timeout after which unlocking with secondary, non strong auth (e.g. fingerprint, face, trust agents) times out, i.e.

boolean setResetPasswordToken(ComponentName admin, byte[] token)

Called by a profile or device owner to provision a token which can later be used to reset the device lockscreen password (if called by device owner), or managed profile challenge (if called by profile owner), via resetPasswordWithToken(ComponentName, String, byte, int).

void setRestrictionsProvider(ComponentName admin, ComponentName provider)

Designates a specific service component as the provider for making permission requests of a local or remote administrator of the user.

void setScreenCaptureDisabled(ComponentName admin, boolean disabled)

Called by a device/profile owner to set whether the screen capture is disabled.

void setSecureSetting(ComponentName admin, String setting, String value)

This method is mostly deprecated.

void setSecurityLoggingEnabled(ComponentName admin, boolean enabled)

Called by device owner or a profile owner of an organization-owned managed profile to control the security logging feature.

void setShortSupportMessage(ComponentName admin, CharSequence message)

Called by a device admin to set the short support message.

void setStartUserSessionMessage(ComponentName admin, CharSequence startUserSessionMessage)

Called by a device owner to specify the user session start message.

boolean setStatusBarDisabled(ComponentName admin, boolean disabled)

Called by device owner or profile owner of secondary users that is affiliated with the device to disable the status bar.

int setStorageEncryption(ComponentName admin, boolean encrypt)

This method was deprecated in API level 30. This method does not actually modify the storage encryption of the device. It has never affected the encryption status of a device. Called by an application that is administering the device to request that the storage system be encrypted. Does nothing if the caller is on a secondary user or a managed profile.

When multiple device administrators attempt to control device encryption, the most secure, supported setting will always be used. If any device administrator requests device encryption, it will be enabled; Conversely, if a device administrator attempts to disable device encryption while another device administrator has enabled it, the call to disable will fail (most commonly returning ENCRYPTION_STATUS_ACTIVE).

This policy controls encryption of the secure (application data) storage area. Data written to other storage areas may or may not be encrypted, and this policy does not require or control the encryption of any other storage areas. There is one exception: If Environment.isExternalStorageEmulated() is true, then the directory returned by Environment.getExternalStorageDirectory() must be written to disk within the encrypted storage area.

Important Note: On some devices, it is possible to encrypt storage without requiring the user to create a device PIN or Password. In this case, the storage is encrypted, but the encryption key may not be fully secured. For maximum security, the administrator should also require (and check for) a pattern, PIN, or password.

void setSystemSetting(ComponentName admin, String setting, String value)

Called by a device or profile owner to update Settings.System settings.

void setSystemUpdatePolicy(ComponentName admin, SystemUpdatePolicy policy)

Called by device owners or profile owners of an organization-owned managed profile to set a local system update policy.

boolean setTime(ComponentName admin, long millis)

Called by a device owner or a profile owner of an organization-owned managed profile to set the system wall clock time.

boolean setTimeZone(ComponentName admin, String timeZone)

Called by a device owner or a profile owner of an organization-owned managed profile to set the system's persistent default time zone.

void setTrustAgentConfiguration(ComponentName admin, ComponentName target, PersistableBundle configuration)

Sets a list of configuration features to enable for a trust agent component.

void setUninstallBlocked(ComponentName admin, String packageName, boolean uninstallBlocked)

Change whether a user can uninstall a package.

void setUsbDataSignalingEnabled(boolean enabled)

Called by a device owner or profile owner of an organization-owned managed profile to enable or disable USB data signaling for the device.

void setUserControlDisabledPackages(ComponentName admin, List<String> packages)

Called by a device owner or a profile owner or holder of the permission Manifest.permission.MANAGE_DEVICE_POLICY_APPS_CONTROL to disable user control over apps.

void setUserIcon(ComponentName admin, Bitmap icon)

Called by profile or device owners to set the user's photo.

void setWifiSsidPolicy(WifiSsidPolicy policy)

Called by device owner or profile owner of an organization-owned managed profile to specify the Wi-Fi SSID policy (WifiSsidPolicy).

int startUserInBackground(ComponentName admin, UserHandle userHandle)

Called by a device owner to start the specified secondary user in background.

int stopUser(ComponentName admin, UserHandle userHandle)

Called by a device owner to stop the specified secondary user.

boolean switchUser(ComponentName admin, UserHandle userHandle)

Called by a device owner to switch the specified secondary user to the foreground.

void transferOwnership(ComponentName admin, ComponentName target, PersistableBundle bundle)

Changes the current administrator to another one.

void uninstallAllUserCaCerts(ComponentName admin)

Uninstalls all custom trusted CA certificates from the profile.

void uninstallCaCert(ComponentName admin, byte[] certBuffer)

Uninstalls the given certificate from trusted user CAs, if present.

boolean updateOverrideApn(ComponentName admin, int apnId, ApnSetting apnSetting)

Called by device owner or managed profile owner to update an override APN.

void wipeData(int flags, CharSequence reason)

Ask that all user data be wiped.

void wipeData(int flags)

See wipeData(int, java.lang.CharSequence)

void wipeDevice(int flags)

Ask that the device be wiped and factory reset.

Inherited methods

Constants

ACTION_ADD_DEVICE_ADMIN

Added in API level 8 
public static final String ACTION_ADD_DEVICE_ADMIN

Activity action: ask the user to add a new device administrator to the system. The desired policy is the ComponentName of the policy in the EXTRA_DEVICE_ADMIN extra field. This will invoke a UI to bring the user through adding the device administrator to the system (or allowing them to reject it).

You can optionally include the EXTRA_ADD_EXPLANATION field to provide the user with additional explanation (in addition to your component's description) about what is being added.

If your administrator is already active, this will ordinarily return immediately (without user intervention). However, if your administrator has been updated and is requesting additional uses-policy flags, the user will be presented with the new list. New policies will not be available to the updated administrator until the user has accepted the new list.

Constant Value: "android.app.action.ADD_DEVICE_ADMIN"

ACTION_ADMIN_POLICY_COMPLIANCE

Added in API level 29 
public static final String ACTION_ADMIN_POLICY_COMPLIANCE

Activity action: Starts the administrator to show policy compliance for the provisioning. This action is used any time that the administrator has an opportunity to show policy compliance before the end of setup wizard. This could happen as part of the admin-integrated provisioning flow (in which case this gets sent after ACTION_GET_PROVISIONING_MODE), or it could happen during provisioning finalization if the administrator supports finalization during setup wizard.

Intents with this action may also be supplied with the EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE extra.

Constant Value: "android.app.action.ADMIN_POLICY_COMPLIANCE"

ACTION_APPLICATION_DELEGATION_SCOPES_CHANGED

Added in API level 26 
public static final String ACTION_APPLICATION_DELEGATION_SCOPES_CHANGED

Broadcast Action: Sent after application delegation scopes are changed. The new delegation scopes will be sent in an ArrayList<String> extra identified by the EXTRA_DELEGATION_SCOPES key.

Note: This is a protected intent that can only be sent by the system.

Constant Value: "android.app.action.APPLICATION_DELEGATION_SCOPES_CHANGED"

ACTION_CHECK_POLICY_COMPLIANCE

Added in API level 30 
public static final String ACTION_CHECK_POLICY_COMPLIANCE

Activity action: launch the DPC to check policy compliance. This intent is launched when the user taps on the notification about personal apps suspension. When handling this intent the DPC must check if personal apps should still be suspended and either unsuspend them or instruct the user on how to resolve the noncompliance causing the suspension.

Constant Value: "android.app.action.CHECK_POLICY_COMPLIANCE"

ACTION_DEVICE_ADMIN_SERVICE

Added in API level 26 
public static final String ACTION_DEVICE_ADMIN_SERVICE

Service action: Action for a service that device owner and profile owner can optionally own. If a device owner or a profile owner has such a service, the system tries to keep a bound connection to it, in order to keep their process always running. The service must be protected with the Manifest.permission.BIND_DEVICE_ADMIN permission.

Constant Value: "android.app.action.DEVICE_ADMIN_SERVICE"

ACTION_DEVICE_FINANCING_STATE_CHANGED

Added in API level 34 
public static final String ACTION_DEVICE_FINANCING_STATE_CHANGED

Broadcast Action: Broadcast sent to indicate that the device financing state has changed.

This occurs when, for example, a financing kiosk app has been added or removed.

To query the current device financing state see isDeviceFinanced().

This will be delivered to the following apps if they include a receiver for this action in their manifest:

  • Device owner admins.
  • Organization-owned profile owner admins
  • The supervision app
  • The device management role holder

Constant Value: "android.app.admin.action.DEVICE_FINANCING_STATE_CHANGED"

ACTION_DEVICE_OWNER_CHANGED

Added in API level 23 
public static final String ACTION_DEVICE_OWNER_CHANGED

Broadcast action: sent when the device owner is set, changed or cleared. This broadcast is sent only to the primary user.

Constant Value: "android.app.action.DEVICE_OWNER_CHANGED"

ACTION_DEVICE_POLICY_RESOURCE_UPDATED

Added in API level 33 
public static final String ACTION_DEVICE_POLICY_RESOURCE_UPDATED

Broadcast action: notify system apps (e.g. settings, SysUI, etc) that the device management resources with IDs EXTRA_RESOURCE_IDS has been updated, the updated resources can be retrieved using DevicePolicyResourcesManager.getDrawable and DevicePolicyResourcesManager.getString.

This broadcast is sent to registered receivers only.

EXTRA_RESOURCE_TYPE will be included to identify the type of resource being updated.

Constant Value: "android.app.action.DEVICE_POLICY_RESOURCE_UPDATED"

ACTION_GET_PROVISIONING_MODE

Added in API level 29 
public static final String ACTION_GET_PROVISIONING_MODE

Activity action: Starts the administrator to get the mode for the provisioning. This intent may contain the following extras:

The target activity should return one of the following values in EXTRA_PROVISIONING_MODE as result:

If performing fully-managed device provisioning and the admin app desires to show its own education screens, the target activity can additionally return EXTRA_PROVISIONING_SKIP_EDUCATION_SCREENS set to true.

The target activity may also return the account that needs to be migrated from primary user to managed profile in case of a profile owner provisioning in EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE as result.

The target activity may also include the EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE extra in the intent result. The values of this PersistableBundle will be sent as an intent extra of the same name to the ACTION_ADMIN_POLICY_COMPLIANCE activity, along with the values of the EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE extra that are already supplied to this activity.

Other extras the target activity may include in the intent result:

Constant Value: "android.app.action.GET_PROVISIONING_MODE"

ACTION_MANAGED_PROFILE_PROVISIONED

Added in API level 23 
public static final String ACTION_MANAGED_PROFILE_PROVISIONED

Broadcast Action: This broadcast is sent to indicate that provisioning of a managed profile has completed successfully.

The broadcast is limited to the primary profile, to the app specified in the provisioning intent with action ACTION_PROVISION_MANAGED_PROFILE.

This intent will contain the following extras

Constant Value: "android.app.action.MANAGED_PROFILE_PROVISIONED"

ACTION_PROFILE_OWNER_CHANGED

Added in API level 28 
public static final String ACTION_PROFILE_OWNER_CHANGED

Broadcast action: sent when the profile owner is set, changed or cleared. This broadcast is sent only to the user managed by the new profile owner.

Constant Value: "android.app.action.PROFILE_OWNER_CHANGED"

ACTION_PROVISIONING_SUCCESSFUL

Added in API level 26 
public static final String ACTION_PROVISIONING_SUCCESSFUL

Activity action: This activity action is sent to indicate that provisioning of a managed profile or managed device has completed successfully. It'll be sent at the same time as DeviceAdminReceiver.ACTION_PROFILE_PROVISIONING_COMPLETE broadcast but this will be delivered faster as it's an activity intent.

The intent is only sent to the new device or profile owner.

Constant Value: "android.app.action.PROVISIONING_SUCCESSFUL"

ACTION_PROVISION_MANAGED_DEVICE

Added in API level 23
Deprecated in API level 31 
public static final String ACTION_PROVISION_MANAGED_DEVICE

This constant was deprecated in API level 31.
to support Build.VERSION_CODES.S and later, admin apps must implement activities with intent filters for the ACTION_GET_PROVISIONING_MODE and ACTION_ADMIN_POLICY_COMPLIANCE intent actions; using ACTION_PROVISION_MANAGED_DEVICE to start provisioning will cause the provisioning to fail; to additionally support pre-Build.VERSION_CODES.S, admin apps must also continue to use this constant.

Activity action: Starts the provisioning flow which sets up a managed device. Must be started with Activity.startActivityForResult(Intent, int).

During device owner provisioning a device admin app is set as the owner of the device. A device owner has full control over the device. The device owner can not be modified by the user.

A typical use case would be a device that is owned by a company, but used by either an employee or client.

An intent with this action can be sent only on an unprovisioned device. It is possible to check if provisioning is allowed or not by querying the method isProvisioningAllowed(java.lang.String).

The intent contains the following extras:

When device owner provisioning has completed, an intent of the type DeviceAdminReceiver.ACTION_PROFILE_PROVISIONING_COMPLETE is broadcast to the device owner.

From version Build.VERSION_CODES.O, when device owner provisioning has completed, along with the above broadcast, activity intent ACTION_PROVISIONING_SUCCESSFUL will also be sent to the device owner.

If provisioning fails, the device is factory reset.

A result code of Activity.RESULT_OK implies that the synchronous part of the provisioning flow was successful, although this doesn't guarantee the full flow will succeed. Conversely a result code of Activity.RESULT_CANCELED implies that the user backed-out of provisioning, or some precondition for provisioning wasn't met.

Constant Value: "android.app.action.PROVISION_MANAGED_DEVICE"

ACTION_PROVISION_MANAGED_PROFILE

Added in API level 21 
public static final String ACTION_PROVISION_MANAGED_PROFILE

Activity action: Starts the provisioning flow which sets up a managed profile.

It is possible to check if provisioning is allowed or not by querying the method isProvisioningAllowed(java.lang.String).

The intent may contain the following extras:

Extra Supported Versions
EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE
EXTRA_PROVISIONING_SKIP_ENCRYPTION Build.VERSION_CODES.N+
EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE
EXTRA_PROVISIONING_LOGO_URI
EXTRA_PROVISIONING_SKIP_USER_CONSENT Can only be used by an existing device owner trying to create a managed profile
EXTRA_PROVISIONING_KEEP_ACCOUNT_ON_MIGRATION
EXTRA_PROVISIONING_DISCLAIMERS
EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME Required if EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME is not specified. Must match the package name of the calling application. Build.VERSION_CODES.LOLLIPOP+
EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME Required if EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME is not specified. Package name must match the package name of the calling application. Build.VERSION_CODES.M+
EXTRA_PROVISIONING_ALLOW_OFFLINE On Build.VERSION_CODES.TIRAMISU+, when set to true this will force offline provisioning instead of allowing it

When managed provisioning has completed, broadcasts are sent to the application specified in the provisioning intent. The DeviceAdminReceiver.ACTION_PROFILE_PROVISIONING_COMPLETE broadcast is sent in the managed profile and the ACTION_MANAGED_PROFILE_PROVISIONED broadcast is sent in the primary profile.

From version Build.VERSION_CODES.O, when managed provisioning has completed, along with the above broadcast, activity intent ACTION_PROVISIONING_SUCCESSFUL will also be sent to the profile owner.

If provisioning fails, the managed profile is removed so the device returns to its previous state.

If launched with Activity.startActivityForResult(Intent, int) a result code of Activity.RESULT_OK indicates that the synchronous part of the provisioning flow was successful, although this doesn't guarantee the full flow will succeed. Conversely a result code of Activity.RESULT_CANCELED indicates that the user backed-out of provisioning or some precondition for provisioning wasn't met.

If a device policy management role holder updater is present on the device, an internet connection attempt must be made prior to launching this intent.

Constant Value: "android.app.action.PROVISION_MANAGED_PROFILE"

ACTION_SET_NEW_PARENT_PROFILE_PASSWORD

Added in API level 24 
public static final String ACTION_SET_NEW_PARENT_PROFILE_PASSWORD

Activity action: have the user enter a new password for the parent profile. If the intent is launched from within a managed profile, this will trigger entering a new password for the parent of the profile. The caller can optionally set EXTRA_DEVICE_PASSWORD_REQUIREMENT_ONLY to only enforce device-wide password requirement. In all other cases the behaviour is identical to ACTION_SET_NEW_PASSWORD.

Constant Value: "android.app.action.SET_NEW_PARENT_PROFILE_PASSWORD"

ACTION_SET_NEW_PASSWORD

Added in API level 8 
public static final String ACTION_SET_NEW_PASSWORD

Activity action: have the user enter a new password.

For admin apps, this activity should be launched after using setPasswordQuality(android.content.ComponentName, int), or setPasswordMinimumLength(android.content.ComponentName, int) to have the user enter a new password that meets the current requirements. You can use isActivePasswordSufficient() to determine whether you need to have the user select a new password in order to meet the current constraints. Upon being resumed from this activity, you can check the new password characteristics to see if they are sufficient.

Non-admin apps can use getPasswordComplexity() to check the current screen lock complexity, and use this activity with extra EXTRA_PASSWORD_COMPLEXITY to suggest to users how complex the app wants the new screen lock to be. Note that both getPasswordComplexity() and the extra EXTRA_PASSWORD_COMPLEXITY require the calling app to have the permission permission.REQUEST_PASSWORD_COMPLEXITY.

If the intent is launched from within a managed profile with a profile owner built against Build.VERSION_CODES.M or before, this will trigger entering a new password for the parent of the profile. For all other cases it will trigger entering a new password for the user or profile it is launched from.

Constant Value: "android.app.action.SET_NEW_PASSWORD"

ACTION_START_ENCRYPTION

Added in API level 11 
public static final String ACTION_START_ENCRYPTION

Activity action: begin the process of encrypting data on the device. This activity should be launched after using setStorageEncryption(ComponentName, boolean) to request encryption be activated. After resuming from this activity, use getStorageEncryption(ComponentName) to check encryption status. However, on some devices this activity may never return, as it may trigger a reboot and in some cases a complete data wipe of the device.

Constant Value: "android.app.action.START_ENCRYPTION"

ACTION_SYSTEM_UPDATE_POLICY_CHANGED

Added in API level 23 
public static final String ACTION_SYSTEM_UPDATE_POLICY_CHANGED

Broadcast action: notify that a new local system update policy has been set by the device owner. The new policy can be retrieved by getSystemUpdatePolicy().

Constant Value: "android.app.action.SYSTEM_UPDATE_POLICY_CHANGED"

APP_FUNCTIONS_DISABLED

Added in API level 36 
public static final int APP_FUNCTIONS_DISABLED

Indicates that AppFunctionManager is controlled and disabled by policy, i.e. no apps in the current user are allowed to expose app functions.

Constant Value: 1 (0x00000001)

APP_FUNCTIONS_DISABLED_CROSS_PROFILE

Added in API level 36 
public static final int APP_FUNCTIONS_DISABLED_CROSS_PROFILE

Indicates that AppFunctionManager is controlled and disabled by a policy for cross profile interactions only, i.e. app functions exposed by apps in the current user can only be invoked within the same user.

This is different from APP_FUNCTIONS_DISABLED in that it only disables cross profile interactions (even if the caller has permissions required to interact across users). appfunctions can still be used within the a user profile boundary.

Constant Value: 2 (0x00000002)

APP_FUNCTIONS_NOT_CONTROLLED_BY_POLICY

Added in API level 36 
public static final int APP_FUNCTIONS_NOT_CONTROLLED_BY_POLICY

Indicates that AppFunctionManager is not controlled by policy.

If no admin set this policy, it means appfunctions are enabled.

Constant Value: 0 (0x00000000)

AUTO_TIME_DISABLED

Added in API level 36 
public static final int AUTO_TIME_DISABLED

Specifies the "disabled" auto time state.

Constant Value: 1 (0x00000001)

AUTO_TIME_ENABLED

Added in API level 36 
public static final int AUTO_TIME_ENABLED

Specifies the "enabled" auto time state.

Constant Value: 2 (0x00000002)

AUTO_TIME_NOT_CONTROLLED_BY_POLICY

Added in API level 36 
public static final int AUTO_TIME_NOT_CONTROLLED_BY_POLICY

Specifies that the auto time state is not controlled by device policy.

Constant Value: 0 (0x00000000)

AUTO_TIME_ZONE_DISABLED

Added in API level 36 
public static final int AUTO_TIME_ZONE_DISABLED

Specifies the "disabled" auto time zone state.

Constant Value: 1 (0x00000001)

AUTO_TIME_ZONE_ENABLED

Added in API level 36 
public static final int AUTO_TIME_ZONE_ENABLED

Specifies the "enabled" auto time zone state.

Constant Value: 2 (0x00000002)

AUTO_TIME_ZONE_NOT_CONTROLLED_BY_POLICY

Added in API level 36 
public static final int AUTO_TIME_ZONE_NOT_CONTROLLED_BY_POLICY

Specifies that the auto time zone state is not controlled by device policy.

Constant Value: 0 (0x00000000)

CONTENT_PROTECTION_DISABLED

Added in API level 35 
public static final int CONTENT_PROTECTION_DISABLED

Indicates that content protection is controlled and disabled by a policy (default).

Constant Value: 1 (0x00000001)

CONTENT_PROTECTION_ENABLED

Added in API level 35 
public static final int CONTENT_PROTECTION_ENABLED

Indicates that content protection is controlled and enabled by a policy.

Constant Value: 2 (0x00000002)

CONTENT_PROTECTION_NOT_CONTROLLED_BY_POLICY

Added in API level 35 
public static final int CONTENT_PROTECTION_NOT_CONTROLLED_BY_POLICY

Indicates that content protection is not controlled by policy, allowing user to choose.

Constant Value: 0 (0x00000000)

DELEGATION_APP_RESTRICTIONS

Added in API level 26 
public static final String DELEGATION_APP_RESTRICTIONS

Delegation of application restrictions management. This scope grants access to the setApplicationRestrictions(ComponentName, String, Bundle) and getApplicationRestrictions(ComponentName, String) APIs.

Constant Value: "delegation-app-restrictions"

DELEGATION_BLOCK_UNINSTALL

Added in API level 26 
public static final String DELEGATION_BLOCK_UNINSTALL

Delegation of application uninstall block. This scope grants access to the setUninstallBlocked(ComponentName, String, boolean) API.

Constant Value: "delegation-block-uninstall"

DELEGATION_CERT_INSTALL

Added in API level 26 
public static final String DELEGATION_CERT_INSTALL

Delegation of certificate installation and management. This scope grants access to the getInstalledCaCerts(ComponentName), hasCaCertInstalled(ComponentName, byte), installCaCert(ComponentName, byte), uninstallCaCert(ComponentName, byte), uninstallAllUserCaCerts(ComponentName) and installKeyPair(ComponentName, PrivateKey, Certificate, String) APIs. This scope also grants the ability to read identifiers that the delegating device owner or profile owner can obtain. See getEnrollmentSpecificId().

Constant Value: "delegation-cert-install"

DELEGATION_CERT_SELECTION

Added in API level 29 
public static final String DELEGATION_CERT_SELECTION

Grants access to selection of KeyChain certificates on behalf of requesting apps. Once granted the app will start receiving DelegatedAdminReceiver.onChoosePrivateKeyAlias. The caller (PO/DO) will no longer receive DeviceAdminReceiver.onChoosePrivateKeyAlias. There can be at most one app that has this delegation. If another app already had delegated certificate selection access, it will lose the delegation when a new app is delegated.

The delegated app can also call grantKeyPairToApp(ComponentName, String, String) and revokeKeyPairFromApp(ComponentName, String, String) to directly grant KeyChain keys to other apps.

Can be granted by Device Owner or Profile Owner.

Constant Value: "delegation-cert-selection"

DELEGATION_ENABLE_SYSTEM_APP

Added in API level 26 
public static final String DELEGATION_ENABLE_SYSTEM_APP

Delegation for enabling system apps. This scope grants access to the enableSystemApp(ComponentName, Intent) API.

Constant Value: "delegation-enable-system-app"

DELEGATION_INSTALL_EXISTING_PACKAGE

Added in API level 28 
public static final String DELEGATION_INSTALL_EXISTING_PACKAGE

Delegation for installing existing packages. This scope grants access to the installExistingPackage(ComponentName, String) API.

Constant Value: "delegation-install-existing-package"

DELEGATION_KEEP_UNINSTALLED_PACKAGES

Added in API level 28 
public static final String DELEGATION_KEEP_UNINSTALLED_PACKAGES

Delegation of management of uninstalled packages. This scope grants access to the setKeepUninstalledPackages(ComponentName, List) and getKeepUninstalledPackages(ComponentName) APIs.

Constant Value: "delegation-keep-uninstalled-packages"

DELEGATION_NETWORK_LOGGING

Added in API level 29 
public static final String DELEGATION_NETWORK_LOGGING

Grants access to setNetworkLoggingEnabled(ComponentName, boolean), isNetworkLoggingEnabled(ComponentName) and retrieveNetworkLogs(ComponentName, long). Once granted the delegated app will start receiving DelegatedAdminReceiver.onNetworkLogsAvailable() callback, and Device owner or Profile Owner will no longer receive the DeviceAdminReceiver.onNetworkLogsAvailable() callback. There can be at most one app that has this delegation. If another app already had delegated network logging access, it will lose the delegation when a new app is delegated.

Device Owner can grant this access since Android 10. Profile Owner of a managed profile can grant this access since Android 12.

Constant Value: "delegation-network-logging"

DELEGATION_PACKAGE_ACCESS

Added in API level 26 
public static final String DELEGATION_PACKAGE_ACCESS

Delegation of package access state. This scope grants access to the isApplicationHidden(ComponentName, String), setApplicationHidden(ComponentName, String, boolean), isPackageSuspended(ComponentName, String), and setPackagesSuspended(ComponentName, String, boolean) APIs.

Constant Value: "delegation-package-access"

DELEGATION_PERMISSION_GRANT

Added in API level 26 
public static final String DELEGATION_PERMISSION_GRANT

Delegation of permission policy and permission grant state. This scope grants access to the setPermissionPolicy(ComponentName, int), getPermissionGrantState(ComponentName, String, String), and setPermissionGrantState(ComponentName, String, String, int) APIs.

Constant Value: "delegation-permission-grant"

DELEGATION_SECURITY_LOGGING

Added in API level 31 
public static final String DELEGATION_SECURITY_LOGGING

Grants access to setSecurityLoggingEnabled(ComponentName, boolean), isSecurityLoggingEnabled(ComponentName), retrieveSecurityLogs(ComponentName), and retrievePreRebootSecurityLogs(ComponentName). Once granted the delegated app will start receiving DelegatedAdminReceiver.onSecurityLogsAvailable callback, and Device owner or Profile Owner will no longer receive the DeviceAdminReceiver.onSecurityLogsAvailable callback. There can be at most one app that has this delegation. If another app already had delegated security logging access, it will lose the delegation when a new app is delegated.

Can only be granted by Device Owner or Profile Owner of an organization-owned managed profile.

Constant Value: "delegation-security-logging"

ENCRYPTION_STATUS_ACTIVATING

Added in API level 11
Deprecated in API level 34 
public static final int ENCRYPTION_STATUS_ACTIVATING

This constant was deprecated in API level 34.
This result code has never actually been used, so there is no reason for apps to check for it.

Result code for getStorageEncryptionStatus(): indicating that encryption is not currently active, but is currently being activated.

Constant Value: 2 (0x00000002)

ENCRYPTION_STATUS_ACTIVE

Added in API level 11 
public static final int ENCRYPTION_STATUS_ACTIVE

Result code for setStorageEncryption(ComponentName, boolean) and getStorageEncryptionStatus(): indicating that encryption is active.

getStorageEncryptionStatus() can only return this value for apps targeting API level 23 or lower, or on devices that use Full Disk Encryption. Support for Full Disk Encryption was entirely removed in API level 33, having been replaced by File Based Encryption. The result code ENCRYPTION_STATUS_ACTIVE_PER_USER is used on devices that use File Based Encryption, except when the app targets API level 23 or lower.

setStorageEncryption(ComponentName, boolean) can still return this value for an unrelated reason, but setStorageEncryption(ComponentName, boolean) is deprecated since it doesn't do anything useful.

Constant Value: 3 (0x00000003)

ENCRYPTION_STATUS_ACTIVE_DEFAULT_KEY

Added in API level 23 
public static final int ENCRYPTION_STATUS_ACTIVE_DEFAULT_KEY

Result code for getStorageEncryptionStatus(): indicating that encryption is active, but the encryption key is not cryptographically protected by the user's credentials.

This value can only be returned on devices that use Full Disk Encryption. Support for Full Disk Encryption was entirely removed in API level 33, having been replaced by File Based Encryption. With File Based Encryption, each user's credential-encrypted storage is always cryptographically protected by the user's credentials.

Constant Value: 4 (0x00000004)

ENCRYPTION_STATUS_ACTIVE_PER_USER

Added in API level 24 
public static final int ENCRYPTION_STATUS_ACTIVE_PER_USER

Result code for getStorageEncryptionStatus(): indicating that encryption is active and the encryption key is tied to the user or profile.

This value is only returned to apps targeting API level 24 and above. For apps targeting earlier API levels, ENCRYPTION_STATUS_ACTIVE is returned, even if the encryption key is specific to the user or profile.

Constant Value: 5 (0x00000005)

ENCRYPTION_STATUS_INACTIVE

Added in API level 11 
public static final int ENCRYPTION_STATUS_INACTIVE

Result code for setStorageEncryption(ComponentName, boolean) and getStorageEncryptionStatus(): indicating that encryption is supported, but is not currently active.

getStorageEncryptionStatus() can only return this value on devices that use Full Disk Encryption. Support for Full Disk Encryption was entirely removed in API level 33, having been replaced by File Based Encryption. Devices that use File Based Encryption always automatically activate their encryption on first boot.

setStorageEncryption(ComponentName, boolean) can still return this value for an unrelated reason, but setStorageEncryption(ComponentName, boolean) is deprecated since it doesn't do anything useful.

Constant Value: 1 (0x00000001)

ENCRYPTION_STATUS_UNSUPPORTED

Added in API level 11 
public static final int ENCRYPTION_STATUS_UNSUPPORTED

Result code for setStorageEncryption(ComponentName, boolean) and getStorageEncryptionStatus(): indicating that encryption is not supported.

Constant Value: 0 (0x00000000)

EXTRA_ADD_EXPLANATION

Added in API level 8 
public static final String EXTRA_ADD_EXPLANATION

An optional CharSequence providing additional explanation for why the admin is being added.

Constant Value: "android.app.extra.ADD_EXPLANATION"

EXTRA_DELEGATION_SCOPES

Added in API level 26 
public static final String EXTRA_DELEGATION_SCOPES

An ArrayList<String> corresponding to the delegation scopes given to an app in the ACTION_APPLICATION_DELEGATION_SCOPES_CHANGED broadcast.

Constant Value: "android.app.extra.DELEGATION_SCOPES"

EXTRA_DEVICE_ADMIN

Added in API level 8 
public static final String EXTRA_DEVICE_ADMIN

The ComponentName of the administrator component.

Constant Value: "android.app.extra.DEVICE_ADMIN"

EXTRA_DEVICE_PASSWORD_REQUIREMENT_ONLY

Added in API level 31 
public static final String EXTRA_DEVICE_PASSWORD_REQUIREMENT_ONLY

A boolean extra for ACTION_SET_NEW_PARENT_PROFILE_PASSWORD requesting that only device password requirement is enforced during the parent profile password enrolment flow.

Normally when enrolling password for the parent profile, both the device-wide password requirement (requirement set via getParentProfileInstance(android.content.ComponentName) instance) and the profile password requirement are enforced, if the profile currently does not have a separate work challenge. By setting this to true, profile password requirement is explicitly disregarded.

Constant Value: "android.app.extra.DEVICE_PASSWORD_REQUIREMENT_ONLY"

EXTRA_PASSWORD_COMPLEXITY

Added in API level 29 
public static final String EXTRA_PASSWORD_COMPLEXITY

An integer indicating the complexity level of the new password an app would like the user to set when launching the action ACTION_SET_NEW_PASSWORD.

Must be one of

If an invalid value is used, it will be treated as PASSWORD_COMPLEXITY_NONE.
Requires Manifest.permission.REQUEST_PASSWORD_COMPLEXITY

Constant Value: "android.app.extra.PASSWORD_COMPLEXITY"

EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE

Added in API level 22 
public static final String EXTRA_PROVISIONING_ACCOUNT_TO_MIGRATE

An Account extra holding the account to migrate during managed profile provisioning.

If the account supplied is present in the user, it will be copied, along with its credentials to the managed profile and removed from the user.

Constant Value: "android.app.extra.PROVISIONING_ACCOUNT_TO_MIGRATE"

EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE

Added in API level 21 
public static final String EXTRA_PROVISIONING_ADMIN_EXTRAS_BUNDLE

A Parcelable extra of type PersistableBundle that is passed directly to the Device Policy Controller after provisioning.

Starting from Build.VERSION_CODES.M, if used with MIME_TYPE_PROVISIONING_NFC as part of NFC managed device provisioning, the NFC message should contain a stringified Properties instance, whose string properties will be converted into a PersistableBundle and passed to the management application after provisioning.

Constant Value: "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE"

EXTRA_PROVISIONING_ALLOWED_PROVISIONING_MODES

Added in API level 31 
public static final String EXTRA_PROVISIONING_ALLOWED_PROVISIONING_MODES

An ArrayList of Integer extra specifying the allowed provisioning modes.

This extra will be passed to the admin app's ACTION_GET_PROVISIONING_MODE activity, whose result intent must contain EXTRA_PROVISIONING_MODE set to one of the values in this array.

If the value set to EXTRA_PROVISIONING_MODE is not in the array, provisioning will fail.

Constant Value: "android.app.extra.PROVISIONING_ALLOWED_PROVISIONING_MODES"

EXTRA_PROVISIONING_ALLOW_OFFLINE

Added in API level 33 
public static final String EXTRA_PROVISIONING_ALLOW_OFFLINE

A boolean extra indicating whether offline provisioning should be used.

The default value is false.

Constant Value: "android.app.extra.PROVISIONING_ALLOW_OFFLINE"

EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME

Added in API level 23 
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME

A ComponentName extra indicating the device admin receiver of the application that will be set as the Device Policy Controller.

If an application starts provisioning directly via an intent with action ACTION_PROVISION_MANAGED_DEVICE the package name of this component has to match the package name of the application that started provisioning.

This component is set as device owner and active admin when device owner provisioning is started by an intent with action ACTION_PROVISION_MANAGED_DEVICE or by an NFC message containing an NFC record with MIME type MIME_TYPE_PROVISIONING_NFC. For the NFC record, the component name must be flattened to a string, via ComponentName.flattenToShortString().

Constant Value: "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME"

EXTRA_PROVISIONING_DEVICE_ADMIN_MINIMUM_VERSION_CODE

Added in API level 23 
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_MINIMUM_VERSION_CODE

An int extra holding a minimum required version code for the device admin package. If the device admin is already installed on the device, it will only be re-downloaded from EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION if the version of the installed package is less than this version code.

Use in an NFC record with MIME_TYPE_PROVISIONING_NFC that starts device owner provisioning via an NFC bump. It can also be used for QR code provisioning.

Constant Value: "android.app.extra.PROVISIONING_DEVICE_ADMIN_MINIMUM_VERSION_CODE"

EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM

Added in API level 21 
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM

A String extra holding the URL-safe base64 encoded SHA-256 hash of the file at download location specified in EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION.

Either this extra or EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM must be present. The provided checksum must match the checksum of the file at the download location. If the checksum doesn't match an error will be shown to the user and the user will be asked to factory reset the device.

Use in an NFC record with MIME_TYPE_PROVISIONING_NFC that starts device owner provisioning via an NFC bump. It can also be used for QR code provisioning.

Note: for devices running Build.VERSION_CODES.LOLLIPOP and Build.VERSION_CODES.LOLLIPOP_MR1 only SHA-1 hash is supported. Starting from Build.VERSION_CODES.M, this parameter accepts SHA-256 in addition to SHA-1. From Build.VERSION_CODES.Q, only SHA-256 hash is supported.

Constant Value: "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM"

Added in API level 21 
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_COOKIE_HEADER

A String extra holding a http cookie header which should be used in the http request to the url specified in EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION.

Use in an NFC record with MIME_TYPE_PROVISIONING_NFC that starts device owner provisioning via an NFC bump. It can also be used for QR code provisioning.

Constant Value: "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_COOKIE_HEADER"

EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION

Added in API level 21 
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION

A String extra holding a url that specifies the download location of the device admin package. When not provided it is assumed that the device admin package is already installed.

Use in an NFC record with MIME_TYPE_PROVISIONING_NFC that starts device owner provisioning via an NFC bump. It can also be used for QR code provisioning.

Constant Value: "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION"

EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME

Added in API level 21
Deprecated in API level 23 
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME

This constant was deprecated in API level 23.
Use EXTRA_PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME.

A String extra holding the package name of the application that will be set as Device Policy Controller.

When this extra is set, the application must have exactly one device admin receiver. This receiver will be set as the Device Policy Controller.

Constant Value: "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME"

EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM

Added in API level 23 
public static final String EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM

A String extra holding the URL-safe base64 encoded SHA-256 checksum of any signature of the android package archive at the download location specified in EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION.

The signatures of an android package archive can be obtained using PackageManager.getPackageArchiveInfo(String, PackageInfoFlags) with flag PackageManager.GET_SIGNATURES.

Either this extra or EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM must be present. The provided checksum must match the checksum of any signature of the file at the download location. If the checksum does not match an error will be shown to the user and the user will be asked to factory reset the device.

Use in an NFC record with MIME_TYPE_PROVISIONING_NFC that starts device owner provisioning via an NFC bump. It can also be used for QR code provisioning.

Constant Value: "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM"

EXTRA_PROVISIONING_DISCLAIMERS

Added in API level 26 
public static final String EXTRA_PROVISIONING_DISCLAIMERS

A Bundle[] extra consisting of list of disclaimer headers and disclaimer contents.

Each Bundle must have both EXTRA_PROVISIONING_DISCLAIMER_HEADER as disclaimer header, and EXTRA_PROVISIONING_DISCLAIMER_CONTENT as disclaimer content.

The extra typically contains one disclaimer from the company of mobile device management application (MDM), and one disclaimer from the organization.

Call Bundle.putParcelableArray(String, Parcelable[]) to put the Bundle[]

Maximum 3 key-value pairs can be specified. The rest will be ignored.

Can be used in an intent with action ACTION_PROVISION_MANAGED_PROFILE. This extra can also be returned by the admin app when performing the admin-integrated provisioning flow as a result of the ACTION_GET_PROVISIONING_MODE activity.

Constant Value: "android.app.extra.PROVISIONING_DISCLAIMERS"

EXTRA_PROVISIONING_DISCLAIMER_CONTENT

Added in API level 26 
public static final String EXTRA_PROVISIONING_DISCLAIMER_CONTENT

A Uri extra pointing to disclaimer content.

The following URI schemes are accepted:

Styled text is supported. This is parsed by Html.fromHtml(String) and displayed in a TextView.

If a content: URI is passed, the intent should also have the flag Intent.FLAG_GRANT_READ_URI_PERMISSION and the uri should be added to the ClipData of the intent.

System apps can also insert a disclaimer by declaring an application-level meta-data in AndroidManifest.xml.

For example: 

  <meta-data
      android:name="android.app.extra.PROVISIONING_DISCLAIMER_CONTENT"
      android:resource="@string/disclaimer_content"
 />

This must be accompanied with another extra using the key EXTRA_PROVISIONING_DISCLAIMER_HEADER.

Constant Value: "android.app.extra.PROVISIONING_DISCLAIMER_CONTENT"

EXTRA_PROVISIONING_DISCLAIMER_HEADER

Added in API level 26 
public static final String EXTRA_PROVISIONING_DISCLAIMER_HEADER

A String extra of localized disclaimer header.

The extra is typically the company name of mobile device management application (MDM) or the organization name.

System apps can also insert a disclaimer by declaring an application-level meta-data in AndroidManifest.xml.

For example: 

  <meta-data
      android:name="android.app.extra.PROVISIONING_DISCLAIMER_HEADER"
      android:resource="@string/disclaimer_header"
 />

This must be accompanied with another extra using the key EXTRA_PROVISIONING_DISCLAIMER_CONTENT.

Constant Value: "android.app.extra.PROVISIONING_DISCLAIMER_HEADER"

EXTRA_PROVISIONING_EMAIL_ADDRESS

Added in API level 21
Deprecated in API level 26 
public static final String EXTRA_PROVISIONING_EMAIL_ADDRESS

This constant was deprecated in API level 26.
From Build.VERSION_CODES.O, never used while provisioning the device.

Constant Value: "android.app.extra.PROVISIONING_EMAIL_ADDRESS"

EXTRA_PROVISIONING_IMEI

Added in API level 29 
public static final