Android MDM policies

A policy is a set of rules OpsMerge enforces on an Android device. One policy covers eight areas; you turn on the ones you need and leave the rest off.

The eight rule types

• Passcode — screen-lock complexity, minimum length, wipe-after-N-failures, expiry.
• Encryption — require full-device encryption with a password.
• Apps — a list of mandatory, force-installed apps. All other apps are blocked.
• Location — location reporting mode.
• Lost mode — whether the user can factory-reset the device.
• Wi-Fi — networks pushed to the device automatically.
• OS updates — automatic, windowed, or postponed updates.
• Kiosk — lock the device into dedicated-device (kiosk) mode.

Edit a policy under Settings → MDM → Devices → Policies. Toggle each rule on in the left list and fill in its form on the right, then Save.

Choosing mandatory apps

In the Apps rule, click Browse Google Play to open the Managed Google Play picker. Approve the apps you want and they're added to the force-installed list. You can also add an app directly by its package name (for example com.example.app).

Kiosk mode

The Kiosk rule locks a device into dedicated-device (kiosk) mode: the keyguard and status bar are disabled so it behaves like an appliance. There are two modes:

• Single app — the device is locked to one app. Enter that app's package name (for example com.example.kiosk).
• Multi-app launcher — the device shows a locked launcher built from the Apps rule's force-installed list. Turn on the Apps rule as well and add the apps you want on the launcher; a multi-app kiosk with no force-installed apps is rejected.

Rolling a policy out to devices ("groups")

Android applies exactly one policy per device. OpsMerge resolves which one using a hierarchy:

1. A policy assigned directly to the device (on its detail page) wins.
2. Otherwise, the device's site default applies.
3. Otherwise, the organisation default applies.

So the way to apply a policy to a group of devices is to set it as a site default: every device in that site picks it up. Set org and site defaults under Settings → MDM → Devices → Policies, in the Assign policies to devices section. OpsMerge pushes the change to affected devices automatically.

There's no separate "app group" — apps live inside each policy. If two groups of devices need different apps, make two policies.