October 2025

Android Management API

• We've added a new policy to manage default applications on devices. Admins can configure a prioritized list of applications for each app type, and the first installed and qualified app on the device will be set as the default. Once configured, this policy prevents users from changing the default application settings, maintaining compliance with corporate policies. See this guide for more details.
• We introduced inMay a policy to configure theenterpriseDisplayNameVisibility setting, allowing administrators to control visibility of theenterpriseDisplayName on the device, such as on the lock screen of company-owned devices. In that announcement, we mentioned we will soon set the default for that policy setting to beENTERPRISE_DISPLAY_NAME_VISIBLE. That change is expected to go live inJanuary 2026.
• Documentation items have also been updated:
  • We clarified behavior of theLOCK command on devices with work profiles.
  • We added information aboutnonComplianceDetails for changes to themte_policy on devices pending a reboot.

September 2025

Android Management API

• We've introduced the concept of application roles. This includes:
  • COMPANION_APP for offline interaction with Android Device Policy
  • KIOSK for dedicated device experiences to be used with apps that haveInstallType configured asREQUIRED_FOR_SETUP orCUSTOM
  • MOBILE_THREAT_DEFENSE_ENDPOINT_DETECTION_RESPONSE (MTD/EDR) andSYSTEM_HEALTH_MONITORING apps.
  These types of apps are exempt from power and background execution restrictions, suspension and hibernation on Android 14 and later. User control is disallowed by default on Android 11 and later. See the documentation forApplicationPolicy.roles andRoleType for more details.
• A new stable release and a release candidate of the AMAPI SDK are available. See the Release notes for the details of what is included in these versions.

August 2025

Android Management API

• We are now supporting installation of applications using AMAPI SDK 1.6.0-rc01 and later. To install an application, add it to theapplication policy withinstallTypeCUSTOM and the application's signing key certificates are specified in thesigningKeyCerts list. Using AMAPI SDK, issueinstallCustomApp anduninstallCustomApp commands to install and uninstall the custom applications. See the documentation for more details
• We've addedApplicationPolicy.signingKeyCerts replacing the usage ofExtensionConfig.signingKeyFingerprintsSha256, which is now deprecated.ApplicationPolicy.signingKeyCerts must be set when the app hasinstallType set toCUSTOM (i.e. a custom app) or when the app hasextensionConfig set (i.e. an extension app) and is not on the Play Store. See the documentation for more details.
• For the AMAPI SDK, we have released:
  • An updated stable release v1.5.0
  • A new release candidate v1.6.0-rc01 that introduces the functionality to manage custom apps.

July 2025

Android Management API

• We've updated thePasswordRequirements to allow complexity-based requirements on work profile scope. A new guide has been published to explain interaction of complexity-based and non-complexity-based password settings.

June 2025

Android Management API

• For Android 16 and later, IT admins can now use theappFunctions policy setting to control whether apps on the device for fully managed devices or in the work profile for devices with work profiles are allowed to expose app functions.crossProfileAppFunctionscan be used to control whether personal profile apps can invoke app functions exposed by apps in the work profile.
• We've added to the Android Management API two new methods:modifyPolicyApplications andremovePolicyApplications. These methods allow creating, updating, and removing subsets of applications in the Policy applications field, without having to fetch and supply topolicies.patch all the applications that remain unchanged.
• A newWIPE command is being introduced as an alternative todevices.delete, and can be triggered usingdevices.issueCommand. This method triggers company-owned devices to factory reset and personally-owned devices to delete the work profile. After the wipe or deletion, the device record will also be deleted.
  We have published a new guide to explain the various methods for deprovisioning a device.
• We've updated the Android Management API SDK (AMAPI SDK) to include theDevice.WorkProfileState signal to identify the device management state.
  See the AMAPI SDK Release notes for further details.

May 2025

Android Management API

• We've added a new policy restrictionapnPolicy toDeviceConnectivityManagement to enable IT admins to configure Access Point Names (APNs) on devices. The APNs enforced by the policy will override any other APNs configured by users.
• A new policy restrictionpreferentialNetworkServiceSettings has been implemented inDeviceConnectivityManagement to enable IT admins to configure preferential networks. ThepreferentialNetworkId field in the Application can be used to choose a preferential network for each individual application. More information can be found on our5G network slicing guide and on AOSP5G network slicing docs.
• This release provides IT admins with enhanced eSIM management, enabling them to add, remove and view managed eSIMs across all devices. From now, admins can define policies for managed eSIMs, specifying their behaviour if a device is wiped or a work profile becomes non-compliant, ensuring control and compliance with organizational policies.
• The newenterpriseDisplayNameVisibility policy setting allows administrators to control visibility of theenterpriseDisplayName on the device, such as on the lock screen of company-owned devices. While it now defaults showing the enterprise name configured during initial device setup, this will change in six months (November 2025), at which point the default will beENTERPRISE_DISPLAY_NAME_VISIBLE.

April 2025

Android Management API

• We've added a new policy restrictionbluetoothSharing toPersonalUsagePolicies andDeviceConnectivityManagement to enable IT admins to allow or disallow sharing of files using Bluetooth.
• A new security log event is generated and notified using Pub/Sub notification in AMAPI whenBackupServiceState field is enabled or disabled by the admin.
• We've added a new fieldEuiccChipInfo inHardwareInfo to read EID for corporate-owned devices and a new commandREQUEST_DEVICE_INFO has been added to read EID from personally-owned devices.
• Documentation items have also been updated:
  • We've updated the Android Management API SDK (AMAPI SDK) to include the stable release of Device Trust from Android Enterprise. Release notes are available at https://developers.google.com/android/management/sdk-release-notes

March 2025

Android Management API

• The Enterprise resource now includes more details in the enterprise type field. They specify whether the enterprise uses Managed Google Play Accounts (and if it's customer-owned or EMM-owned) or if it's a managed Google domain (either DNS-verified or an email-verified team). This information helps EMMs prepare for an upcoming feature that allows enterprises to upgrade from Managed Google Play Accounts to managed Google domains, allowing them to adapt the IT admin console based on the enterprise type.

February 2025

Android Management API

• We added the guide on how to detect work profiles managed by the Android Device policy app.
• We've updated the Android Management API SDK (AMAPI SDK) to include the first release candidate for the device trust signal APIs. See AMAPI SDK release notes to know what is the latest version available.

January 2025

Android Management API

• EMMs can now limit the IT admin to sign up using an email from an allowlist of domain names.
• Documentation items have also been updated:
  • Theweb apps guide has been updated to clarify how the user's chosen default browser interacts with display settings like fullscreen or minimal UI. The browser may or may not support these attributes. IT administrators are responsible for testing the browser's compatibility with web app settings before deploying it to users.

December 2024

Android Management API

• For Android 15 and later, IT admins can now use theprivateSpacePolicy to allow or disallow the creation of a Private Space.
• For Android 15 and later, we introducedWifiRoamingMode inWifiRoamingPolicy, allowing IT admins to disable Wi-Fi roaming for specific SSIDs on fully managed devices and on work profiles on company-owned devices.
• Various items of our documentation have been updated:
  • The description of thekeyguardDisable field now includes information about management mode.
  • ThesecurityPosture documentation now includes a table that shows the equivalent Play Integrity API verdict for each AM API verdict.

November 2024

Android Management API

• We now prevent users from changing their email address during customers signup. We also introduced validation foradmin_email when creating a signup URL.
• Various items of our documentation have been updated:
  • We updated the description for theaddUserDisabled policy. For devices wheremanagementMode isDEVICE_OWNER this field is ignored and the user is never allowed to add or remove users.
  • We updated theExtensionConfig to clarify that exempt from battery restrictions applies to Android 11 and above.
  • We updated the description of thePermissionPolicy .
  • We clarified to how many applications a scope can be delegated in theDelegatedScope enum.

October 2024

Android Management API

• We updated the behavior of theCommonCriteriaMode policy.
  COMMON_CRITERIA_MODE_ENABLED will now enable cryptographic policy integrity check and additional network certificate validation. The result of the policy integrity check is set toPolicySignatureVerificationStatus ifstatusReportingSettings.commonCriteriaModeEnabled is set totrue.
  There are no changes to the behaviour of the default value (COMMON_CRITERIA_MODE_UNSPECIFIED) or when explicitly disabling it withCOMMON_CRITERIA_MODE_DISABLED.
• We updated the documentation forPERSONAL_USAGE_DISALLOWED_USERLESS to remind developers that this change is necessary before January 2025. If this change is omitted, users may encounter an"Authenticate with Google" prompt during enrollment, when their IT admin has this feature enabled.
  The complete timeline for this feature is published on the Android Enterprise partner portal: Feature Timeline: Improved sign-up flow, device enrollment, and on-device experiences.
• We updated the documentation forCrossProfileDataSharing to include details of simple data sharing via intents.

September 2024

Android Management API

The Android Management API now supports the following Android 15 features:

• For Android 15 and above a new policy has been added to control Wi-Fi roaming settings. IT Admins can useWifiRoamingPolicy to select the desiredWifiRoamingMode. Supported on fully managed devices and work profiles on company-owned devices.

Android 15 release

Android Management API

The Android Management API now supports the following Android 15 features:

• Android 15 introduces a new policy to controlCircle to Search. IT admins can useAssistContentPolicy to control this feature.
• Android 15 introduces a new policy to control Phishing Detection of apps. IT admins can useContentProtectionPolicy to control whether the app is scanned byOn Device Abuse Detection (ODAD) for phishing malware.Note: Users are not able to see this control from settings on devices with a work profile. This will be fixed in a later platform release.
• Android 15 expands the support of screen brightness and screen timeout settings using theDisplaySettings policy to company-owned devices with a work profile. This setting was previously available only on fully managed devices.

August 2024

Android Management API

• On Android 13+, IT ​​Admins can now query theICCID associated with the SIM card of theTelephonyInfo included in aNetworkInfo. This is supported on fully managed devices when thenetworkInfoEnabled field instatusReportingSettings is set totrue.
• Various items of our documentation have been updated:
  • We updated the documentation for the Common Criteria Mode to clarify that it is only supported on company-owned devices running Android 11 or above.
  • We documented the optional fieldDefaultStatus inSigninDetail.

July 2024

Android Management API

• Various items of our documentation have been updated:
  • We removed the note in the documentation forenrollmentToket.create about not being able to retrieve the token content anymore as it is possible getting the enrollment token value usingenrollmentTokens.get.
  • We clarifiedNonComplianceReason documentation.

June 2024

Android Management API

• IT admins can now control the screen brightness and screen timeout settings using theDisplaySettings policy. Supported on fully managed devices, on Android 9 and above.
• We've updated our documentation to explain that, even when usingAUTO_UPDATE_HIGH_PRIORITY, updates to apps with larger deployments across Android's ecosystem can take up to 24h.
• We've updated the Android Management API SDK (AMAPI SDK) to explain the different use cases that this library (originally known as Extensibility SDK) now supports. The updated documentation covers:
  • How to integrate the library
  • Extension apps and local commands
  • DPC migration

  See AMAPI SDK release notes to know what is the latest version available.

May 2024

Android Management API

• Theget andlist methods forenrollmentTokens now return populatedvalue,qrCode, andallowPersonalUsage fields.
• For fully managed devices, theAllowPersonalUsage setting now supports thePERSONAL_USAGE_DISALLOWED_USERLESS.
• On Android 11+ the newUserControlSettings policy allows to specify whether user control is permitted for a given app.UserControlSettings includes user actions like force-stopping and clearing app data.
• Version 1.1.5 of the AMAPI SDK is now available. Additional information is available on the release notes page.

  Note: We strongly recommend to always use the latest available version of the library to benefit from the available bug fixes and improvements.

April 2024

Android Management API

• On Android 13+, for company-owned devices, we added controls over which WiFi SSIDs devices can connect to. UsingWifiSsidPolicy IT Admins can specify a list of SSIDs to be added to an allowlist (WIFI_SSID_ALLOWLIST) or to a denylist (WIFI_SSID_DENYLIST).
• For corporate-owned devices, we added hardware identifiers (IMEI, MEID, and serial number) toProvisioningInfo that EMMs can now access during device setup using the sign-in URL.

March 2024

Android Management API

• We added additional controls over app installation usingInstallConstraint, IT admins can restrict app installation based on specific criteria.
  By settinginstallPriority, IT admins can ensure that critical apps are installed first.
• On Android 10+, AMAPI supports configuring enterprise 192 bit networks inopenNetworkConfiguration by passing Security value WPA3-Enterprise_192.
  On Android 13+, in theMinimumWifiSecurityLevel policy, we now supportENTERPRISE_BIT192_NETWORK_SECURITY, which can be used to ensure that devices do not connect to Wi-Fi networks below this security level.
• We have updated theUsbDataAccess setting so that theUSB_DATA_ACCESS_UNSPECIFIED value defaults toDISALLOW_USB_FILE_TRANSFER.

February 2024

Android Management API

• On Android 9+, IT admins can now control whether printing is allowed using theprintingPolicy field.
• For Android 14+, a new policy is added to controlCredentialProvider apps. IT admins can use thecredentialProviderPolicy field to control whether the app is allowed to act as a credential provider.
• A new policy is added to control Arm Memory Tagging Extension (MTE) on the device. TheMtePolicy field is supported on fully managed devices and work profiles on company-owned devices with Android 14 and above.
• We have updated how AM API receives errors related to installs that are triggered by IT admins. As a result of this migration, theInstallationFailureReason field now also includes client errors (in addition to the server errors).
• For Android 12+, IT admins can use a key pair installed on the device for enterprise Wi-Fi authentication. See the newClientCertKeyPairAlias field in Open Network Configuration (ONC) and our network configuration guide for more information.

January 2024

Android Management API

• Devices managed by your custom DPC can now be seamlesslymigrated to use Android Management API.

December 2023

Android Management API

• AddedMinimumWifiSecurityLevel to define the different minimum security levels required to connect to Wi-Fi networks. Supported on fully managed devices and work profiles on company-owned devices with Android 13 and above.

November 2023

Android Management API

• Android 12+ now supports passwordless enterprise Wi-Fi network configuration usingIdentity andPassword fields inOpen Network Configuration. This was already supported prior to Android 12.

  Note: On Android 12+, for Wi-Fi networks with EAP username/password authentication, if the user password is not provided andAutoConnect is set totrue, the device might try to connect to the network with a randomly generated placeholder password. To avoid this when the user’s password is not provided, setAutoConnect tofalse.

• Local device events that occur in quick succession are batched and reported in a single Pub/Sub message to EMMs.

  Event type	Expected latency between on-device event and corresponding EMM notification1
  	Previous behavior	New behavior
  High prioritykeyed app states	Immediate, at most one report per minute	Immediate, at most one report per minute
  Standard prioritykeyed app states	Schedule-based	Within one minute
  Application-related eventsduring provisioning, for apps with install states defined by the IT admin2	Integrated into other provisioning-related events	Within one minute on top of other related provisioning events
  Application-related eventsafter provisioning, for apps with install states defined by the IT admin2	Schedule-based	Within 5 minutes
  Application-related events bothduring andafter provisioning, for apps with install states defined by the employee3	Schedule-based	Within 60 minutes
  Other on-device app events	Schedule-based	Within 60 minutes

  ¹ Best effort targets based on controlled circumstances. Actual latency may vary according to a variety of device and environmental factors.
  ²InstallType of apps enforced in the policy:FORCE_INSTALLED,BLOCKED,REQUIRED_FOR_SETUP,PREINSTALLED andKIOSK.
  ³InstallType of available apps:AVAILABLE,INSTALL_TYPE_UNSPECIFIED.

October 2023

Android Management API

• Apps launched asSetupAction can now cancel enrollment. This will reset a company-owned device or deletes the work profile on a personally-owned device.

Android 14 release

Android Management API

With the release of Android 14, the Android Management API now supports the following Android 14 features:

• Restricting work profile contacts access to system applications and personal apps specified inexemptionsToShowWorkContactsInPersonalProfile. Now access to work profile contacts can be enabled for all personal apps, select personal apps, or no personal apps.

  For convenience, the newSHOW_WORK_CONTACTS_IN_PERSONAL_PROFILE_DISALLOWED_EXCEPT_SYSTEM option inshowWorkContactsInPersonalProfile ensures that the only personal apps to access work contacts are the device default Dialer, Messages, and Contacts apps. In this case, neither user-configured Dialer, Messages, and Contacts apps, nor any other system or user-installed personal apps, will be able to query work contacts.

• Disable use of the ultra wideband radio on the device. This can be achieved using the newdeviceRadioState.ultraWidebandState policy.
• Block the use of cellular 2G, improving network security. This is offered through the newdeviceRadioState.cellularTwoGState policy.
• Android 14 introduces customizable lock screen shortcuts.

  The lock screen features admin control, which includes camera, fingerprint unlock, face unlock, etc, has been extended to also disable lockscreen shortcuts using the newSHORTCUTS option.

September 2023

Android Management API

• Device and provisioning information can now be optionally retrieved during setup, allowing developers to create more targeted policies during setup or filter devices according to the supplied attributes. Thesign-in url will now include aprovisioningInfo parameter which can be exchanged for the corresponding device details using the newprovisioningInfo get method.
• SigninDetails can now be distinguished from one another with a customizabletokenTag value.

August 2023

Android Management API

• IntroducedLost Mode for company-owned devices. Lost mode enables employers to remotely lock and secure a lost device and optionally to display a message on the device screen with contact information to facilitate asset recovery.
• Added support for certificate selection delegation which grants an app access to selection of KeyChain certificates on behalf of requesting apps. SeeDelegatedScope.CERT_SELECTION for more details.
• Added additional WiFi management policies:
  • configureWifi - Admins can now disable adding or configuring WiFi networks.wifiConfigDisabled is now deprecated.
  • wifiDirectSettings - This policy can be used to disable configuring WiFi direct.
  • tetheringSettings - This policy can be used to disable WiFi tethering or all forms of tethering.tetheringConfigDisabled is now deprecated.
  • wifiState - This policy can be used to force enable/disable WiFi in a user's device.
• Sharing of admin configured WiFi networks will be disabled from Android 13 and above

July 2023

Android Management API

• AddeduserFacingType field toApplicationReport to signal whether an app is user facing.
• AddedONC_WIFI_INVALID_ENTERPRISE_CONFIG specific non-compliance reason.
  Non-compliance with reasonINVALID_VALUE and specific reasonONC_WIFI_INVALID_ENTERPRISE_CONFIG is reported if enterprise Wi-Fi network does not haveDomainSuffixMatch set.
• New Pub/Sub notificationEnrollmentCompleteEvent added, as a type ofUsageLogEvent that is published when the device finishes the enrollment.
• AddedairplaneModeState indeviceRadioState to control the current state of airplane mode and whether the user can toggle it on or off. By default, the user is allowed to toggle airplane mode on or off. Supported on fully managed devices and work profiles on company-owned devices, on Android 9 and above.

June 2023

Android Management API

• Added support for theDomainSuffixMatch field inOpen Network Configuration to configure enterprise WiFi networks for Android 6+. Enterprise WiFi configurations withoutDomainSuffixMatch are considered insecure andwill be rejected by the platform.
• AddedUsbDataAccess policy setting that allows admins to fully disable USB data transferring.usbFileTransferDisabled is now deprecated, please useUsbDataAccess.

December 2022

Android Management API

• Management capabilities over Work Profile Widgets have been improved with the addition of two new API fields:workProfileWidgets on the application level andworkProfileWidgetsDefault on the device level. These allow greater control over whether an application running in the work profile can create widgets on the parent profile e.g. the home screen. This functionality is disallowed by default, but can be set to allowed usingworkProfileWidgets andworkProfileWidgetsDefault, and is only supported for work profiles.
• We have addedsupport to setMAC address randomization settings while configuring WiFi networks. Admins can now specify whetherMACAddressRandomizationMode is set toHardware orAutomatic while configuring WiFi networks which takes effect on devices with OS version Android 13 and above and is applicable on all management modes. If set toHardware the factory MAC address will be configured to the WiFi network, whereasAutomatic the MAC address will be random.
• Various items of our documentation have been updated:
• Understanding Security Posture has been created to provide clarity on the potential responses fromdevicePosture andsecurityRisk evaluations.
• autoUpdateMode has been provided forautoUpdatePolicy as a recommended alternative due to greater flexibility with update frequency.
• We have provided clarification thatBlockAction andWipeAction are restricted to company-owned devices.
• The Pub/Sub notifications page has been updated to accurately reflect the resource types for different notification types.
• For Android 13+,extension apps are exempt from battery restrictions so will not be placed into therestricted App Standby Bucket.

October 2022

Android Management API

• Various items of our documentation have been updated:
• We recommend having onepolicy per device, to enable granular device-level management capabilities.
• In order forFreezePeriods to work as expected, system update policy cannot be set asSYSTEM_UPDATE_TYPE_UNSPECIFIED.
• Additional suggestions have been provided for policy updates regarding visibility of password steps during company-owneddevice provisioning.
• shareLocationDisabled is supported for fully managed devices and personally owned work profiles.
• We have provided an updated description on the usage ofenterprises.devices.delete and its effects on device visibility.
• Maximum enrollment tokenduration is now 10,000 years, where it was previously 90 days.

July 12 2022

Android Management API

• AddedNETWORK_ACTIVITY_LOGS andSECURITY_LOGS values to theDelegatedScope to grant device policy applications access to the corresponding logs.

June 14 2022

Android Management API

• AddedspecificNonComplianceReason andspecificNonComplianceContext toNonComplianceDetail to provide detailed context for policy application errors.

June 6 2022

Android Management API

• Added acommand to allow the admin to remotely clear the application data of an app.
• Enrollment tokens can now becreated with a longerduration than the previous maximum of 90 days, up to approximately 10,000 years. Enrollment tokens that last longer than 90 days will have a length of 24 characters, while tokens that last 90 days or less will continue to have 20 characters.

May 24 2022

Android Management API

• Hardware-backed security features such askey attestation will now be used in device integrity evaluations, when supported by the device. This provides a strong guarantee of system integrity. Devices that fail these evaluations or do not support such hardware-backed security features will report the new HARDWARE_BACKED_EVALUATION_FAILEDSecurityRisk.

May 16 2022

Android Management API

• AddedunifiedLockSettings inPasswordPolicies to allow the admin to configure if the work profile needs a separate lock.

March 25 2022

Android Management API

• AddedalwaysOnVpnLockdownExemption to specify which apps should be exempt from theAlwaysOnVpnPackage setting.
• Added all available fields from the Play EMM APIProducts resource to theApplication resource.

February 22 2022

Android Management API

• AddedcameraAccess to control the use of camera and camera toggle, andmicrophoneAccess, to control the use of microphone and microphone toggle. These fields replace newly deprecatedcameraDisabled andunmuteMicrophoneDisabled, respectively.

February 15 2022

AMAPI SDK

• Minor bug fixes. SeeGoogle's Maven Repository for more details.

November 15 2021

Android Device Policy

• Apps that are marked as unavailable inpersonalApplications will now be uninstalled from the personal profile of company-owned devices if already installed, as they are in theApplicationPolicy for work profile and fully managed devices.

September 17 2021

Android Management API

• You can now designate an app as an extension app usingExtensionConfig. Extension apps can communicate directly with Android Device Policy and in future will be able to interact with the complete set of management features offered in the Android Management API, enabling a local interface for managing the device that does not require server connectivity.
  • This initial release includes support for local execution ofCommands, and currently only theClearAppData command. See theextensibility integration guide for more details.
  • The remaining commands will be added over time, as well as additional extension app features designed to expose the breadth of device management features to the extension app.

June 30 2021

Android Device Policy

• Minor bug fixes

June 2 2021

Android Device Policy

• Minor bug fixes

May 5 2021

Android Device Policy

• Minor bug fixes

April 6 2021

Android Device Policy

• Minor bug fixes

March 2021

Android Management API

• Added two newAdvancedSecurityOverrides. These policies enable Android Enterprise security best practices by default, while allowing organizations to override the default values for advanced use cases.
• googlePlayProtectVerifyApps enablesGoogle Play's app verification by default.
• developerSettings prevents users from accessingdeveloper options and safe mode by default, capabilities that would otherwise introduce risk of corporate data exfiltration.
To facilitate migration to the new default behaviors, the default values for these policies are not enforced for existing API users (Google Cloud projects with Android Management API enabled as of April 15, 2021) until October 2021. Until then, existing API users must explicitly set a desired value to use the new policies.
• ChoosePrivateKeyRule now supports the direct grant of specific KeyChain keys to managed apps.
• This allows the target app(s) to access specified keys by callinggetCertificateChain() andgetPrivateKey() without having to first callchoosePrivateKeyAlias().
• Android Management API defaults to granting direct access to the keys specified in policy, but otherwise falls back to granting access after the specified app has calledchoosePrivateKeyAlias(). SeeChoosePrivateKeyRule for more details.

Deprecations

• ensureVerifyAppsEnabled is now deprecated. Use thegooglePlayProtectVerifyAppsAdvancedSecurityOverrides instead.
• Existing API users (Google Cloud projects with Android Management API enabled as of April 15, 2021) can continue to useensureVerifyAppsEnabled until October 2021, but are encouraged to migrate toAdvancedSecurityOverrides as soon as possible. In OctoberensureVerifyAppsEnabled will no longer function.
• debuggingFeaturesAllowed andsafeBootDisabled are now deprecated. Use thedeveloperSettingsAdvancedSecurityOverrides instead.
• Existing API users (Google Cloud projects with Android Management API enabled as of April 15, 2021) can continue to usedebuggingFeaturesAllowed andsafeBootDisabled until October 2021, but are encouraged to useAdvancedSecurityOverrides as soon as possible. In OctoberdebuggingFeaturesAllowed andsafeBootDisabled will no longer function.

February 2021

Android Management API

• AddedpersonalApplications support for company-owned devices starting from Android 8. The feature is now supported on all company-owned devices with a work profile.
• Device phone number is now reported on Fully Managed Devices as part of theDevice resource.

January 2021

Android Device Policy

• Minor bug fixes

December 2020

Android Management API

• AddedpersonalApplications toPersonalUsagePolicies. On company-owned devices, IT can specify an allow or blocklist of applications in the personal profile. This feature is currently available only on Android 11 devices, but will be backported to Android 8 in a future release.

Android Device Policy

• Minor updates to the provisioning UI

  

November 2020

Android Management API

• AddedAutoDateAndTimeZone, replacing the deprecatedautoTimeRequired, to control auto date, time, and time zone configuration on a company-owned device.
• Starting in Android 11, users can no longer clear app data or force stop applications when the device is configured as a kiosk (that is, when theInstallType of one application inApplicationPolicy is set toKIOSK).
• Added newLocationMode controls to replace deprecated location detection method controls. On company-owned devices, IT can now choose between enforcing location, disabling location, or allowing users to toggle location on and off.
• Added support forCommonCriteriaMode, a new feature in Android 11. Can be enabled to address specificCommon Criteria Mobile Device Fundamentals Protection Profile (MDFPP) requirements.

Deprecations

• autoTimeRequired is now deprecated, following the deprecation of specific auto time controls in Android 11. UseAutoDateAndTimeZone instead.
• The followingLocationMode options are now deprecated, following their deprecation in Android 9:HIGH_ACCURACY,SENSORS_ONLY,BATTERY_SAVING, andOFF. UseLOCATION_ENFORCED,LOCATION_DISABLED, andLOCATION_USER_CHOICE instead.

October 2020

Android Device Policy

• AddedRELINQUISH_OWNERSHIP as a new type of device command. When deploying work profile, admins can relinquish ownership of company-owned devices to employees, wiping the work profile and resetting any device policies to factory state, while leaving personal data intact. In doing so, IT loses claim to the ownership of the device now and in the future and should not expect the device to re-enroll. To factory reset a device while maintaining ownership, use thedevices.delete method instead.

August 2020

Android Management API

• Improvements to the work profile experience on company-owned devices were announced in theAndroid 11 developer preview. Android Management API adds support for these improvements for devices runningAndroid 8.0+ or higher. Enterprises can now designate work profile devices as company-owned, allowing management of a device's work profile, personal usage policies, and certain device-wide settings while still maintaining privacy in the personal profile.

  • For a high-level overview of enhancement to the work profile experience, seeWork profile: the new standard for employee privacy.
  • SeeCompany-owned devices for work and personal use to learn how to set up a work profile on a company-owned device.
  • An example policy for a company-owned device with a work profile is available inDevices with work profiles.
  • AddedblockScope toblockAction. UseblockScope to specify whether a block action applies to an entire company-owned device or to its work profile only.

• AddedconnectedWorkAndPersonalApp toapplicationPolicy. Starting in Android 11, some core apps can connect across a device's work and personal profiles. Connecting an app across profiles can provide a more unified experience for users. For example, by connecting a calendar app, users could view their work and personal events displayed together.

  Some apps (for example, Google Search) may be connected on devices by default. A list of connected apps on a device is available inSettings >Privacy >Connected work & personal apps.

  UseconnectedWorkAndPersonalApp to allow or disallow connected apps. Allowing an app to connect cross-profile only gives the user theoption to connect the app. Users can disconnect apps at any time.

• AddedsystemUpdateInfo todevices to report information on pending system updates.

July 2020

Android Device Policy

• [July 23] Minor bug fixes

June 2020

Android Device Policy

• [June 17] Minor bug fixes.

May 2020

Android Device Policy

• [May 12] Minor bug fixes.

April 2020

Android Device Policy

• [April 14] Minor bug fixes.

March 2020

Android Device Policy

• [March 16] Minor bug fixes.

February 2020

Android Device Policy

• [Feb 24] Minor bug fixes.

January 2020

Android Device Policy

• [Jan 15] Minor bug fixes.

December 2019

Android Management API

• A new policy for blocking untrusted apps (apps from unknown sources) is available. UseadvancedSecurityOverrides.untrustedAppsPolicy to:
  • Block untrusted app installs device-wide (including work profiles).
  • Block untrusted app installs in a work profile only.
  • Allow untrusted app installed device-wide.
  advancedSecurityOverrides.untrustedAppsPolicy replacesinstallUnknownSourcesAllowed, which is now deprecated. For more details, see theDeprecations section below.
• A timeout period for allowing non-strong screen lock methods (e.g. fingerprint and face unlock) can now be enforced on a device or work profile usingrequirePasswordUnlock. After the timeout period expires, a user must use a strong form of authentication (password, PIN, pattern) to unlock a device or work profile.
• AddedkioskCustomization to support the ability to enable or disable the following system UI features inkiosk mode devices:
  • Global actions launched from the power button (seepowerButtonActions).
  • System info and notifications (seestatusBar).
  • Home and overview buttons (seesystemNavigation).
  • Status bar (seestatusBar).
  • Error dialogs for crashed or unresponsive apps (seesystemErrorWarnings).
• AddedfreezePeriod policy to support blocking system updates annually over a specified freeze period.
• A new parameter is available indevices.delete:wipeReasonMessage lets you specify a short message to display to a user before wiping the work profile from their personal device.

Deprecations

installUnknownSourcesAllowed is now marked as deprecated. Support for the policy will continue until Q2 2020 for users who enabled Android Management APIbefore 2:00pm GMT on December 19, 2019. The policy is not supported for users who enabled the API after this date.

advancedSecurityOverrides.untrustedAppsPolicy replacesinstallUnknownSourcesAllowed. The table below provides a mapping between the two policies. Developers should update their solutions with the new policy as soon as possible*.

November 2019

Android Device Policy

• [Nov 27] Minor bug fixes.

October 2019

Android Management API

• NewIframeFeature options allow you to specify whichManaged Google Play iframe features to enable/disable in your console.

Android Device Policy

• [Oct 16] Minor bug fixes and performance optimization.

September 04, 2019

Features

• Thepolicies resource is now capable of distributing closed app releases (closed app tracks), allowing organizations to test pre-release versions of apps. For details, seeDistribute apps for closed testing.
• AddedpermittedAccessibilityServices topolicies, which can be used to:
  • disallow all non-system accessibility services on a device, or
  • only allow specified apps access to these services.

August 6, 2019

Features

• The Android Management API now evaluates the security of a device and reports findings indevice reports (undersecurityPosture).securityPosture returns the security posture status of a device (POSTURE_UNSPECIFIED,SECURE,AT_RISK, orPOTENTIALLY_COMPROMISED), as evaluated bySafetyNet and other checks, along with details of any identified security risks for you to share with customers through your management console.

  To enable this feature for a device, ensure its policy has least one field fromstatusReportingSettings enabled.

July 02, 2019

Features

• To distinguish that an app is launched fromlaunchApp insetupActions, the activity that's first launched as part of the app now contains the boolean intent extracom.google.android.apps.work.clouddpc.EXTRA_LAUNCHED_AS_SETUP_ACTION (set totrue). This extra allows you to customize your app based on whether it's launched fromlaunchApp or by a user.

May 31, 2019

Maintenance release

• Minor bug fixes and performance optimization.

May 7, 2019

Features

• AddedpolicyEnforcementRules to replacecomplianceRules, which has been deprecated. See the deprecation notice above for more information.
• Added new APIs to create and edit web apps. For more details, seeSupport web apps.

User experience

Android Device Policy: The app’s icon is no longer visible on devices. Users can still view the policy page previously launched by the icon:

• Fully managed devices: Settings > Google > Device Policy
• Devices with work profiles: Settings > Google > Work > Device Policy
• All devices: Google Play Store app > Android Device Policy

April 16, 2019

• Android Device Policy is now available in South Korea.

March 21, 2019

Features

• Added new metadata, including alternate serial numbers, todevices.
• The number of apps withinstallTypeREQUIRED_FOR_SETUP is now limited to five per policy. This is to ensure the best possible user experience during device and work profile provisioning.

February 12, 2019

User experience

• Android Device Policy: Added improvednon-compliance messaging to help users return their devices to a compliant state or inform them when it isn’t possible.
• Android Device Policy: After an enrollment token is registered, a new setup experience guides users through the steps required by their policy to complete their device or work profile configuration.

  

Features

• Added new field toinstallType
  • REQUIRED_FOR_SETUP: If true, the app must be installed before the device or work profile setup completes.Note: If the app isn't installed for any reason (e.g. incompatibility, geo-availability, poor network connection), setup won't complete.
• AddedSetupAction topolicies. WithSetupAction, you can specify an app to launch during setup, allowing a user to further configure their device. SeeLaunch an app during setup for more details.
• For enterprises withstatus reports enabled, new device reports are now issued immediately following any failed attempt to unlock a device or work profile.

Deprecations

• Inpolicies,wifiConfigsLockdownEnabled has been deprecated. WiFi networks specified is policy are now non-modifiable by default. To make them modifiable, setwifiConfigDisabled to false.

December 10, 2018

Features

• Added support for work profile devices to thesign-in URL provisioning method. Work profile device owners can now sign in with their corporate credentials to complete provisioning.

User experience

• Added support for dark mode in Android Device Policy. Dark mode is a display theme available in Android 9 Pie, which can be enabled inSettings >Display >Advanced >Device theme >Dark.

  

November 2, 2018

Features

• A newenrollment method is available for fully managed devices. The method uses a sign-in URL to prompt users to enter their credentials, allowing you to assign a policy and provision users' devices based on their identity.
• Added support for themanaged configurations iframe, a UI you can add to your console for IT admins to set and save managed configurations. The iframe returns a uniquemcmId for each saved configuration, which you can add topolicies.
• AddedpasswordPolicies andPasswordPolicyScope topolicies:
  • passwordPolicies sets the password requirements for the specified scope (device or work profile).
  • IfPasswordPolicyScope isn't specified, the default scope isSCOPE_PROFILE for work profile devices, andSCOPE_DEVICE for fully managed or dedicated devices.
  • passwordPolicies overridespasswordRequirements ifPasswordPolicyScope is unspecified (default), orPasswordPolicyScope is set to the same scope aspasswordRequirements

September 20, 2018

Bug fixes

• Fixed issue that made kiosk devices incorrectly appear out of compliance following provisioning, for a subset of policy configurations

August 28, 2018

With this release, Android Management API now supports thework profile andfully managed device solution sets. For more information about solution sets, seedevelop your solution.

Features

Updates to support work profile and fully managed device provisioning and management:

• New provisioning methods are available for work profiles:
  • Provide users with anenrollment token link.
  • Go toSettings >Google >Set up work profile.
• Added new fields toenrollmentTokens.
  • oneTimeOnly: If true, the enrollment token will expire after it's first used.
  • userAccountIdentifier: Identifies a specificmanaged Google Play Account.
    • If not specified: The API silently creates a new account each time a device is enrolled with the token.
    • If specified: The API uses the specified account each time a device is enrolled with the token. You can specify the same account across multiple tokens. SeeSpecify a user for more information.
• AddedmanagementMode (read-only) todevices.
  • Devices with work profiles:managementMode is set toPROFILE_OWNER.
  • Dedicated devices and fully managed devices:managementMode is set toDEVICE_OWNER.

Updates to thepolicies resource to improve app management capabilities:

• Added new fieldplayStoreMode.
  • WHITELIST (default): Only apps added to policy are available in the work profile or on the managed device. Any app not in policy is unavailable, and uninstalled if previously installed.
  • BLACKLIST: Apps added to policy are unavailable. All other apps listed in Google Play are available.
• AddedBLOCKED as anInstallType option, which makes an app unavailable to install. If the app is already installed, it will be uninstalled.
  • You can use installTypeBLOCKED together withplayStoreModeBLACKLIST to prevent a managed device or work profile from installing specific apps.

User experience

• Updated Android Device Policy settings to match device settings.

July 12, 2018

User experience

• Merged the status and device details pages in Android Device Policy into a single page.
• Improved setup UI consistency with Android setup wizard.

Features

• AddedPermissionGrants at the policy level. You can now control runtime permissions at four levels:
  • Global, across all apps: set defaultPermissionPolicy at the policy level.
  • Per permission, across all apps: set permissionGrant at the policy level.
  • Per app, across all permissions: set defaultPermissionPolicy withinApplicationPolicy.
  • Per app, per permission: set permissionGrant withinApplicationPolicy.
• When factory resetting a device, the newWipeDataFlag allows you to:
  • WIPE_EXTERNAL_STORAGE: wipe the device's external storage (e.g. SD cards).
  • PRESERVE_RESET_PROTECTION_DATA: preserve the factory reset protection data on the device. This flag ensures that only an authorized user can recover a device if, for instance, the device is lost.Note: Only enable this feature if you've setfrpAdminEmails[] inpolicy.

Bug fixes

• Fixed issue with Android Device Policy exiting lock task mode when updating in the foreground.

May 25, 2018

User experience

• Instead of hiding disabled apps from the launcher, Android 7.0+ devices now display icons for disabled apps in gray:
  

  

Features

• Updatedpolicies to support the following certificate management capabilities:
  • Automatic granting of certificate access to apps.
  • Delegating all certificate management features supported by Android Device Policy to another app (seeCERT_INSTALL).
• Individual apps can now be disabled inApplicationPolicy (setdisabled totrue), independent ofcompliance rules.
• It's now possible to disable system apps.
• Addedapplication reports todevices. For each managed app installed on a device, the report returns the app's package name, version, install source, and other detailed information. To enable, setapplicationReportsEnabled totrue in the device'spolicy.
• Updatedenterprises to includeterms and conditions. An enterprise's terms and conditions are displayed on devices during provisioning.

Bug fixes

• Updated provisioning flow to disable access to settings, except when access is required to complete setup (e.g. creating a passcode).

April 3, 2018

User experience

• Updated the design of Android Device Policy and the device provisioning flow to improve overall user experience.

Features

• Added support forDirect Boot, allowing you to remotely wipe Android 7.0+ devices that haven't been unlocked since they were last rebooted.
• Added alocation mode setting to thepolicies resource, allowing you to configure the location accuracy mode on a managed device.
• Added an error response field to theCommand resource.

Bug fixes

• Provisioning performance has been improved.
• Compliance reports are now generated immediately after a device is provisioned. To configure an enterprise to receive compliance reports, seeReceive non-compliance detail notifications.

Known issues

• Lock Screen Settings crashes on Android 8.0+ LG devices (e.g. LG V30) managed by Android Device Policy.

February 14, 2018

User experience

• Updated the validation text for the "code" field, which is displayed if a user chooses to manually enter a QR code to enroll a device.

Features

• You can now set a policy to trigger force-installed apps to auto-update if they don't meet a specified minimum app version. InApplicationPolicy:
  • SetinstallType toFORCE_INSTALLED
  • Specify aminimumVersionCode.
• Updated theDevices resource with new fields containing information that may be useful to IT admins, such as the device's carrier name (see NetworkInfo for more details), whether the device is encrypted, and whether Verify Apps is enabled (seeDeviceSettings for more details).

Bug fixes

• TheRESET_PASSWORD andLOCK commands now work with Android 8.0 Oreo devices.
• Fixed issue with DeviceSettings not being populated.
• Fixed issue withstayOnPluggedModes policy handling.

December 12, 2017

Features

• Android Device Policy now supports a basickiosk launcher, which can be enabled via policy. The launcher locks down a device to a set of predefined apps and blocks user access to device settings. The specified apps appear on a single page in alphabetical order. To report a bug or request a feature, tap the feedback icon on the launcher.
• Updated device setup with new retry logic. If a device is rebooted during setup, the provisioning process now continues where it left off.
• The following new policies are now available. See theAPI reference for full details:

  keyguardDisabledFeatures	accountTypesWithManagementDisabled
  installAppsDisabled	mountPhysicalMediaDisabled
  uninstallAppsDisabled	bluetoothContactSharingDisabled
  shortSupportMessage	longSupportMessage
  bluetoothConfigDisabled	cellBroadcastsConfigDisabled
  credentialsConfigDisabled	mobileNetworksConfigDisabled
  tetheringConfigDisabled	vpnConfigDisabled
  createWindowsDisabled	networkResetDisabled
  outgoingBeamDisabled	outgoingCallsDisabled
  smsDisabled	usbFileTransferDisabled
  ensureVerifyAppsEnabled	permittedInputMethods
  recommendedGlobalProxy	setUserIconDisabled
  setWallpaperDisabled	alwaysOnVpnPackage
  dataRoamingDisabled	bluetoothDisabled

• Updated Android Device Policy's target SDK toAndroid 8.0 Oreo.

Bug Fixes

• It's now possible to skip the network picker display if a connection can't be made at boot. To enable the network picker on boot, use thenetworkEscapeHatchEnabled policy.