Policy settings
Every setting a policy can hold, and which devices it reaches.
This is every setting in the policy editor, grouped as the editor groups them. Each one says what it does and how each kind of device handles it:
- Agent — Android devices running the Simplifyd agent, enrolled by QR code.
- Google-managed — company-owned Android devices enrolled through managed Google Play.
- Personal (work profile) — people's own phones, where only the work profile is managed.
- Windows — Windows laptops and desktops.
Enforced means the device is made to follow the setting. Reported, not enforced means the device can't be forced, so a device that doesn't meet it is reported as non-compliant instead. A setting that is not available on a kind of device has no effect there, and the policy review warns you before you publish it to such devices.
Security
Screen lock, encryption and what happens after a reset.
Screen lock strength
Low allows a pattern or simple PIN. Medium needs a 4+ digit PIN without repeats (4444) or sequences (1234), or a 4+ character password. High needs an 8+ digit PIN or a 6+ character password.
One of Not required, Low, Medium, High.
Agent: Enforced (agent 1.2.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedExact bands on Android 12+; older devices get the nearest equivalent.
Require a new screen lock every
People are asked to set a new PIN or password after this many days.
From 0 to 365 days. Never at zero.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): EnforcedBlock reusing recent passwords
People can't reuse this many of their previous PINs or passwords.
From 0 to 24 passwords. Off at zero.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedNeeds a screen lock strength.
Wipe after failed unlock attempts
The device factory-resets after this many wrong PINs or passwords in a row. Set it high enough that someone guessing a shared PIN can't wipe a class set.
From 0 to 30 attempts. Never at zero.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedNeeds a screen lock strength.
Lock the screen after inactivity
The screen locks after this long without use. People can choose a shorter time, but not a longer one.
From 0 to 60 minutes. Device default at zero.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedRequire the full PIN or password
Fingerprint and face unlock keep working in between. After this long, the PIN or password is needed again.
One of Device default (every 72 hours), Every 24 hours.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedTurn off on the lock screen
These are hidden or disabled while the device is locked.
Any of Camera, Notifications, Fingerprint unlock, Face unlock.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedFace unlock needs Android 9+.
Require encrypted storage
Android can't switch encryption on remotely. Unencrypted devices are reported as non-compliant.
On or off.
Agent: Reported, not enforced · Google-managed: Reported, not enforced · Personal (work profile): Reported, not enforcedFactory reset protection admins
After a reset from recovery mode, setup only finishes when one of these Google accounts signs in.
A list of Google accounts.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Not availableAgent devices need each admin's Google account ID; AMAPI devices use the email.
Restrictions
Hardware and system features people can't use or change.
Block camera
Turns off every camera app, including in video calls.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): EnforcedBlock screenshots and screen recording
Also blocks casting the screen to other displays.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): EnforcedBlock USB file transfer and SD cards
Charging still works. Files can't be copied to or from a computer or memory card.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Not availableBlock apps from outside Google Play
Stops APK files being installed from downloads, messages or USB.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): EnforcedBlock developer options and USB debugging
Stops anyone connecting the device to a computer to change it.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): EnforcedBlock adding users
Stops extra user profiles being created on shared devices.
On or off.
Agent: Enforced (agent 1.2.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableLock volume
Keeps the volume where it is. Useful in libraries and exam halls.
On or off.
Agent: Enforced (agent 1.2.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableRequire automatic date and time
Date, time and time zone come from the network and people can't change them, so exam timers and usage limits can't be dodged.
On or off.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableNetwork & filtering
Web filtering, VPN, and which network settings people can change.
DNS filtering
Blocks domains on every network, mobile data included, and people can't turn it off. Blocking example.com also blocks its subdomains; *.example.com blocks only the subdomains. Allowed domains are never blocked, even when a blocklist includes them. Blocked sites open a page saying so.
Blocklists, blocked domains and allowed domains.
Agent: Enforced (agent 1.5.0 or later) · Google-managed: Not available · Personal (work profile): Not availableAndroid 10+. Uses Private DNS, so the two can't both be set.
Private DNS
Sends every DNS lookup to a DNS-over-TLS service, such as one that filters adult content or enforces safe search. People can't change it.
Off, automatic, or a provider's hostname.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableAndroid 10+.
Global HTTP proxy
Browsers and apps that follow the system proxy send web traffic through it. Apps can ignore it, so pair it with an always-on VPN for strict filtering.
A proxy host and port, or a PAC file address.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableAlways-on VPN
The VPN app connects at startup and stays connected. With lockdown, no traffic leaves the device unless the VPN is connected.
An always-on VPN app.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedThe VPN app must support always-on.
Block changing Wi-Fi settings
People can't add, change or forget Wi-Fi networks. Devices keep the networks already saved on them.
On or off.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableBlock changing Bluetooth settings
People can't pair new Bluetooth devices or change Bluetooth settings.
On or off.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableBlock hotspot and tethering
Devices can't share their connection with other devices.
On or off.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableBlock data roaming
Mobile data stays off while roaming.
On or off.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableOffer a temporary network at startup
If a device starts without a connection, someone can connect it to Wi-Fi just long enough for it to download its policy.
On or off.
Agent: Not available · Google-managed: Enforced · Personal (work profile): Not availableWi-Fi & certificates
Networks devices join on their own, and the certificates they trust. For Android and Windows.
Wi-Fi networks
Devices join these networks on their own, without anyone typing a password. Enterprise networks check the server's certificate against one of the certificates below before signing in.
A list of Wi-Fi networks.
Agent: Enforced (agent 1.7.0 or later) · Google-managed: Enforced · Personal (work profile): Enforced · Windows: EnforcedOn Windows, enterprise networks use PEAP with MSCHAPv2 and people enter their own sign-in.
Trusted certificates
CA certificates devices trust, such as your Wi-Fi server's or your web filter's. Paste each as PEM.
A list of certificates.
Agent: Enforced (agent 1.7.0 or later) · Google-managed: Enforced · Personal (work profile): Enforced · Windows: EnforcedSystem updates
When Android installs system updates, and when it mustn't.
System update policy
Automatic installs updates as soon as they're available. A daily window installs them only between set times. Postpone delays them for up to 30 days. Freeze periods block updates on set dates every year, such as exam weeks.
Automatic, windowed or postponed, with freeze periods.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableFreeze periods need Android 9+, last at most 90 days, and need 60 days between them.
Accounts
Which accounts and credentials people can add or change.
Block adding and removing accounts
People can't add Google or other accounts, or remove the ones already on the device.
On or off.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedBlock changing credentials
People can't install or remove certificates and saved credentials.
On or off.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedApps
Which apps can be installed, how they update, and what they can access.
Apps
Apps from your catalog that devices on this policy get. Installed automatically means pushed to the device and can't be removed; available means people can install it themselves.
A list of apps, each installed, offered or blocked.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): EnforcedUploaded APKs install on agent devices only. Play apps install on AMAPI devices; agent devices get a prompt for available ones..
Only allow approved apps
Nothing outside this list and the policy's apps can be installed, and installed apps that aren't on either are blocked. System apps and the MDM agent are never affected.
A list of apps people may use.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): EnforcedWhen apps ask for permissions
Applies to runtime permissions such as camera, microphone and location. Choices for specific apps take precedence.
One of Ask the person, Grant automatically, Deny automatically.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedPermissions for specific apps
Grant or deny one permission for one app, such as the camera for an exam app. People can't change it.
A list of app and permission pairs.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedRuntime permissions only.
Automatic app updates
How Google Play updates installed apps.
One of Let people choose, Never, Over Wi-Fi only, Always.
Agent: Not available · Google-managed: Enforced · Personal (work profile): EnforcedRequire Google Play Protect
Play Protect scans apps for harmful behaviour, and people can't turn it off.
On or off.
Agent: Enforced (agent 1.3.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedAllow remote support
Installs the Remote support app on devices Google manages, so IT can see their screen, and tap with the person's say-so. Someone opens the app once on each device to connect it.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Not availableDevices running our agent have remote view built in.
Kiosk & exams
Lock devices to one app, or into exam lockdown.
Kiosk mode
In one-app mode the device opens straight into the chosen app and people can't leave it.
A mode and, for a single-app kiosk, the app.
Agent: Enforced (agent 1.2.0 or later) · Google-managed: Enforced · Personal (work profile): Not availableExam lockdown
Turns on the camera, screenshot, USB, outside-apps, debugging and add-user blocks together, whatever they're set to under Restrictions.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Not availableLocation
Where devices are.
Report device location
Records an approximate position at each check-in so lost devices can be found.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Not availableOn devices Google manages, this installs the Remote support app to report the position; someone opens it once on each device to connect it.
Places devices belong
A device outside all of these places, at the times they apply, is out of line with its policy, and the compliance settings decide what happens. Devices report a precise position while this is on.
Places on a map, with optional active hours.
Agent: Enforced (agent 1.8.0 or later) · Google-managed: Not available · Personal (work profile): Not availableChecked at each check-in, about every 15 minutes.
Compliance
What makes a device non-compliant beyond the settings above, and what happens then.
Minimum Android version
Devices running an older version of Android are non-compliant.
One of Any version, Android 10, Android 11, Android 12, Android 13, Android 14, Android 15, Android 16.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): EnforcedMaximum security patch age
Devices whose Android security patch is older than this are non-compliant. Manufacturers stop patching old models, so set it with the oldest devices you keep in mind.
From 0 to 365 days. Off at zero.
Agent: Enforced (agent 1.7.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedBlock rooted or tampered devices
Devices that look rooted, run an unofficial build or fail Google's integrity checks are non-compliant.
On or off.
Agent: Enforced (agent 1.7.0 or later) · Google-managed: Enforced · Personal (work profile): EnforcedAMAPI devices are checked by Google; agent devices by Google Play Integrity from agent 1.8.0, and for common signs of rooting.
Minimum Windows version
Windows devices running an older release are non-compliant.
One of Any version, Windows 10 22H2, Windows 11 22H2, Windows 11 23H2, Windows 11 24H2, Windows 11 25H2.
Windows: EnforcedMark devices offline for longer than
Devices that haven't checked in for this many days are non-compliant until they next check in.
From 0 to 90 days. Off at zero.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Enforced · Windows: EnforcedGrace period
How long a device can stay out of line before it counts as non-compliant. Until then it shows as a warning, and nothing else happens.
From 0 to 168 hours. None at zero.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Enforced · Windows: EnforcedWhen a device becomes non-compliant
Runs once, when the grace period ends. Devices that are only offline aren't locked, since they'd lock the moment they came back.
One of Do nothing, Lock the screen.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Enforced · Windows: EnforcedEmail admins
Your organisation's admins get an email listing the devices that have become non-compliant, at most every few minutes.
On or off.
Agent: Enforced · Google-managed: Enforced · Personal (work profile): Enforced · Windows: EnforcedWindows sign-in & security
Passwords, BitLocker, Defender and the firewall on Windows devices.
Require a sign-in password
People must set a password or PIN to sign in. The other password settings only apply when this is on.
On or off.
Windows: EnforcedApplies to local accounts.
Minimum password length
Passwords and PINs must be at least this long.
From 0 to 16 characters. Windows default at zero.
Windows: EnforcedPassword characters
Whether a PIN of digits is enough, or the password must mix letters and numbers.
One of Digits or letters, Letters and numbers.
Windows: EnforcedLock the screen after inactivity
The device locks after this long without use.
From 0 to 60 minutes. Windows default at zero.
Windows: EnforcedLock out after failed sign-ins
After this many wrong passwords in a row, a BitLocker-encrypted device restarts into BitLocker recovery and needs its recovery key.
From 0 to 30 attempts. Never at zero.
Windows: EnforcedRequire a new password every
From 0 to 365 days. Never at zero.
Windows: EnforcedBlock reusing recent passwords
From 0 to 24 passwords. Off at zero.
Windows: EnforcedRequire BitLocker
Asks Windows to encrypt the system drive. Until it is encrypted, the device is non-compliant.
On or off.
Windows: EnforcedNeeds a TPM; Windows Home has no BitLocker.
Require Microsoft Defender
Turns on real-time, behaviour and cloud protection. A device whose antivirus is off or missing is non-compliant.
On or off.
Windows: EnforcedRequire the firewall
Turns on Windows Firewall for domain, private and public networks. A device whose firewall is off is non-compliant.
On or off.
Windows: EnforcedWindows restrictions
Hardware and account features people can't use on Windows devices.
Block camera
Turns off every camera, including in video calls.
On or off.
Windows: EnforcedBlock writing to USB drives
Files can be read from USB drives and memory cards but not copied to them.
On or off.
Windows: EnforcedTurn off Bluetooth
Bluetooth stays off and can't be turned on.
On or off.
Windows: EnforcedBlock personal Microsoft accounts
People can't sign in to apps and Windows services with a personal Microsoft account.
On or off.
Windows: EnforcedBlock removing management
People can't disconnect the device from management in Settings.
On or off.
Windows: EnforcedWindows Update
When Windows devices install updates, and how long they wait.
Install updates
Automatic installs updates and restarts outside active hours. Scheduled installs and restarts at a set time every day. Notify only tells people an update is ready.
One of Windows default, Automatically, outside active hours, Every day at a set time, Notify only.
Windows: EnforcedActive hours start
With automatic updates, Windows won't restart between active hours' start and end.
One of 00:00, 01:00, 02:00, 03:00, 04:00, 05:00, 06:00, 07:00, 08:00, 09:00, 10:00, 11:00, 12:00, 13:00, 14:00, 15:00, 16:00, 17:00, 18:00, 19:00, 20:00, 21:00, 22:00, 23:00.
Windows: EnforcedActive hours end
One of 00:00, 01:00, 02:00, 03:00, 04:00, 05:00, 06:00, 07:00, 08:00, 09:00, 10:00, 11:00, 12:00, 13:00, 14:00, 15:00, 16:00, 17:00, 18:00, 19:00, 20:00, 21:00, 22:00, 23:00.
Windows: EnforcedScheduled install time
With scheduled updates, when Windows installs and restarts.
One of 00:00, 01:00, 02:00, 03:00, 04:00, 05:00, 06:00, 07:00, 08:00, 09:00, 10:00, 11:00, 12:00, 13:00, 14:00, 15:00, 16:00, 17:00, 18:00, 19:00, 20:00, 21:00, 22:00, 23:00.
Windows: EnforcedDelay security and quality updates
Monthly updates wait this long after release, so problems surface elsewhere first.
From 0 to 30 days. Don't delay at zero.
Windows: EnforcedDelay feature updates
New Windows releases wait this long before installing.
From 0 to 365 days. Don't delay at zero.
Windows: Enforced