Features

Features

A complete list of what CORE MDM can do, and which parts need Device Owner Setup.

Enrollment & identity

• Firebase email/password and Google Sign-In
• Automatic enrollment to Firestore on sign-in — works for brand-new devices
• Optional enrollment-token provisioning: pre-register a device by IMEI, then the device claims the token (see Enrollment and Provisioning)
• Stable per-device hardware ID (IMEI → serial → Android ID, cached)

Remote commands (queued & cancellable)

• Lock screen
• Reboot (Device Owner)
• Wipe (factory reset)
• Full lockdown — turns on a bundle of restrictions at once
• Alarm on/off (instant toggle, not queued)

Commands are written to a per-device queue, shown as Pending in the console with a Cancel button, and claimed by the device in a transaction so a cancelled command never runs. See Commands and Command Queue.

Device policies (persistent)

Around 30 toggles, applied live and re-applied after reconnect/reboot. Highlights:

• App restrictions: block install / uninstall / sideloading, hide Play Store, hide browsers, disable camera, disable screen capture
• System: block safe boot / factory reset / developer options, block add-user & user-switch, lock the status bar
• Hardware: lock Wi-Fi / Bluetooth / cellular / VPN config, block USB file transfer, disable Bluetooth radio, block outgoing calls, block SD card, protect MDM from uninstall
• Network: enforce Private DNS hostname, content filter VPN, kiosk packages

Full list with meanings: Policies Reference.

App management (Device Owner)

• Installed-app inventory synced to the console (package, label, version)
• Hide/suspend individual apps from the Installed Apps tab
• Block Social Media — one toggle suspends WhatsApp, Facebook, Instagram, TikTok, Snapchat, X, Messenger
• Silent install/uninstall support via PackageInstaller (SilentInstaller)

See App Management.

Security

• Mandatory in-app PIN on every open, PBKDF2-hashed with lockout backoff
• Admin-configurable minimum PIN length (4 / 6 / 8) enforced on the lock screen and in-app
• MDM self-uninstall protection

See PIN and Security.

Content filtering & kiosk

• DNS content filter via a local VPN (DnsVpnService); on Device Owner it self-authorizes so the console toggle works with no on-device tap
• Private DNS hostname enforcement
• Kiosk / lock-task mode with an allowed-package list

See Content Filter and DNS and Kiosk Mode.

Web console

• Real-time device grid with online/offline/alarm status and search
• Rename devices
• Per-device modal with 7 tabs (Commands, App Policies, Installed Apps, System, Hardware, Network, Danger)
• Super-admin view, audit log, enrollment-token management

See Web Console Guide.

What needs Device Owner

Works as Device Admin	Needs Device Owner
Lock, Wipe, Alarm	Reboot, Full lockdown (fully)
Enrollment, rename, online status	App hide/suspend, Block Social Media
Command queue + cancel	Enforced lock-screen PIN length
Installed-app inventory	Kiosk mode, Private DNS, content-filter auto-start
	Most system/hardware restrictions

See Device Owner Setup.