Policies Reference

Policies Reference

Every policy is a field under policies.* on the device document. The console writes it; the device applies it in MdmCommandService.applyRemotePolicies and re-applies it on reconnect/reboot. Most require Device Owner (noted below).

Unless stated, each is a boolean where true = enabled/blocked.

App Policies tab

Key	Meaning	Needs DO
installAppsBlocked	Block installing apps (DISALLOW_INSTALL_APPS)	✅
uninstallAppsBlocked	Block uninstalling apps (DISALLOW_UNINSTALL_APPS)	✅
unknownSourcesBlocked	Block sideloading (DISALLOW_INSTALL_UNKNOWN_SOURCES)	✅
playStoreHidden	Hide the Play Store app	✅
browsersHidden	Hide Chrome and other installed browsers	✅
socialMediaBlocked	Suspend WhatsApp, Facebook, Instagram, TikTok, Snapchat, X, Messenger	✅
cameraDisabled	Disable all cameras	Admin
screenCaptureDisabled	Block screenshots & screen recording	Admin
blockedApps (string[])	Hide each listed package — removed from the launcher (Installed Apps tab)	✅
suspendedApps (string[])	Block each listed package — suspended, visible but can't open (Installed Apps tab)	✅

System tab

Key	Meaning	Needs DO
safeBootBlocked	Block booting into safe mode (DISALLOW_SAFE_BOOT)	✅
factoryResetBlocked	Block factory reset from settings (DISALLOW_FACTORY_RESET)	✅
debuggingBlocked	Disable developer options & ADB (DISALLOW_DEBUGGING_FEATURES)	✅
addUserBlocked	Block adding users (DISALLOW_ADD_USER)	✅
userSwitchBlocked	Block switching users (DISALLOW_USER_SWITCH)	✅
statusBarDisabled	Lock the status/notification bar	✅
pinMinLength (number)	Minimum lock-screen PIN length (4/6/8), numeric quality	✅

Hardware tab

Key	Meaning	Needs DO
wifiConfigBlocked	Lock Wi-Fi configuration (DISALLOW_CONFIG_WIFI)	✅
mobileNetworksBlocked	Lock cellular settings (DISALLOW_CONFIG_MOBILE_NETWORKS)	✅
bluetoothConfigBlocked	Lock Bluetooth config (DISALLOW_CONFIG_BLUETOOTH)	✅
vpnBlocked	Block VPN configuration (DISALLOW_CONFIG_VPN)	✅
networkResetBlocked	Block network reset (DISALLOW_NETWORK_RESET, API 23+)	✅
usbTransferBlocked	Block USB/MTP file transfer	✅
bluetoothDisabled	Turn off the Bluetooth radio	✅
outgoingCallsBlocked	Block outgoing calls (DISALLOW_OUTGOING_CALLS)	✅
physicalMediaBlocked	Block SD-card / physical media mounting	✅
mdmUninstallProtected	Prevent CORE MDM itself from being uninstalled	✅

Network tab

Key	Meaning	Needs DO
privateDnsHost (string)	Enforce a Private DNS hostname; empty clears it	✅
filterRunning	Start/stop the DNS content filter VPN (self-authorizes on DO)	✅
kioskPackages (string[])	Apps allowed in kiosk/lock-task mode	✅

How application works

• The device compares the incoming policies map to the last applied one and only acts on changes (so the 60s heartbeat doesn't thrash).
• blockedApps (hide) and suspendedApps (block) are each diffed: packages newly added are hidden/suspended; packages removed from a list are un-hidden/un-suspended.
• socialMediaBlocked suspends/un-suspends only the preset packages that are actually installed.
• On non-Device-Owner devices, DO-only policies are silently skipped (the app logs it but doesn't crash).

See App Management, Content Filter and DNS, Kiosk Mode, and PIN and Security for the richer features.