Device Admin

To display only the features present on a particular device, select one or more filters from the SmartDocs bar below.

Input fields accept ENGLISH ONLY.

Queries from MX are not supported on Zebra devices running Android 11 or later. See alternative method.

Overview

The Device Administrator CSP (DevAdmin) controls which apps have administrative privileges, can access Android Device Admin APIs and how, when and whether the Screen-Lock is invoked.

Android defines some APIs as Device Administration APIs, as implemented within the DevicePolicyManager class. These APIs enable applications to perform tasks that can affect the security of the device. As such, they are restricted to specially approved "Device Administrator" applications. If an application is written to conform to the DeviceAdminReceiver model and is approved to become a Device Administrator, then it can use some or all of the Device Administration APIs.

In standard Android devices, an application that is written to conform to the DeviceAdminReceiver model must explicitly request the device user to approve it as a Device Administrator. This is based on the assumption that the device user is knowledgeable enough to make this determination. For a device that is owned and/or used by a single user, that assumption might be reasonable. For an Enterprise-owned device that might be shared among multiple device users, that assumption may be a poor one.

The DevAdmin provides direct access to certain device administration tasks and allows programmatic approval as a Device Administrator of applications written to conform to the DeviceAdminReceiver model without involving or notifying the device user. This allows an Enterprise to grant its own trusted applications access to the Device Administration APIs, thus enabling those applications to perform device administration tasks.

Main Functionality

  • Set Screen-Lock Timeout Interval
  • Set Screen Lock Type (or none)
  • Set Lock Screen notification type
  • Set Lock Screen wallpaper
  • Enable/Disable:
    • Installation of applications from Unknown sources
    • Device Administrator approval for an application
    • Secure Start-up Selection
    • Visibility of remote Lock Screen during RC sessions

Device Administration Action

Used to grant or deny approval as a Device Administrator from a qualifying application. To qualify, the app must be written to conform to the DeviceAdminReceiver model. All applications by default are initially denied approval as a Device Administrator and must be explicitly approved. Only an application that is currently installed and written to conform to the DeviceAdminReceiver model may be approved as a Device Administrator.

When an application is approved as a Device Administrator, it will be notified that it can begin using the Device Administration APIs. When Device Administrator approval is removed, the app is likewise notified that it must stop using the Device Administration APIs.

NOTE: The ability to grant or deny approval for an application using the DevAdmin does not prevent the device user from doing the same for an application using the System Settings panel. The effect of this parameter is the same as that of a device user going though System Settings. Access to the System Settings panel can be controlled with the UI Manager.

Parm Name: DevAdminAction

Option Name Description Note Status Requires
0 Do nothing This value (or the absence of this parm from the XML) will not make any change to whether any application is approved to be a Device Administrator; any previously selected setting will be retained.

OSX: 1.3+

MX: 4.3+

1 Turn On as Device Administrator Approves a specific application as a Device Administrator.

OSX: 1.3+

MX: 4.3+

2 Turn Off as Device Administrator Removes Device Administrator approval from a specific application.

OSX: 1.3+

MX: 4.3+

Device Admin Package Name

Used to enter the Package Name of an application to which to grant or deny Device Administrator privileges.

NOTE: The Package Name of the application must be known and specified. The Package Name can be acquired from the application developer, by looking up the Package Name on a device, or using developer tools to extract the Package Name from the APK file.

Parm value input rules:

  • String from 1 - 255 characters

Shown if: Device Administration Action is "Turn On as Device Administrator" or "Turn Off as Device Administrator"

Parm Name: DevAdminPkg

Requires:

  • OSX: 1.3+
  • MX: 4.3+

Device Admin Class Name

Used to enter the Class Name that will be added to or removed from the Device Admin list, which determines whether the application can access Android Device Admin APIs.

NOTE: The name of the class within the application that implements the DeviceAdminReceiver must be known and specified. This is not the same as the Activity class name required to launch the application and would likely need to be acquired from the application developer.

Parm value input rules:

  • String from 1 - 255 characters

Shown if: Device Administration Action is "Turn On as Device Administrator" or "Turn Off as Device Administrator"

Parm Name: DevAdminClass

Requires:

  • OSX: 1.3+
  • MX: 4.3+

Install from Unknown Sources

Controls whether apps can be installed (on devices with or without GMS) by the device user from sources other than Google Play. Off by default (option 2) on Zebra devices with GMS; On by default on non-GMS devices.

IMPORTANT: On non-GMS devices, disabling apps from Unknown Sources (option 2) prevents only the device user from installing apps on the device. It does NOT prevent apps from being installed through the App Manager or other programmatic means.

Note: Not supported on devices running Android 8.x Oreo or higher.

Status: Deprecated. This feature will be discontinued in devices running Android 13 and later.

Parm Name: UnknownSourcesStatus

Option Name Description Note Status Requires
0 Do not change This value (or the absence of this parm from the XML) makes no change to the Unknown Sources Option; any previously selected setting is retained.

MX: 4.3+

Android API: 3+

1 Turn On Turns Unknown Sources On, allowing apps to be installed by the device user from sources other than Google Play.

MX: 4.3+

Android API: 3+

2 Turn Off Turns Unknown Sources Off, preventing apps from being installed by the device user from sources other than Google Play.

MX: 4.3+

Android API: 3+

Lock Screen Wallpaper

Used to determine the wallpaper displayed on the Lock Screen. When selecting a Custom wallpaper (option 2), identify the wallpaper file on the device using the Custom Wallpaper parameter.

Parm Name: LockScreenWallpaper

Option Name Description Note Status Requires
0 Do not change This value (or the absence of this parm from the XML) makes no change to device settings; any previously selected setting is retained.

MX: 10.5+

1 Restore to default Restores the Lock Screen wallpaper to its factory-default setting.

MX: 10.5+

2 Custom Allows a custom wallpaper image to be selected for display on the Lock Screen.

MX: 10.5+

Custom Wallpaper File

Used to enter the file name and path on the device of an image file (.jpg or .png, 126 MB max.) for display when the Lock Screen is shown on the device.

Parm value input rules:

  • String of at least one (1) character
  • Supports .jpg or .png file formats
  • 126 MB maximum file size

Note: Supported only on devices running Android 10 or later. Android 11 requires MX 11.3 or later.

Shown if: Lock Screen Wallpaper is "Custom"

Parm Name: CustomLockWallpaper

Requires:

  • MX: 10.5+

Lock Screen Notifications

Used to select the type of notification content to be shown on the Lock Screen, if any. WARNING: Displaying notifications of any kind on the Lock Screen could expose confidential data to users who lack credentials to unlock the device.

This parameter controls settings found in Apps & notifications > Notifications > "Notifications on Lock Screen" AND Display > Lock Screen > "Notifications on Lock Screen" Settings panels on the device. The table below shows the corresponding device settings for each DevAdmin setting.

DevAdmin Setting Apps & Notifications Setting Display Setting
Show all content Show conversations, default and silent Show all notification content
Show only non-sensitive content Hide silent conversations and notifications Show all notification content
Hide notifications Don’t show any notifications Don’t show notifications at all

Note: Supported only on devices running Android 10 or later. Android 11 requires MX 11.3 or later.

Parm Name: NotificationOnLockScreen

Option Name Description Note Status Requires
0 Do not change This value (or the absence of this parm from the XML) makes no change to device settings; any previously selected setting is retained.

MX: 10.5+

1 Show all content Allows all notifications sent to the device or its user to be displayed on the device Lock Screen.

MX: 10.5+

2 Show only non-sensitive content Allows all notifications to be displayed on the device Lock Screen except those deemed "sensitive" by Android. See table, above.

MX: 10.5+

3 Hide notifications Blocks all notifications from being displayed on the device Lock Screen.

MX: 10.5+

Screen Lock Type

Controls whether a screen lock will be invoked when the device powers up or user inactivity exceeds the Screen-Lock Timeout Interval parameter, and which Android Lock Screen will be displayed.

ENTERPRISE HOME SCREEN NOTE: Installation of Zebra EHS by default disables the Android Settings panel on devices, which causes any execution of this parameter to fail. To use this parameter on devices intended to run EHS, Zebra recommends setting the ScreenLockType before EHS is installed on target device(s). To set the ScreenLockType on devices already running EHS, enable EHS Privileged Settings on the device(s) to temporarily activate the Settings app, set the ScreenLockType as desired, then disable Privileged Settings to re-secure the device.

Note: On TC20/TC25 devices, available only when running Android 8.x Oreo and later.

Parm Name: ScreenLockType

Option Name Description Note Status Requires
0 Do not change This value (or the absence of this parm from the XML) will cause no change to the Screen Lock Type; any previously selected setting will be retained.

OSX: 6.0+

MX: 6.0+

1 Swipe Causes the Swipe screen-lock to be displayed whenever the Lock Screen is invoked.

OSX: 6.0+

MX: 6.0+

2 Pattern Causes the Pattern screen-lock to be displayed whenever the Lock Screen is invoked.

OSX: 6.0+

MX: 6.0+

3 Pin Causes the numerical "Pin" screen-lock to be displayed whenever the Lock Screen is invoked.

OSX: 6.0+

MX: 6.0+

4 Password Causes the Password screen-lock to be displayed whenever the Lock Screen is invoked.

OSX: 6.0+

MX: 6.0+

5 None Prevents the display of any Lock Screen at any time.

OSX: 6.0+

MX: 6.0+

Screen-Lock Timeout Interval

Controls the length of time a device must remain inactive with the display screen off before a screen-lock is invoked.

Android supports two levels of inactivity, each controlled independently. The Display Screen Timeout, administered by the Display Manager, controls the length of time a device must remain inactive before the display screen is turned off. The Screen Lock Timeout interval (this parameter), controls how long the screen must remain off before a screen-lock will be invoked.

When the device screen is turned back on, manually by some sort of device user activity, or programmatically due to some device event, the result will depend on how long the device screen was off and the value set for the Screen Lock Timeout. If the display screen was off for less than the Screen Lock Timeout, then the screen will not be locked (and hence will not need to be unlocked by the device user). If the display screen was off for at least the Screen Lock Timeout, then the screen will be locked (and hence will need to be unlocked by the device user).

This behavior can be modified in two ways, based on other aspects of the device that may be configured. First, if no lock behavior is set for the device (e.g. no pin or password), then "unlocking" (if required) may require only a swipe, and not any actual data entry by the device user. Second, if the device is configured to lock automatically when the display screen is turned off by the power key, then a screen lock will always occur when the display screen is turned back on after being turned off via the power key, regardless of how much time the display screen was off.

NOTE: The Android display system supports a fixed set of interval values for the Screen-Lock Timeout as listed in the table below. This parameter is capable of configuring the timeout using only those supported values. Entering a value that is less than the smallest value shown in the table or greater than the largest value will be ignored and generate an error in the Result XML document. However, entering a value between two supported values will cause the closest value to the requested value to be selected, and generate no error in the Result XML document.

Status: In devices running Android 13 and later, this feature can be accessed through StageNow and compatible EMM systems, or using Android Device Policy Manager (DPM) APIs.

Parm Name: ScreenLockTimeoutInterval

Option Name Description Note Status Requires
0 Do not change This value (or the absence of this parm from the XML) will cause no change to the Screen Lock Timeout; any previously selected setting will be retained.

OSX: 1.3+

MX: 4.3+

1 Immediately after Display Timeout Causes the screen to be locked when the display screen is turned back on, regardless of how long the display screen was off.

OSX: 1.3+

MX: 4.3+

5 5 seconds after Display Timeout Causes the screen to be locked when the display screen is turned back on if the screen was off for at least 5 seconds.

OSX: 1.3+

MX: 4.3+

15 15 seconds after Display Timeout Causes the screen to be locked when the display screen is turned back on if the screen was off for at least 15 seconds.

OSX: 1.3+

MX: 4.3+

30 30 seconds after Display Timeout Causes the screen to be locked when the display screen is turned back on if the screen was off for at least 30 seconds.

OSX: 1.3+

MX: 4.3+

60 1 minute after Display Timeout Causes the screen to be locked when the display screen is turned back on if the screen was off for at least 1 minute.

OSX: 1.3+

MX: 4.3+

120 2 minutes after Display Timeout Causes the screen to be locked when the display screen is turned back on if the screen was off for at least 2 minutes.

OSX: 1.3+

MX: 4.3+

300 5 minutes after Display Timeout Causes the screen to be locked when the display screen is turned back on if the screen was off for at least 5 minutes.

OSX: 1.3+

MX: 4.3+

600 10 minutes after Display Timeout Causes the screen to be locked when the display screen is turned back on if the screen was off for at least 10 minutes.

OSX: 1.3+

MX: 4.3+

1800 30 minutes after Display Timeout Causes the screen to be locked when the display screen is turned back on if the screen was off for at least 30 minutes.

OSX: 1.3+

MX: 4.3+

Remote Lock Screen Allow/Disallow

Used to select whether the Android Lock Screen is visible on the remote console if the Lock Screen appears on a device while being remotely controlled. The remote console is the rendering of the device being controlled as seen on the DNA Cloud console or that of a third-party EMM system.

Platform Note

This feature is supported ONLY on the following platforms and requires the following Android- and platform-specific OSX versions.

Android 13:

Platform - Required OSX ver. (or later)
SDM660 - SDM660.130.13.20.18
4490 - QCT4490.130.13.15.4
6375 - QCT6375.130.13.22.15
6490 - QCT6490.130.13.20.16

Android 11:

Platform - Required OSX ver. (or later)
SDM660 - QCT.110.11.27.46
6375 - SD6375.110.30.41
6490 - QCT6490.110.11.14.32

Note: This feature requires Android- and platform-specific versions of OSX. See Platform Note.

Parm Name: RCLockScreenVisibility

Option Name Description Note Status Requires
0 Do nothing This value (or the absence of this parm from the XML) makes no change to device settings; any previously selected setting is retained.

MX: 13.3+

Android API: 30+

1 Allow Shows the Android Lock Screen on the remote console if it appears on the device while being remotely controlled.

MX: 13.3+

Android API: 30+

2 Disallow Hides the Android Lock Screen on the remote console if it appears on a device while being remotely controlled.

MX: 13.3+

Android API: 30+

Secure Start-up Selection

Controls whether the "YES" button is available for selection by a device user on the "Secure Start-up" dialog box after changing the device lock-screen password, PIN or swipe pattern in the Android Settings panel. If "YES" is pressed, the same password, PIN or pattern that protects access to the Android Launcher app also would be applied to protect the device start-up process, preventing the device from booting if restarted.

IMPORTANT: If the device is rebooted with this feature enabled, the device remains unmanaged and inoperable until the password, PIN or pattern is entered and the start-up process is allowed to complete.

Status: This feature is discontinued in devices running Android 13 and later.

Parm Name: SecureStartupSelection

Option Name Description Note Status Requires
0 Do not change This value (or the absence of this parm from the XML) makes no change to device settings; any previously selected setting is retained.

OSX: 6.2+

MX: 10.0+

Android API: 26+

1 Enable Allows the user to select "YES" when prompted to protect the device boot process.

OSX: 6.2+

MX: 10.0+

Android API: 26+

2 Disable Disables "YES" button, preventing device user from electing to protect the device boot process.

OSX: 6.2+

MX: 10.0+

Android API: 26+

Silent App Install

Used to select whether the device user receives notifications when the Device Owner installs, uninstalls or upgrades apps.

Parm Name: SilentAppInstall

Option Name Description Note Status Requires
0 Do not change This value (or the absence of this parm from the XML) causes no change to device settings; any previously selected setting is retained.

OSX: 11.5+

MX: 10.5+

Android API: 30+

1 Show Allows notifications to be displayed on the device when the DO installs, uninstalls or upgrades an app.

OSX: 11.5+

MX: 10.5+

Android API: 30+

2 Hide Prevents notifications from being displayed on the device when the DO installs, uninstalls or upgrades an app.

OSX: 11.5+

MX: 10.5+

Android API: 30+

Examples

Set the Screen to Lock to 1 Minute After the Display Times Out


<wap-provisioningdoc>
    <characteristic type="DevAdmin" version="4.3" >
        <parm name="ScreenLockTimeoutInterval" value="60"/>
    </characteristic>
</wap-provisioningdoc>

Allow Application Installs from Unknown Sources


<wap-provisioningdoc>
    <characteristic type="DevAdmin" version="4.3" >
        <parm name="UnknownSourcesStatus" value="1"/>
    </characteristic>
</wap-provisioningdoc>

Queries

Queries are not supported on Zebra devices running Android 11 or later.

Get Apps that are Active Device Admins

Input


<wap-provisioningdoc>
    <characteristic type="DevAdmin" version="4.3" >
        <characteristic-query type="AppAsDevAdmin"/>
    </characteristic>
</wap-provisioningdoc>

Output


<wap-provisioningdoc>
    <characteristic type="DevAdmin" version="4.3" >
        <characteristic type="AppAsDevAdmin">
            <parm name="DevAdminAction" value="1"/>
            <characteristic type="DevAdminDetails">
                <parm name="DevAdminPkg" value="PackageName1"/>
                <parm name="DevAdminClass" value="ClassName1"/>
            </characteristic>
        </characteristic>
    </characteristic>
    <characteristic type="DevAdmin" version="4.3" >
        <characteristic type="AppAsDevAdmin">
            <parm name="DevAdminAction" value="1"/>
            <characteristic type="DevAdminDetails">
                <parm name="DevAdminPkg" value="PackageName2"/>
                <parm name="DevAdminClass" value="ClassName2"/>
            </characteristic>
        </characteristic>
    </characteristic>
</wap-provisioningdoc>

Get Screen Lock Timeout Interval

Input


<wap-provisioningdoc>
    <characteristic type="DevAdmin">
        <parm-query name="ScreenLockTimeoutInterval"/>
    </characteristic>
</wap-provisioningdoc>

Output


<wap-provisioningdoc>
    <characteristic type="DevAdmin" version="4.3">
        <parm name="ScreenLockTimeoutInterval" value="1"/>
    </characteristic>
</wap-provisioningdoc>

Get Install Apps from Unknown Sources Status

Input


<wap-provisioningdoc>
    <characteristic type="DevAdmin">
        <parm-query name="UnknownSourcesStatus"/>
    </characteristic>
</wap-provisioningdoc>

Output


<wap-provisioningdoc>
    <characteristic type="DevAdmin" version="4.3">
        <parm name="UnknownSourcesStatus" value="1"/>
    </characteristic>
</wap-provisioningdoc>