How to develop an app using managed AppConfig settings and apply them in Knox Manage

Environment

• Knox Manage (KM)
• Android Enterprise

Overview

This knowledge base article shows developers how to implement managed configuration settings in their apps, and guides IT admins through the steps on how to apply managed configurations in Knox Manage (KM).

What is AppConfig?

AppConfig is a standard approach for app configuration and management that supports developers and customers in driving business mobility.

KM introduced managed configurations as an implementation of AppConfig, designed as an easy way for IT admins to configure enterprise mobile apps. As a developer, Google also provides you with native Android APIs to support managed AppConfig through KM.

Why should I use AppConfig and managed configurations?

If you are developing apps for the enterprise market, you may need to satisfy particular requirements set by an organization's policies. Managed Configurations, previously known as application restrictions, allow the organization's IT admin to remotely specify settings for apps. This feature is particularly useful for organization-approved apps deployed to an Android Enterprise work profile.

Each app defines the managed configuration options that IT admins can set remotely through KM. If your app is running in a work profile, the admin can change your app's managed configuration.

As a developer, how do I implement managed AppConfig in my app?

Let's assume you are developing an app that should be configured with a server address. To do so:

1. Open your app's resource XML file, typically found inside the res/xml/ folder. Using the schema shown below, this file declares all the managed AppConfig keys that are supported by your app. KM automatically pulls the details of the keys using Google Play APIs,

<?xml version="1.0" encoding="utf-8"?>
<restrictions xmlns:android="http://schemas.android.com/apk/res/android"> 
<restriction
android:key="address"
android:title="@string/title"
android:restrictionType="string"
android:description="@string/description"
android:defaultValue="sample address"/>
</restrictions>

2. In your app's manifest file, under the application tag, declare the restrictions xml file.

<application
android:allowBackup="true"
android:icon="@mipmap/ic_launcher"
android:label="@string/app_name"
android:roundIcon="@mipmap/ic_launcher_round"
android:supportsRtl="true"
android:theme="@style/AppTheme">
<meta-data android:name="android.content.APP_RESTRICTIONS"
android:resource="@xml/app_restrictions" />

3. Next, dynamically register your activity to listen for the ACTION_APPLICATION_RESTRICTIONS_CHANGED intent. Doing so ensures that any new or updated values pushed by KM's managed configuration are also received by the app.

IntentFilter restrictionFilter = new IntentFilter(Intent.ACTION_APPLICATION_RESTRICTIONS_CHANGED);
BroadcastReceiver restrictionReceiver = new BroadcastReceiver() { 
	@Override
	public void onReceive(Context context, Intent intent) { 
		Bundle appRestrictions = restrictionsManager.getApplicationRestrictions(); 
	/* 
		Fetch the values of managed application configuration from this bundle and take action in your app accordingly.
		*/ 
	}
};

In order for an app to fetch an EMM-provided managed AppConfig, Google requires the app to be published from a source that KM can pull from and publish to enrolled Android devices. Organizations might choose to publish the app in the Google Play Store, or they can use private channels if they have a limited audience.

As a Knox Manage admin, how do I set up managed configurations for an enterprise app?

The UI for Managed Configuration now uses a custom method from Google’s iframe method for better flexibility and improved usability, for example using diverse Wildcards.

To push the managed AppConfig for enterprise apps from the KM console:

1. Navigate to Group > Select the checkbox next to the desired group > Click Assign Application.

2. Select the app and click Assign.

3. Next to Target Device, select Android Enterprise. Then, under Android Enterprise Settings, next to Auto-run after Install, select Yes. Click Set Configuration.

4. If the app follows Google's guidelines and the managed AppConfig keys are set up correctly, then KM can pull and populate the keys and their corresponding key types. The KM admin can then assign corresponding values for the new configuration. Enter the server address and click Save.
   
   NOTE—KM's Managed Configuration interface now uses Google's iframe method for betterimproved usability. If you have already set up a managed configuration, you can choose to either use the previous configuration or use a new method. If there is no existing configuration, the new method is used for each new configuration.

5. Click Assign to push the new configuration to the group's devices.

6. Click OK to assign and start the newly-configured app on the devices.

If the app is running on the devices and the developer has correctly registered it to receive the managed restriction broadcast, it then receives the updated values pushed by KM.

Additional information

For more developer info about managed configurations, see the Knox SDK developer guide.