Android policies

Allows the device user and apps to operate the camera.

Values

• Allow (default)
• Don't allow

Allows the device user and apps to take screenshots.

Values

• Allow (default)
• Don't allow

Allows the device user to toggle developer mode.

Values

• Allow (default)
• Don't allow

Android 8 and higher

Knox 2.0 and higher

Allows the device user to factory reset the device.

Values

• Allow (default)
• Don't allow

Allows the user to adjust the clock and current date.

Values

• Allow (default)
• Don't allow

Determines the schedule for firmware updates on the device.

Values

• Automatically install updates when available (default). The device will perform firmware updates as soon as they become available.
• Postpone updates for 30 days after it becomes available. For each firmware update, the device will wait 30 days before applying it.

• Set a time period. The device will perform firmware updates during a specified period in the day. If set, you must also define the start and end of the period:

  • From. Specifies the start of the update period, in 24-hour time format.
  • To. Specifies the end of the update period, in 24-hour time format.

Additionally, you can schedule one or more freeze periods, which are stretches of time where the device won't apply any firmware updates, on top of whichever update setting you select. These periods will recur every year. You can configure as many freeze periods as you need.

• Start date. Specifies the month and day to begin the firmware freeze period.
• End date. Specifies the month and day to end the firmware freeze period.

Click ADD ANOTHER PERIOD to schedule an additional freeze period.

Controls Wi-Fi availability.

Values

• Allow (default). The device user can turn Wi-Fi on and off.
• Force on
• Force off

Android 8 and higher

Knox 1.0 and higher

Controls Bluetooth availability.

Values

• Allow (default). The device user can turn Bluetooth on and off.
• Force off

Allows the device user to transfer files between the device and other devices through USB. Charging through the USB connector isn't affected.

Values

• Allow (default)
• Don't allow

Allows the device user to mount storage media connected through the SD card slot.

Values

• Allow (default)
• Don't allow

Determines the name of the policy.

Values

Enter a unique name for the policy. The name must:

• Be at least 3 characters long
• Contain only ASCII alphanumeric characters, and underscores (_)
• Not contain a space at the start or the end

Determines the name of the policy.

Values

Enter a name.

So that Knox Manage can correctly process and store the name, it must:

• Be between 3 and 50 characters long
• Contain only ASCII alphanumeric characters, and underscores (_)
• Not contain a space at the start or the end

Specifies a description for the policy that is displayed on the Knox Manage console.

Values

Enter a description up to 1,000 characters long.

The security protocol of the Wi-Fi network. This value must match the actual security protocol that the network uses.

Values

• None
• WPA/WPA2-PSK (default)

The password of the Wi-Fi network. This value must match the actual password that the network uses.

Only available if Security type is set to WPA/WPA2-PSK.

Values

Enter the password.

So that Knox Manage can correctly process and store the password, it must:

• Be between 8 and 30 characters long
• Contain at least one ASCII letter
• Not contain spaces

The Wi-Fi network's proxy. This value must match the actual proxy settings that the network uses.

Values

• None (default).

• Manual. The proxy settings are determined individually.

  • Proxy host name. The name of the proxy server.

    So that Knox Manage can correctly process and store the host name, it must:

    • Contain ASCII alphanumeric characters, colons (:), periods (.), dashes (-), underscores (_), and forward slashes (/).
  • Proxy port. The port of the proxy server. Must be a number between 1 and 5 digits long.

  • Proxy exception. A URL that isn't routed through the proxy.

    So that Knox Manage can correctly process and store the host name, it must:

    • Contain ASCII alphanumeric characters, colons (:), periods (.), dashes (-), and forward slashes (/).

    Click ADD ANOTHER EXCEPTION to create extra exceptions.

• Proxy automatic configuration. The proxy settings are loaded by an external file.

  • PAC Web address. The URL where the proxy auto-config (PAC) file is stored.

Assigns extra settings that control how the device interacts with the Wi-Fi network.

Values

• Automatically connect to the network (default off). If in range of the network, the device will connect to it.
• Allow user to remove the network from the Knox Manage agent configuration (default on). Allows the user to remove the Wi-Fi policy from the Knox Manage agent. This setting has no effect on the network's entry Android Wi-Fi manager.
• Hidden network (default off). Hides the the network from the Android Wi-Fi manager. This setting has no effect on the Wi-Fi policy in the Knox Manage agent.

Turns on settings related to the lock screen.

Enforces the minimum complexity for the device's lock. There are three complexity levels, each pre-defined by the Android API. The device user must set a lock that meets or exceeds the minimum level.

You can enable this setting and the Set minimum strength at the same time. If you do so, this setting will apply to any assigned devices that are running Android 12 and higher, while Set minimum strength will apply to any devices running Android 8 to 11.

Only available if Screen lock policies is turned on.

Values

• Low. The lock must be a pattern or PIN. Repeating (4444) and ordered (1234, 4321, 2468) sequences are allowed.
• Medium. The lock must be A PIN without repeating (4444) or ordered (1234, 4321, 2468) sequences. Or, it must be a password with 4 or more characters.
• High. The lock must be a PIN with 8 or more characters, without repeating (4444) or ordered (1234, 4321, 2468) sequences. Or, it must be a password with 6 or more characters.

Enforces the minimum strength for the device's lock. Each strength level uses a lock type with minimum strength requirements. For PINs and passwords, you can further define the minimum length and complexity requirements across multiple parameters. The device user must set a lock that meets or exceeds the minimum strength.

The password strength increases in the following descending order of the available values, with Weak Biometric being the weakest, and Complex being the strongest.

You can enable this setting and the Set minimum complexity at the same time. If you do so, this setting will apply to any assigned devices that are running Android 8 to 11, while Set minimum complexity will apply to any devices running Android 12 and higher.

Only available if Screen lock policies is turned on.

Values

• Weak Biometric. A biometric recognition method.
• Pattern. A pattern.

• Numeric. A PIN.

• Numeric Complex. A pin with no repeating (4444) or ordered (1234, 4321, 2468) sequences.
• Alphabetic. A password with letter characters.
• Alphanumeric. A password with alphanumeric characters.
• Complex. A password with alphanumeric and special characters.

Depending on the value selected above, you must also set the parameters of the password strength:

• Minimum length (default is 4 for most strengths, and 6 for Complex). Specifies the minimum allowed length of the PIN. This value can be between 4 and 16 for most strengths, but is between 6 and 16 for Complex.

  Required if the password strength is set to Numeric, Numeric Complex, Alphabetic, Alphanumeric, or Complex.

• Minimum letters (default is 4). Specifies the minimum number of letters that the password must have.

  Required if the password strength is set to Complex.

• Minimum non-letters (default is 2). Specifies the minimum number of numbers and special characters that the password must have.

  Required if the password strength is set to Complex.

• Minimum lowercase letters (default is 3). Specifies the minimum number of lowercase letters that the password must have.

  Required if the password strength is set to Complex.

• Minimum capital letters (default is 1). Specifies the minimum number of capital letters that the password must have.

  Required if the password strength is set to Complex.

• Minimum special characters (default is 1). Specifies the minimum number of special characters that the password must have.

  Required if the password strength is set to Complex.

• Maximum sequential numbers (default is 10). Specifies the maximum length that any sequence of repeated numbers (such as 4444) can be in the PIN. Leave as 1 to disallow repeated sequences entirely.

  Required if the password strength is set to Numeric, Numeric Complex, Alphabetic, Alphanumeric, or Complex.

  Only takes effect on Samsung devices secured by Knox.

• Maximum sequential characters (default is 10). Specifies the maximum length that any sequence of repeated letters (such as aaaa) can be in the PIN. Leave as 1 to disallow repeated sequences entirely.

  Required if the password strength is set to Alphabetic, Alphanumeric, or Complex.

  Only takes effect on Samsung devices secured by Knox.

Specifies how long the lock will remain active before the device user must change it.

Only available if Set minimum complexity is turned on, or Set minimum strength is set to Pattern, Numeric, Numeric Complex, Alphabetic, Alphanumeric, or Complex.

Values

Enter the number of days, between 1 and 365. Default is 30.

You can also set:

• Send notification before expiration (default off). Pushes a notification to the device that alerts the device user that the password will expire soon. Additionally, select how soon before expiration to send the notification:

  • 1 day before (default)
  • 3 day before
  • 5 day before
  • 7 day before

Specifies how many times how many times someone can fail to unlock the device in a row before the device takes action to protect itself.

Only available if Set minimum complexity is turned on, or Set minimum strength is set to Pattern, Numeric, Numeric Complex, Alphabetic, Alphanumeric, or Complex.

Values

Enter the number of failed unlock attempts are tolerated, between 1 and 10. Default is 1.

You can also set:

• Take action if attempts are exceeded (default off). Controls which action the device takes when the unlock attempt limit is reached. You can select from the following actions:

  • Lock device (default)
  • Factory reset + initialize SD card
  • Factory reset

If the lock complexity is low or its strength is weak, specifies how long after the device is unlocked that it relocks.

Values

Enter the number of hours, between 1 and 72. Default is 1.

Specifies the minimum number of new locks that must be registered before a user can reuse a previous lock.

Values

Enter the minimum number of locks, between 1 and 10. Default is 1.

Specifies what happens if the device user sets a lock that violates the minimum complexity or strength requirements.

Values

• Lock device
• Do nothing (default)

Specifies the longest duration that the device user can set for automatic screen timeout and lock.

Values

• 15 sec
• 30 sec
• 1 min
• 2 min
• 5 min
• 10 min (default)

Controls the services that track the device's physical location.

Values

• Allow user to configure (default). Allows the device user to toggle location services.

• Allow user to configure and prompt for location accuracy. Turns on high-precision tracking for location services.

  When turned on, every app that requires location permissions asks the device user to choose a preferred precision.

• Force on. Requires Android 9 and higher.
• Force off

Allows the device user to install apps.

Values

• Allow (default)
• Don't allow

Allows the device user to uninstall apps.

Values

• Allow (default)
• Don't allow

Allows the device user to install Android apps from untrusted sources. This setting doesn't apply to apps on Google Play.

Values

• Allow (default)
• Don't allow

Specifies a list of apps to uninstall from the device and prevent the user from installing.

If you or the user have already installed an app to the device, once you hide it, it automatically uninstalls.

Values

Select one or more apps from the app library.

Specifies a list of pre-installed system apps to reactivate. Apps specified in the Hide apps list take precedence over this list.

Values

Select one or more apps from the known list of system apps.

Specifies a list of apps that are not run on devices.

Values

Select one or more apps from the app library.

Specifies a list of apps that must not be uninstalled from devices.

Values

Select one or more apps from the app library.

Specifies the single app to offer in the kiosk experience.

Values

Enter the package name.

As of Knox Manage 23.12, this value is fixed at com.sds.emm.singleweb — Knox Browser — and can't be changed.

Specifies the home page of the Kiosk Browser.

Values

Enter a fully-formed URL.

You can insert lookup codes for string substitution.

Controls settings related to core kiosk behavior.

Values

• Hide info icon (default off). Hides the info button in the interface, which normally lets the device user exit kiosk mode and view the license. If the button is hidden and the device isn't connected to a network, the device can't exit mode.
• Automatic app updates (default off). Controls whether apps can automatically update.
• File uploads (default off). Allows the device user to upload files through Kiosk Browser.
• Copy text (default off). Allows the device user to copy text in Kiosk Browser.

• Screen saver (default off). Controls whether to use a screen saver. The screen saver launches when no user activity is detected for a specific amount of time, or when the device is charging.

  • Images (Up to 10 images, max 5MB per image). Specifies the images to use as a screen saver. Each image can be up to 5 MB in size. You can add up to 10 images, in the PNG, JPG, JPEG, or GIF formats. If an image is a GIF, it can't be animated.
  • Video (Max 50MB). Specifies the video to use as a screen saver. the corresponding files. The video file can be up to 50 MB in size. The MP4 and MKV file formats are supported.
  • Session timeout (default 1800). Specifies the amount of time, in seconds, that the device must be idle before the screen saver launches. Enter a value between 10 and 3,600.
• Run JavaScript (default on). Controls whether Kiosk Browser can run JavaScript on web pages.

Controls settings related to OS behavior in the kiosk.

Values

• System status bar (default off). Enables the system status bar.
• Notification bar (default off). Enables notifications.
• Power off (default on). Enables the power off button.
• Home button (default off). Enables the home button.
• Recent apps (default off). Enables the recent app button, also known as the Recents button.
• Keyguard (default on). Allows the Lock screen policy to apply to the device. If turned off, the device doesn't won't be protected by a lock screen, and the device user can access the device without first unlocking it.