How to block Google and Samsung Accounts

Environment

• Android Enterprise
• Knox Service Plugin
• Google Account
• Samsung account

Overview

Device users can add accounts to a device, such as a Google or Samsung account, in Settings > Account and backup > Manage accounts. You can restrict what account types are allowed and specify accounts to be blocked using Knox Service Plugin.

How can I block the addition of a Google or Samsung account on a device?

You can prevent accounts from being added to a device by applying a Knox Service Plugin Device Account Policy. On your EMM console, set the following Knox Service Plugin configurations:

Fully managed devices

To restrict accounts on fully managed devices:

1. Set Device-Wide policies > Enable device policy controls to True.

2. Under Device-Wide policies > Device Account Policy, set the following to True:

   • Enable Device Account Policy controls.
   • Enable Device Account policies (Configure profiles below).

Devices with a work profile

To restrict accounts on devices with a work profile:

1. Set Work profile policies > Enable work profile policies to True.

2. Under Work profile policies > Device Account Policy (Premium), set the following to True:

   • Enable Device Account Policy controls.
   • Enable Device Account policies (Configure profiles below).

Add Device Account Policy configurations

Now, add your Device Account Policy configurations:

1. Go to Device Account Policy Configurations and add a configuration for each account type to be blocked.

   1. Add Account Type to Addition Blocklist:

      • Select “com.google” for Google accounts.
      • Select “com.osp.app.signin” for Samsung accounts.
      • See the list of account names for common apps to restrict other account types.

   2. Add Accounts to Addition Blocklist: Enter the list of accounts to be blocked as a comma-separated list. For example, “abc@google.com, xyz@google.com”. You can use a wildcard to specify multiple accounts to blocklisted, for example, “.*@google.com” or “.*” for all accounts.

2. Save and publish the configuration.