Separated Apps for Android 14

Last updated October 15th, 2024

Enterprises that support work profiles on company-owned devices typically need to separate official work apps from third-party business apps installed by employees. For example,

Airline apps (United, Delta, and so on)
Hotel apps (Marriott, Hilton, and so on)
Ride-sharing apps (Uber, Lyft, and so on)

An IT admin might not be comfortable with a third-party app that needs access to contacts, email addresses, or phone numbers, since sensitive work data may end up on third-party servers. In such a scenario, the enterprise is wholly responsible for its corporate assets and devices.

For enterprises that still need full control over a device while enabling authorized third-party business apps, Samsung exclusively offers an additional option called Separated Apps. Separated Apps isolates third-party apps in a securely separated folder that prevents unauthorized access to confidential work data.

With Separated Apps, you can:

Install the same apps both inside and outside the Separated Apps space.
Set Separated Apps policies with managed configurations.

How it works

Apps that you want to secure can be installed inside the Separated Apps space:

An enterprise IT admin can:

Use a UEM to install work apps on a fully managed device, for full access and control.
Import Separated Apps from managed Google Play in the UEM.
Set up managed configurations for the installed work apps in Separated Apps. The remote configuration will be available on the UEM console.

The device user can:

Set up an app shortcut on the device, to launch an app inside the Separated Apps space.
Configure the following settings inside the Separated Apps space: apps, notifications, data usage, certificates, keyboard, and input.

Default apps

By default, the following apps are available inside the Separated Apps space, marked by the Separated Apps badge. You can also configure to show or hide these default apps with the Show default apps policy below.

Google Chrome
Microsoft Office (depends on model)
Samsung Calendar
Samsung Camera
Samsung Contacts
Samsung Gallery
Samsung MyFiles
Samsung Video
Google maps (Only installed when it’s set to Show with the Show default apps policy).

Set up Separated Apps

Acquire and activate a Knox Platform for Enterprise Premium license.
In your UEM console, go to the managed Google Play store.
Search for Separated Apps, then select it and open its managed configuration.
Set policies for Separated Apps in the managed configuration. See the Separated Apps policies.

Separated Apps policies

Policies you can configure for the Separated Apps managed configuration.

Policy	Value	Description
Enable Separated Apps	Enable	Select Enable to use Separated Apps.
Enable Separated Apps	Disable	Select Disable to remove policies applied to Separated Apps from the device and all apps installed inside Separated Apps.
Enable allowed apps installation policy	Enable	Select Enable to enable a policy configured in one of apps in the Separated Apps space and whether the specified list of apps should be installed. Select Enable to either set or modify features.
Enable allowed apps installation policy	Disable	Select Disable to remove the installation policies.
Set location to install separated apps	Inside	If you select Inside, the list of specified apps will be installed inside the Separated Apps space. Apps not included in this list will be installed outside the Separated Apps space. IMPORTANT — You can't change the installation location unless you disable Separate Apps.
Set location to install separated apps	Outside	If you select Outside, the list of specified apps will be installed outside the Separated Apps space. Apps not added to this list will be installed inside the Separated Apps space.
Add allowed apps to be installed in separated location	String(allowed package names)	The specified list of apps should be installed outside or inside the Separated Apps space. Provide a comma-separated list of applications that will be separated from all the other apps not in this list.
Add allowed apps to be installed on both sides	String(allowed package names)	The specified list of apps will be installed in both the personal space and the Separated Apps space simultaneously.
Add apps to disable in Separated Apps	String(blocked package names)	The specified list of apps is disabled in the separated space. If the same app is installed outside the separated space, this policy doesn't affect that app.
Show default apps	Show/Hide	Show or hide the default apps installed in the separated apps space.
Add blocked list of URLs	String(blocked domain names)	The specified list of domains is blocked in the separated space. Provide a comma separated list of: full URLs: "domain.example.com"; or partial URLs with wildcard "" character at beginning and/or end: "example.com", "domain.example", "example". If you want to block all websites, use "".
Allow camera	False	Prevent apps in the separated space from accessing the device camera.
Allow microphone	False	Prevent apps in the separated space from accessing the device microphone.

Manage Separated Apps

For devices running Android 14 or higher, IT admins can manage Separated Apps either through managed Google Play with managed configurations or Knox Service Plugin, depending on the following scenarios:

Scenario	I want to manage Separated Apps with Knox Service Plugin	I want to manage Separated Apps with managed configurations
I want to use Separated Apps for my devices running Android 14	IT admins who want to enable Separated Apps for the first time can use managed configurations instead of Knox Service Plugin.	Available with managed configurations that an IT admin can import.
I already use Separated Apps through Knox Service Plugin, and my devices were updated to Android 14	The IT admin continues to manage Separated Apps policies through Knox Service Plugin, unless they enable Separated Apps with managed configurations.	Once Separated Apps is enabled with managed configurations, the new policies will override the existing Separated Apps policies enabled by Knox Service Plugin. NOTE — Managed configurations for Separated Apps hold higher priority than Knox Service Plugin policies.