EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     if (restrictionPolicy.allowAirplaneMode(false)) {
         // Airplane Mode is disallowed.
     } else {
         // failure to disallow
     }
     // allow
     if (restrictionPolicy.allowAirplaneMode(true)) {
         // Airplane Mode is allowed.
     } else {
         // failure to allow
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableAndroidBeam = false;
     if (restrictionPolicy.allowAndroidBeam(enableAndroidBeam)) {
         Log.d(TAG, "Android Beam blocked.");
     } else {
         Log.d(TAG, "Failed blocking Android Beam.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

An administrator can use this API to disable audio recording. The device microphone is still available after disabling audio recording so that the user can make calls and use audio streaming. This API relies on declared use of the audio, allowing only calls, voice recognition, and voice over IP (VoIP). If the application declares a use type and does something else, then this API is not able to block it. When audio recording is disabled, any ongoing audio recording is interrupted. Video recording is still allowed if no audio recording is attempted.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableAudioRecording = false;
     if (restrictionPolicy.allowAudioRecord(enableAudioRecording)) {
         Log.w(TAG, "Audio record blocked.");
     } else {
         Log.w(TAG, "Failed to block audio record.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     boolean enableAudioRecording = false;
     if (restrictionPolicy.allowAudioRecord(enableAudioRecording)) {
         Log.w(TAG, "Audio record blocked.");
     } else {
         Log.w(TAG, "Failed to block audio record.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

An administrator can use this API to allow or disallow setting a background process limit by the user. When disabled, the background process limit is set to the maximum.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableLimitBackgroundProcess = false;
     if (restrictionPolicy.allowBackgroundProcessLimit(enableLimitBackgroundProcess)) {
         Log.w(TAG, "Limit on background process blocked.");
     } else {
         Log.w(TAG, "Failed to block limit on background process.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE:

This api always returns false when isBLEAllowed() returns false

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     // disable Bluetooth
     boolean result = restrictionPolicy.allowBluetooth(false);

     if (true == result) {
         // Bluetooth is disabled and cannot be enabled by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 // enable Bluetooth UI control
 try {
     boolean result = restrictionPolicy.allowBluetooth(true);
     if (true == result) {
         // Bluetooth UI control is enabled and user can change it.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean allow = false;
     if (restrictionPolicy.allowClipboardShare(allow)) {
         Log.w(TAG, "allowClipboardShare() success");
     } else {
         Log.w(TAG, "allowClipboardShare() failed");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     boolean allow = false;
     if (restrictionPolicy.allowClipboardShare(allow)) {
         Log.w(TAG, "allowClipboardShare() success");
     } else {
         Log.w(TAG, "allowClipboardShare() failed");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     // disallow Data Saving
     boolean result = restrictionPolicy.allowDataSaving(false);

     if (true == result) {
         // Data Saving is disabled and cannot be enabled by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 // enable Data Saver UI control
 try {
     boolean result = restrictionPolicy.allowDataSaving(true);
     if (true == result) {
         // Data Saver UI control is enabled and user can change it.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // disallow
 try {
  if (restrictionPolicy.allowDeveloperMode(false)) {
      // Developer Mode in Settings application is disallowed and cannot be
      // changed by user.
  } else {
      // failure to disallow
  }
  // allow
  if (restrictionPolicy.allowDeveloperMode(true)) {
      // user is allowed to set any Developer Mode option in Settings
      // application.
  } else {
      // failure to allow
  }
 } catch (SecurityException e) {
  Log.w(TAG, "SecurityException: " + e);
 }

 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean result = restrictionPolicy.allowFactoryReset(false);
     if (true == result) {
         // factory reset is disabled and cannot be enabled by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean allow = true; // enforce fast encryption mode only
     if (restrictionPolicy.allowFastEncryption(allow)) {
         Log.w(TAG, "Succeeded to set the policy");
     } else {
         Log.w(TAG, "Failed to set the policy.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     boolean allow = true; // enforce fast encryption mode only
     if (restrictionPolicy.allowFastEncryption(allow)) {
         Log.w(TAG, "Succeeded to set the policy");
     } else {
         Log.w(TAG, "Failed to set the policy.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean allow = false; // disallow firmware recovery
     if (restrictionPolicy.allowFirmwareRecovery(allow)) {
         Log.w(TAG, "firmware recovery is not allowed");
     } else {
         Log.w(TAG, "Failed to set the policy.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean allow = false; // disallow auto sync
     if (restrictionPolicy.allowGoogleAccountsAutoSync(allow)) {
         Log.w(TAG, "Auto sync for google accounts is not allowed");
     } else {
         Log.w(TAG, "Failed to set the policy.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     boolean allow = false; // disallow auto sync
     if (restrictionPolicy.allowGoogleAccountsAutoSync(allow)) {
         Log.w(TAG, "Auto sync for google accounts is not allowed");
     } else {
         Log.w(TAG, "Failed to set the policy.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableGoogleCrashReport = true;
     restrictionPolicy.allowGoogleCrashReport(enableGoogleCrashReport);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     boolean enableGoogleCrashReport = true;
     restrictionPolicy.allowGoogleCrashReport(enableGoogleCrashReport);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

An administrator can use this API to allow or disallow killing an activity when the user leaves it without user interaction. When disabled, the preference "Do not keep activities" in Developer Options of Settings application is unchecked, and the user cannot edit it. When enabled, the user can edit the preference.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableKillActivitiesOnLeave = false;
     if (restrictionPolicy.allowKillingActivitiesOnLeave(enableKillActivitiesOnLeave)) {
         Log.w(TAG, "Kill activities on leave blocked.");
     } else {
         Log.w(TAG, "Failed blocking kill activities on leave.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE:

Since Android 5.0, this functionality can't be verified from Settings application.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     // disallow multiple widgets on Lock screen.
     if (restrictionPolicy.allowLockScreenView(LOCKSCREEN_MULTIPLE_WIDGET_VIEW, false)) {
         Log.w(TAG, "Success.");
     } else {
         Log.w(TAG, "Failed.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE:

Since MDM 5.0, this API is supported on Verizon and Sprint North American devices too.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean blockOTAUpdate = true;
     // disable visible pattern
     restrictionPolicy.allowOTAUpgrade(blockOTAUpdate);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: Since MDM 5.3, only owner (User 0) administrator can call this API. For guest users, API will return false.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean result = restrictionPolicy.allowPowerOff(false);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException");
 }
 

NOTE: Since MDM 5.3, only COM (Kiosk) container administrator can call this API. For other container types, API will return false.

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     boolean result = restrictionPolicy.allowPowerOff(false);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException");
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     // disallow Power Saving Mode
     boolean result = restrictionPolicy.allowPowerSavingMode(false);

     if (true == result) {
         // Power Saving Mode disallowed and cannot be enabled by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableSBeam = false;
     if (restrictionPolicy.allowSBeam(enableSBeam)) {
         Log.d(TAG, "S Beam blocked.");
     } else {
         Log.d(TAG, "Failed blocking S Beam.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
 	boolean allow = false; // disallow SDCardMove
 	if (restrictionPolicy.allowSDCardMove(allow)) {
 		Log.w(TAG, "SDCardMove is not allowed");
 	} else {
 		Log.w(TAG, "Failed to set the policy.");
 	}
 } catch (SecurityException e) {
 	Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: Only Android users (Owner/Guest user) administrator can call this API. For container, API will return false.

NOTE:

Until knox api level 20, This policy is not applicable when the SD card is encrypted.

If SD card is encrypted, the files in the SD card cannot be read by other devices or PCs except for the device that encrypted it. Hence SD card encryption takes priority over this policy.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableSDCardWrite = true;
     restrictionPolicy.allowSDCardWrite(enableSDCardWrite);
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // disallow
 try {
     if (restrictionPolicy.allowSVoice(false)) {
         // S Voice application is disallowed and cannot be changed by user.
     } else {
         // failure to disallow
     }
     // allow
     if (restrictionPolicy.allowSVoice(true)) {
         // user is allowed to launch S Voice.
     } else {
         // failure to allow
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 // disallow
 try {
     if (restrictionPolicy.allowSVoice(false)) {
         // S Voice application is disallowed and cannot be changed by user.
     } else {
         // failure to disallow
     }
     // allow
     if (restrictionPolicy.allowSVoice(true)) {
         // user is allowed to launch S Voice.
     } else {
         // failure to allow
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     // Disallow Safe Mode boot
     restrictionPolicy.allowSafeMode(false);
 } catch (SecurityException e) {
     Log.e(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     // Administrator wishes to block Screen Pinning functionality
     restrictionPolicy.allowScreenPinning(false);
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     if (restrictionPolicy.allowSettingsChanges(false)) {
         // Settings application is disabled.
     } else {
         // Failure to restrict Settings app.
     }
     if (restrictionPolicy.allowSettingsChanges(true)) {
         // Settings application is enabled.
     } else {
         // Failure to remove restriction on Settings app.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: Since MDM 5.3, only Android users (Owner/Guest user) administrator can call this API. For container, API will return false.

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     if (restrictionPolicy.allowSettingsChanges(false)) {
         // Settings application is disabled.
     } else {
         // Failure to restrict Settings app.
     }
     if (restrictionPolicy.allowSettingsChanges(true)) {
         // Settings application is enabled.
     } else {
         // Failure to remove restriction on Settings app.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

Administrator can disable the display of the Share Via List, the Share Via List is displayed in certain applications that share data with other applications.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     if(restrictionPolicy.allowShareList(allowShareList)) {
        Log.w(TAG, "Share List display is disabled.");
     } else {
        Log.w(TAG, "Failed to disable Share List display.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     if(restrictionPolicy.allowShareList(allowShareList)) {
        Log.w(TAG, "Share List display is disabled.");
     } else {
        Log.w(TAG, "Failed to disable Share List display.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     // Administrator wishes to block smart clip functionality
     restrictionPolicy.allowSmartClipMode(false);
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     // Administrator wishes to block smart clip functionality.
     restrictionPolicy.allowSmartClipMode(false);
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

NOTE: Since MDM 5.3, only owner (User 0) administrator can call this API. For guest users, API will return false.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     if (restrictionPolicy.allowStatusBarExpansion(false)) {
         // status bar expansion is disabled and cannot be accessed by user.
     } else {
         // failure to enable
     }
     // enable
     if (restrictionPolicy.allowStatusBarExpansion(true)) {
         // status bar expansion is enabled.
     } else {
         // failure to disable
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: Since MDM 5.3, only COM (Kiosk) container administrator can call this API. For other container types, API will return false.

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     if (restrictionPolicy.allowStatusBarExpansion(false)) {
         // status bar expansion is disabled and cannot be accessed by user.
     } else {
         // failure to enable
     }
     // enable
     if (restrictionPolicy.allowStatusBarExpansion(true)) {
         // status bar expansion is enabled.
     } else {
         // failure to disable
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

An administrator can use this API to disable a force stop button for system-signed applications on the application Info UI in Settings and the stop button for the system application process on the Running application UI in Settings.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableSystemAppButtons = true;
     if (restrictionPolicy.allowStopSystemApp(enableSystemAppButtons)) {
         Log.w(TAG, "System application buttons are enabled for user.");
     } else {
         Log.w(TAG, "Failed to enable system application button.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     boolean enableSystemAppButtons = true;
     if (restrictionPolicy.allowStopSystemApp(enableSystemAppButtons)) {
         Log.w(TAG, "System application buttons are enabled for user.");
     } else {
         Log.w(TAG, "Failed to enable system application button.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     // disallow UWB
     boolean result = restrictionPolicy.allowUWB(false);

     if (true == result) {
         // UWB disallowed
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE:

Since MDM 5.7, This API will block All USB Host functionality.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();

 try {
     if (restrictionPolicy.allowUsbHostStorage(false)) {
         Log.d(TAG, "Usb host storage is now blocked.");
     } else {
         Log.d(TAG, "Failed to block USB host storage");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

An administrator can use this API to allow or disallow the user to set the mobile data limit. Even when disallowed user still be able to manipulate android "Warning" message.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableMobileDataLimit = false;
     if (restrictionPolicy.allowUserMobileDataLimit(enableMobileDataLimit)) {
         Log.d(TAG, "Successfully blocked user from setting mobile data limit.");
     } else {
         Log.d(TAG, "Failed to block user from setting mobile data limit.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

An administrator can use this API to enable or disable video recording without user interaction. Tne device camera is still available after disabling video recording so that user can take pictures and use video streaming. When video recording is disabled, any ongoing video recording is interrupted.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableVideoRecording = false;
     if (restrictionPolicy.allowVideoRecord(enableVideoRecording)) {
         Log.w(TAG, "Video recording blocked.");
     } else {
         Log.w(TAG, "Failed to block video recording.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     boolean enableVideoRecording = false;
     if (restrictionPolicy.allowVideoRecord(enableVideoRecording)) {
         Log.w(TAG, "Video recording blocked.");
     } else {
         Log.w(TAG, "Failed to block video recording.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean result = restrictionPolicy.allowVpn(false);
     if (true == result) {
         // Native VPN functionality is disabled and cannot be enabled by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     if (restrictionPolicy.allowWallpaperChange(false)) {
         // Wallpaper change is disabled and cannot be changed by user.
     } else {
         // failure to enable
     }
     // enable
     if (restrictionPolicy.allowWallpaperChange(true)) {
         // user allowed to change wallpaper.
     } else {
         // failure to disable
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE: Since MDM 5.3, only Android users (Owner/Guest user) administrator can call this API. For container, API will return false.

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 try {
     if (restrictionPolicy.allowWallpaperChange(false)) {
         // Wallpaper change is disabled and cannot be changed by user.
     } else {
         // failure to enable
     }
     // enable
     if (restrictionPolicy.allowWallpaperChange(true)) {
         // user allowed to change wallpaper.
     } else {
         // failure to disable
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // disable wi-fi UI control
 try {

     boolean result = restrictionPolicy.allowWiFi(false);
     if (true == result) {
         // Wi-Fi is disabled and cannot be enabled by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 // enable Wi-Fi UI control
 try {

     boolean result = restrictionPolicy.allowWiFi(true);
     if (true == result) {
         // Wi-Fi UI control is enabled and user can change settings.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

An administrator can enable or disable Wi-Fi Direct without user interaction. When Wi-Fi Direct is disabled, any ongoing Wi-Fi Direct connection is interrupted, and the user cannot turn on Wi-Fi Direct. S-Beam feature which depend on this policy will also be affected by this setting.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean enableWifiDirect = false;
     if (restrictionPolicy.allowWifiDirect(enableWifiDirect)) {
         Log.w(TAG, "Wi-Fi Direct blocked.");
     } else {
         Log.w(TAG, "Failed to block Wi-Fi Direct.");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // enable wearable policy for Gear device.
 try {
     boolean result = restrictionPolicy.enableWearablePolicy(RestrictionPolicy.WEARABLE_GEAR_DEVICE, true);
     if (true == result) {
         // wearable policy is enabled and Gear device will be managed by IT Policy.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // set final version that allows for updating
 try {
     String result = restrictionPolicy.getAllowedFOTAVersion();
     if (result == null) {
         // this policy not set by any admin
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 int usbExceptionMask = restrictionPolicy.getUsbExceptionList();
 

For a device managed by multiple administrators, Bluetooth tethering is disabled if at least one administrator has disabled it.

For a device managed by multiple administrators, cellular data is disabled if at least one administrator has disabled it.

For a device managed by multiple administrators, access to the clipboard is disabled if at least one administrator has disabled it.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 boolean result = false;
 try {
     // Check Data Saver is allowed
     result = restrictionPolicy.isDataSavingAllowed();
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

For a device managed by multiple administrators, enabling access for application installation is disabled if at least one administrator has disabled it.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 boolean result = false;
 try {
     // Check Power Saving Mode is allowed
     result = restrictionPolicy.isPowerSavingModeAllowed();
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 boolean result = true;
 try {
     // Administrator wants to check if Screen Pinning functionality
     // is allowed or not at user space
     result = restrictionPolicy.isScreenPinningAllowed();
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

For a device managed by multiple administrators, access to the SD card is disabled if at least one administrator has disabled it.

For a device managed by multiple administrators, a user cannot access settings if at least one administrator has disallowed it.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 boolean result = true;
 try {
     // Administrator wants to check if Smart Clip functionality
     // is allowed or not at user space
     result = restrictionPolicy.isSmartClipModeAllowed();
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 RestrictionPolicy restrictionPolicy = kcm.getRestrictionPolicy();
 boolean result = true;
 try {
     // Administrator wants to check if Smart Clip functionality
     // is allowed or not at user space
     result = restrictionPolicy.isSmartClipModeAllowed();
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

For a device managed by multiple administrators, all interfaces are disabled if at least one administrator has disabled each one.

For a device managed by multiple administrators, the UWB is disallowed if at least one administrator has disallowed it.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 boolean result = false;
 try {
     // Check UWB is allowed
     result = restrictionPolicy.isUWBAllowed();
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

For a device managed by multiple administrators, USB debugging is disabled if at least one administrator has disabled it.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();

 try {
     if (restrictionPolicy.isUsbHostStorageAllowed()) {
         Log.d(TAG, "USB host storage is allowed");
     } else {
         Log.w(TAG, "USB host storage is disallowed");
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

For a device managed by multiple administrators, MTP is disallowed if at least one administrator has disabled it.

For a device managed by multiple administrators, this method returns disabled if at least one administrator has disabled USB tethering.

*

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 boolean result = false;
 try {
     // Check whether wearable policy is enabled or not
     result = restrictionPolicy.isWearablePolicyEnabled(RestrictionPolicy.WEARABLE_GEAR_DEVICE);
 } catch (RemoteException e) {
     Log.e(TAG, "Remote exception : " + e);
 }
 

For a device managed by multiple administrators, the Wi-Fi connection is disabled if at least one administrator has disabled it.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // disable
 try {
     if (restrictionPolicy.setAllowNonMarketApps(false)) {
         // Non-Google-Play application installation is disabled and cannot be enabled
         // by user.
     } else {
         // failure to enable UI access
     }
     // enable
     if (restrictionPolicy.setAllowNonMarketApps(true)) {
         // user allowed to change non-Google-Play application installation.
     } else {
         // failure to disable UI access
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // set final version that allows for updating
 try {
     Bundle bundle = new Bundle();
     String str_corpId = "MDM_ID/Customer_ID/Group_ID";
     bundle.putString(RestrictionPolicy.UPDATE_FOTA_CORPID, str_corpId);
     boolean result = restrictionPolicy.setAllowedFOTAVersion("G920FXXU3DPDO/G920FXXU3DPA1/G920FOXA3DPD2", bundle);
     if (true == result) {
         // IT admin will be received the result by intent
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

NOTE:

For Android 4.0 onward, disabling background data works only when a mobile data limit is set. When the policy is enabled, the mobile data limit is set to 100GB; the user cannot disable the mobile data limit but can change the actual limit.

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // disable
 try {
     boolean result = restrictionPolicy.setBackgroundData(false);
     if (true == result) {
         // background data transfer is disabled and cannot be enabled
         // by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 // enable
 try {
     boolean result = restrictionPolicy.setBackgroundData(true);
     if (true == result) {
         // background data UI control is enabled and user can change it
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 try {
     boolean result = restrictionPolicy.setBackup(false);
     if (true == result) {
         // Data backup is disabled and cannot be enabled by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 RestrictionPolicy restrictionPolicy = edm.getRestrictionPolicy();
 // disable
 try {
     boolean result = restrictionPolicy.setBluetoothTethering(false);
     if (true == result) {
         // UI access to Bluetooth tethering is disabled and cannot be enabled by user.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 // enable
 try {
     boolean result = restrictionPolicy.setBluetoothTethering(true);
     if (true == result) {
         // Bluetooth tethering UI control is enabled.
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }