Android compliance policy criteria (user-owned devices with a work profile)

Device unrooted

Specify whether this setting is required for compliance evaluation.

Options are as follows:

If Required, any rooted devices will be evaluated as noncompliant.

Device at or under specific risk level

Select the maximum allowed risk level for devices evaluated by Mobile Security. Devices that are higher than the risk level get evaluated as noncompliant.

Data storage encrypted

Specify whether this setting is required for compliance evaluation.

If Required, any devices with data storage unencrypted get evaluated as noncompliant.

Block apps from unknown sources

Specify whether this setting is required for compliance evaluation.

If Required, any devices that turn off this permission get evaluated as noncompliant.

Developer mode disabled

Specify whether this setting is required for compliance evaluation.

If Required, any devices with developer mode enabled get evaluated as noncompliant.

USB debugging disabled

Specify whether this setting is required for compliance evaluation.

If Required, any devices with USB debugging enabled get evaluated as noncompliant.

Lock screen enabled

Specify whether this setting is required for compliance evaluation.

If Required, any devices without a lock screen enabled get evaluated as noncompliant.

Minimum OS version

Type an OS version.

Examples:

Minimum security patch level

Specify whether this setting is required for compliance evaluation, and select the oldest security patch level a device can have.

If Required and a security patch level is specified, any devices with an older security patch level get evaluated as noncompliant.

Password required to unlock device

Specify whether this setting is required for compliance evaluation.

If Required, any devices without a password get evaluated as noncompliant.

Password complexity

Select the minimum allowed password complexity for devices.

Devices that do not meet the password complexity requirements get evaluated as noncompliant. Your users must update the device password to meet the complexity requirements.

Number of days until password expires

Type a number from 1 to 365.

This setting is available only when Password complexity is required.

Number of passwords required before user can reuse an old one

Type a number from 1 to 24.

Maximum minutes of inactivity before password is required

Type a number from 1 to 480.

Number of days of no check-in until agent becomes inactive

Select a number from the drop-down list. The default value is 30. This means the Mobile Security for Business enters the inactive state when the agent has not check in with Mobile Security for 30 consecutive days.

Device access permissions

Specify whether this setting is required for compliance evaluation.

If Required, any devices that disable the specified permissions get evaluated as noncompliant.

Storage

Specify whether this setting is required for compliance evaluation.

If Required, any devices that disable the Storage permission get evaluated as noncompliant.

Location

Specify whether this setting is required for compliance evaluation.

If Required, any devices that disable the Location permission get evaluated as noncompliant.

Running in background

Specify whether this setting is required for compliance evaluation.

If Required, any devices that disable the Running in background permission get evaluated as noncompliant.

Notifications

Specify whether this setting is required for compliance evaluation.

If Required, any devices that disable the Notifications permission get evaluated as noncompliant.

VPN

Specify whether this setting is required for compliance evaluation.

If Required, any devices that disable the VPN permission get evaluated as noncompliant.