Product documentation
XenMobile Server
View PDF

Android Enterprise app permissions

February 20, 2024
Contributed by: 
K K

You can configure how requests to Android Enterprise apps that are within work profiles handle what Google calls “dangerous” permissions. You control whether the user is prompted to grant or deny the permission request from the app. This feature applies to devices running Android 7.0 and later.

Google defines dangerous permissions as permissions that give the app access to data or resources that involve the user’s private information or can potentially affect the user’s stored data or the operation of other apps. For example, the ability to read the user’s contacts is a dangerous permission.

You can configure a global state that controls the behavior of all dangerous permission requests to Android Enterprise apps within work profiles. You can also control the behavior of the dangerous permission requests for individual permission groups, as defined by Google, for each app. These individual settings override the global state.

For information on how Google defines permission groups, see “Permission groups” in this Android developers guide.

By default, users are prompted to grant of deny dangerous permission requests.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Android Enterprise settings

Image of Device Policies configuration screen

  • Global State: Controls the behavior of all dangerous permission requests. In the list, click Prompt, Grant, or Deny.
    • Prompt: Users are prompted to grant or deny dangerous permission requests.
    • Grant: All dangerous permission requests are granted. The user is not prompted.
    • Deny: All dangerous permission requests are denied. The user is not prompted.

    Default is Prompt.

  • Set an individual behavior for each permission group, for each app. To configure the behavior for a permission group: Click Add. Under App, choose an app from the list. If you configure Android Enterprise system apps, click Add new and enter the application package name you enabled in the Restrictions device policy. Under Grant State, choose Prompt, Grant,, or Deny. This grant state overrides the global state.
    • Prompt: Users are prompted to grant or deny dangerous permission requests from this permission group for this app.

    • Grant: Dangerous permission requests from this permission group for this app are granted. The user is not prompted.

      Note:

      For the devices enrolled in the Profile Owner mode, Grant permission is not applicable for Camera, Location, Microphone, and Sensor if the device is running on Android 12 or later.

    • Deny: Dangerous permission requests from this permission group for this app are denied. The user is not prompted.

    Default is Prompt.

  • Click Save next to the app and grant state.
  • To add more apps for the permission group, click Add again and repeat these steps.
  • When you have finished setting grant states for all permission groups you want to, click Next.
Android Enterprise app permissions
February 20, 2024
Contributed by: 
K K
February 20, 2024
Contributed by: 
K K

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.