In admin permission management, you can delegate other apps to set device control policies. The delegable policy list is as follows.
| Policy Name | API and Description |
|---|---|
| disallow_add_local_account | accountManager.disallowOsAccountAddition: Prohibits the device from creating local users without passing the accountId parameter. accountManager.isOsAccountAdditionDisallowed: Queries whether the device is prohibited from creating local users without passing the accountId parameter. |
| disallow_add_os_account_by_user | accountManager.disallowOsAccountAddition: Prohibits a specified user from adding accounts. The accountId parameter must be passed. accountManager.isOsAccountAdditionDisallowed: Queries whether a specified user is prohibited from adding accounts. The accountId parameter must be passed. |
| disallow_running_bundles | applicationManager.addDisallowedRunningBundlesSync: Adds apps to the disallowed running list. Apps added to the list are not allowed to run under the current/specified user. applicationManager.removeDisallowedRunningBundlesSync: Removes apps from the disallowed running list. applicationManager.getDisallowedRunningBundlesSync: Obtains the disallowed running list under the current/specified user. |
| manage_auto_start_apps | applicationManager.addAutoStartApps: Adds apps to the auto-start list. applicationManager.removeAutoStartApps: Removes apps from the auto-start list. applicationManager.getAutoStartApps: Queries the auto-start list. |
| allowed_bluetooth_devices | bluetoothManager.addAllowedBluetoothDevices: Adds devices to the allowed Bluetooth device list. bluetoothManager.removeAllowedBluetoothDevices: Removes devices from the allowed Bluetooth device list. bluetoothManager.getAllowedBluetoothDevices: Queries the allowed Bluetooth device list. |
| set_browser_policies | browser.setPolicySync: Sets browser sub-policies for a specified browser. browser.getPoliciesSync: Obtains the policies of a specified browser. |
| allowed_install_bundles | bundleManager.addAllowedInstallBundlesSync: Adds apps to the allowed install list. Apps added to the list are allowed to be installed under the current/specified user; otherwise, they are not allowed to be installed. bundleManager.removeAllowedInstallBundlesSync: Removes apps from the allowed install list. bundleManager.getAllowedInstallBundlesSync: Obtains the allowed install list under the current/specified user. |
| disallowed_install_bundles | bundleManager.addDisallowedInstallBundlesSync: Adds apps to the disallowed install list. Apps added to the list are not allowed to be installed under the current/specified user. bundleManager.removeDisallowedInstallBundlesSync: Removes apps from the disallowed install list. bundleManager.getDisallowedInstallBundlesSync: Obtains the disallowed install list under the current/specified user. |
| disallowed_uninstall_bundles | bundleManager.addDisallowedUninstallBundlesSync: Adds apps to the disallowed uninstall list. Apps added to the list are not allowed to be uninstalled under the current/specified user. bundleManager.removeDisallowedUninstallBundlesSync: Removes apps from the disallowed uninstall list. bundleManager.getDisallowedUninstallBundlesSync: Obtains the disallowed uninstall list under the current/specified user. |
| get_device_info | deviceInfo.getDeviceInfo: Obtains device information. |
| location_policy | locationManager.setLocationPolicy: Sets the location service management policy. locationManager.getLocationPolicy: Queries the location service policy. |
| disabled_network_interface | networkManager.setNetworkInterfaceDisabledSync: Prohibits the device from using a specified network. networkManager.isNetworkInterfaceDisabledSync: Queries whether a specified network interface is disabled. |
| global_proxy | networkManager.setGlobalProxySync: Sets the global network proxy. networkManager.getGlobalProxySync: Obtains the global network proxy. |
| disabled_bluetooth | restrictions.setDisallowedPolicy: Passes FeatureForDevice.BLUETOOTH to the feature parameter to disable/enable the Bluetooth capability. restrictions.getDisallowedPolicy: Passes FeatureForDevice.BLUETOOTH to the feature parameter to query whether the Bluetooth capability is disabled. |
| disallow_modify_datetime | restrictions.setDisallowedPolicy: Passes FeatureForDevice.MODIFY_DATE_TIME to the feature parameter to disable/enable the capability of setting the system time. restrictions.getDisallowedPolicy: Passes FeatureForDevice.MODIFY_DATE_TIME to the feature parameter to query whether the capability of modifying the system time is disabled. |
| disabled_printer | restrictions.setDisallowedPolicy: Passes FeatureForDevice.PRINTER to the feature parameter to disable/enable the printing capability. restrictions.getDisallowedPolicy: Passes FeatureForDevice.PRINTER to the feature parameter to query whether the printing capability is disabled. |
| disabled_hdc | restrictions.setDisallowedPolicy: Passes FeatureForDevice.HDC to the feature parameter to disable/enable the capability of being connected and debugged by other devices through HDC. restrictions.getDisallowedPolicy: Passes FeatureForDevice.HDC to the feature parameter to query whether the capability of being connected and debugged by other devices through HDC is disabled. |
| disable_microphone | restrictions.setDisallowedPolicy: Passes FeatureForDevice.MICROPHONE to the feature parameter to disable/enable the microphone capability. restrictions.getDisallowedPolicy: Passes FeatureForDevice.MICROPHONE to the feature parameter to query whether the microphone capability is disabled. |
| fingerprint_auth | restrictions.setDisallowedPolicy: Passes FeatureForDevice.FINGERPRINT to the feature parameter to disable/enable the fingerprint authentication capability. restrictions.getDisallowedPolicy: Passes FeatureForDevice.FINGERPRINT to the feature parameter to query whether the fingerprint authentication capability is disabled. restrictions.setDisallowedPolicyForAccount: Passes FeatureForDevice.FINGERPRINT to the feature parameter to disable/enable the fingerprint authentication capability of a specified user. restrictions.getDisallowedPolicyForAccount: Passes FeatureForDevice.FINGERPRINT to the feature parameter to query whether the fingerprint authentication capability of a specified user is disabled. |
| disable_usb | restrictions.setDisallowedPolicy: Passes FeatureForDevice.USB to the feature parameter to disable/enable the USB capability. restrictions.getDisallowedPolicy: Passes FeatureForDevice.USB to the feature parameter to query whether the USB capability is disabled. |
| disable_wifi | restrictions.setDisallowedPolicy: Passes FeatureForDevice.WIFI to the feature parameter to disable/enable the Wi-Fi capability. restrictions.getDisallowedPolicy: Passes FeatureForDevice.WIFI to the feature parameter to query whether the Wi-Fi capability is disabled. |
| disallowed_tethering | restrictions.setDisallowedPolicy: Passes FeatureForDevice.TETHERING to the feature parameter to disable/enable the network sharing capability. restrictions.getDisallowedPolicy: Passes FeatureForDevice.TETHERING to the feature parameter to query whether the network sharing capability is disabled. |
| inactive_user_freeze | restrictions.setDisallowedPolicy: Passes FeatureForDevice.INACTIVE_USER_FREEZE to the feature parameter to disable/enable the capability of running inactive users. restrictions.getDisallowedPolicy: Passes FeatureForDevice.INACTIVE_USER_FREEZE to the feature parameter to query whether the capability of running inactive users is disabled. |
| snapshot_skip | restrictions.addDisallowedListForAccount: Passes snapshotSkip to the feature parameter to add apps to the list of apps whose screen snapshot capability is disabled. restrictions.removeDisallowedListForAccount: Passes snapshotSkip to the feature parameter to remove apps from the list of apps whose screen snapshot capability is disabled. restrictions.getDisallowedListForAccount: Passes snapshotSkip to the feature parameter to query the list of apps whose screen snapshot capability is disabled. |
| password_policy | securityManager.setPasswordPolicy: Sets the device lock screen password policy. securityManager.getPasswordPolicy: Obtains the device lock screen password policy. |
| clipboard_policy | securityManager.setAppClipboardPolicy: Sets the device clipboard policy. securityManager.getAppClipboardPolicy: Obtains the device clipboard policy. |
| watermark_image_policy | securityManager.setWatermarkImage: Sets the watermark policy. Currently, this is supported only on PC/2in1 devices. securityManager.cancelWatermarkImage: Cancels the watermark policy. Currently, this is supported only on PC/2in1 devices. |
| ntp_server | systemManager.setNTPServer: Sets the NTP server policy. systemManager.getNTPServer: Obtains the NTP server information. |
| set_update_policy | systemManager.setOtaUpdatePolicy: Sets the update policy. systemManager.getOtaUpdatePolicy: Queries the update policy. |
| notify_upgrade_packages | systemManager.notifyUpdatePackages: Notifies the system of update package information. systemManager.getUpdateResult: Obtains the system update result. |
| allowed_usb_devices | usbManager.addAllowedUsbDevices: Adds devices to the allowed USB device list. usbManager.removeAllowedUsbDevices: Removes devices from the allowed USB device list. usbManager.getAllowedUsbDevices: Obtains the allowed USB device list. |
| usb_read_only | usbManager.setUsbStorageDeviceAccessPolicy: Sets the USB storage device access policy. usbManager.getUsbStorageDeviceAccessPolicy: Obtains the USB storage device access policy. |
| disallowed_usb_devices | usbManager.addDisallowedUsbDevices: Adds USB device types that are prohibited from use. usbManager.removeDisallowedUsbDevices: Removes USB device types that are prohibited from use. usbManager.getDisallowedUsbDevices: Obtains the USB device types that are prohibited from use. |
| disallowed_sms | restrictions.setDisallowedPolicy: Passes FeatureForDevice.SMS to the feature parameter to disable/enable the capability of receiving and sending SMS messages. Currently, this is supported only on phones and tablets. restrictions.getDisallowedPolicy: Passes FeatureForDevice.SMS to the feature parameter to query whether the capability of receiving and sending SMS messages is disabled. Currently, this is supported only on phones and tablets. |
| disallowed_mms | restrictions.setDisallowedPolicy: Passes FeatureForDevice.MMS to the feature parameter to disable/enable the capability of receiving and sending MMS messages. Currently, this is supported only on phones and tablets. restrictions.getDisallowedPolicy: Passes FeatureForDevice.MMS to the feature parameter to query whether the capability of receiving and sending MMS messages is disabled. Currently, this is supported only on phones and tablets. |
| disable_backup_and_restore | restrictions.setDisallowedPolicy: Passes FeatureForDevice.BACKUP_AND_RESTORE to the feature parameter to disable/enable the backup and restore capability. Currently, this is supported only on phones and tablets. restrictions.getDisallowedPolicy: Passes FeatureForDevice.BACKUP_AND_RESTORE to the feature parameter to query whether the backup and restore capability is disabled. Currently, this is supported only on phones and tablets. |
| installed_bundle_info_list | bundleManager.getInstalledBundleList: Obtains the list of installed apps under a specified user on the device. |
| clear_up_application_data | applicationManager.clearUpApplicationData: Clears all data generated by an app. |
| disallow_unmute_device | restrictions.setDisallowedPolicy: Passes FeatureForDevice.UNMUTE_DEVICE to the feature parameter to disable/enable the capability of playing media sound on the device. restrictions.getDisallowedPolicy: Passes FeatureForDevice.UNMUTE_DEVICE to the feature parameter to query whether the capability of playing media sound on the device is disabled. |
| disabled_hdc_remote | restrictions.setDisallowedPolicy: Passes FeatureForDevice.HDC_REMOTE to the feature parameter to disable/enable the capability of debugging other devices through HDC. restrictions.getDisallowedPolicy: Passes FeatureForDevice.HDC_REMOTE to the feature parameter to query whether the capability of debugging other devices through HDC is disabled. |
After the super device management app registers for policy change events, when MDM calls the APIs in the following policy change reporting list, the system notifies the super device management app under the current user.
| API Name | Example of parameters Returned in PolicyChangedEvent |
|---|---|
| setDomainAccountPolicy | {"domainAccountInfo":{"domain":"","accountName":"test"},"policy":{"authenticationValidityPeriod":300,"passwordValidityPeriod":420,"passwordExpirationNotification":60}} |
| setAllowedKioskApps | {"appIdentifiers":["6917****3569"]} |
| setPolicySync | {"appId":"com.example._/******5t5CoBM=","policyName":"InsecurePrivateNetworkRequestsAllowed","policyValue":"1"} |
| setValue | {"item":"screenOff","value":"30000"} |
| setHomeWallpaper | "" |
| setUnlockWallpaper | "" |
| setSwitchStatus | {"key":1,"value":0} |
| addFirewallRule | {"firewallRule":{"srcAddr":"192.168.1.1-192.168.22.66","destAddr":"10.1.1.1","srcPort":"8080","destPort":"8080","appUid":"9696","direction":1,"action":1,"protocol":2,"family": 1,"logType":0}} |
| removeFirewallRule | {"firewallRule":{"srcAddr":"192.168.1.1-192.168.22.66","destAddr":"10.1.1.1","srcPort":"8080","destPort":"8080","appUid":"9696","direction":1,"action":1,"protocol":2,"family": 1,"logType":0}} |
| addDomainFilterRule | {"domainFilterRule":{"domainName":"www.example.com","appUid":"9696","action":1,"direction":1,"family":1,"logType":0}} |
| removeDomainFilterRule | {"domainFilterRule":{"domainName":"www.example.com","appUid":"9696","action":1,"direction":1,"family":1,"logType":0}} |
| setGlobalProxySync | {"httpProxy":{"host":"192.168.xx.xxx","port":8080,"exclusionList":["192.168"]}} |
| setGlobalProxyForAccount | {"httpProxy":{"host":"192.168.xx.xx","port":8080,"exclusionList":["192.168"]},"accountId":100} |
| addApn | {"apnId":"3","apnName":"CTENT"} |
| deleteApn | {"apnId":"3","apnName":"CTENT"} |
| updateApn | {"apnInfo":{"apn":"CTENT","apnName":"CTENT","mcc":"460","mnc":"11"},"apnId":"1"} |
| setPreferredApn | {"apnId":"3","apnName":"CTENT"} |
| setEthernetConfig | {"networkInterface":"eth0"} |
| setPasswordPolicy | {"policy":{"complexityRegex":"^(?=.*[a-zA-Z])(?=.*\\d).{8},$","validityPeriod":1808309786000,"additionalDescription":"At least 8 characters, including digits and letters."}} |
| uninstallEnterpriseReSignatureCertificate | {"certificateAlias":"test.cer","accountId":100} |
| installEnterpriseReSignatureCertificate | {"certificateAlias":"test.cer","accountId":100} |
| setNTPServer | {"server":"ntpserver.com"} |
| setActivationLockDisabled | {"isAllowed":true} |
| setWifiProfileSync | {"profile":{"ssid":"guest-Wi-Fi","bssid":"AA:BB:CC:DD:EE:FF"}} |