Fully managed device (COBO)

A corporate Android device with Device Owner.

The current template contains 29 parameters. This is the list of the form, not a guarantee of enforcement on every device. For each item below, the meaning of the selected value and the way to verify it are given.

Meaning of the toggles

For “Disallow/Disable” parameters, turning the toggle on sets the restriction. For “Enable verification”, turning it on sets an additional check. A cleared checkbox does not prove permission: other profiles or system rules may apply.

Conditions of application

Check the management channel (proprietary DPC or Android Enterprise), mode, OS version, and management rights. Minimum OS versions are not shown in the received form; the former help tables are not considered confirmation of compatibility with the current template. First use the preliminary check, then a test device.

COBO restrictions related to connectivity

This section groups the settings of this profile area. Each item defines a separate behavior; “Select all” changes all items of this block only.

Disables access to wireless LAN networks

Blocks access to the wireless network according to the meaning of the template. Do not confuse it with prohibiting changes to Wi-Fi settings.

Verification: After applying, check access to the work network; ensure in advance that there is another communication channel with MDM.

Disables Bluetooth on the device

Restricts the use of Bluetooth. It may affect a work headset, scanner, and other peripherals.

Verification: Check pairing and data transfer with the peripherals needed for the work scenario.

Disallows access to Bluetooth settings

Blocks the user from changing Bluetooth parameters; differs from fully disabling Bluetooth.

Verification: Check the availability of the pairing menu and, separately, the operation of an already paired device.

Disables access to mobile network settings

Prevents changing mobile network settings; this is a separate action from prohibiting data transfer while roaming.

Verification: Check the availability of the mobile network menu and that the work connection is preserved.

Disable the ability to use the device as a hotspot

Prohibits using the device to share the network with other devices.

Verification: Check whether the mobile hotspot can be turned on; check ordinary client connection separately.

Disallow making outgoing calls

Prohibits outgoing calls within the available management rights. Do not use this as a promise to block emergency calls.

Verification: Check an ordinary outgoing call to an allowed test number.

Disallow sending and receiving SMS

Restricts sending and receiving SMS according to the template description. It may affect verification codes and work processes.

Verification: Check a test SMS and the availability of the required sign-in method.

Disallow enabling airplane mode

Prohibits the user from enabling airplane mode. It does not confirm constant network availability or that the device is powered on.

Verification: Check the airplane mode switch and the time of the last contact with MDM.

Disables data exchange while roaming

Blocks mobile data transfer while roaming; it does not set a tariff and does not control payment to the carrier.

Verification: Check the restriction state and data transfer in an agreed roaming test.

Disallow resetting network settings on Android

Prohibits the user from resetting network settings. A full factory reset is regulated separately.

Verification: Check the availability of the network reset action in the system settings.

Disable VPN connection configuration

Prohibits VPN within the scope of the profile. It may conflict with the configuration of access to corporate resources.

Verification: Check launching the required VPN client and compatibility with the assigned VPN profile.

COBO restrictions related to the device

This section groups the settings of the device and its system functions. Each item defines a separate behavior; “Select all” changes all items of this block only.

Disables access to the device camera

Restricts the use of the camera. For BYOD, the current template explicitly specifies the work profile and keeping the camera in the personal profile.

Verification: Check the camera in a work application and, for BYOD, separately in a personal application.

Disable the built-in screen recording feature

Restricts built-in recording of screen content. The scope of protection depends on the management mode and profile.

Verification: Try the built-in recording of the work screen; do not consider this protection against external photo or video capture.

Disallow the user from adding, changing or removing user certificates and keys in the device keystore

Restricts user modification of the certificate and key store. Check MDM certificate delivery separately.

Verification: Check manual certificate import/removal and the operation of corporate trust.

Disallow using NFC to transfer data

Prohibits data transfer over NFC according to the meaning of the template; do not automatically extend this to all NFC scenarios.

Verification: Check the specific work method of NFC exchange used on the target model.

Disallow booting the device in safe mode and the debugging feature

Restricts safe boot and debugging according to the template description. Implementation depends on the OS and the manufacturer.

Verification: Check the availability of debugging; check safe boot in an agreed test on the specific model.

Disallows access to device location

Restricts access to geolocation. It may interfere with a separate coordinate collection configuration.

Verification: Check permissions and coordinate retrieval in the work scenario; the absence of coordinates does not prove that the device is outside the geozone.

Disallow enabling the microphone

Restricts the use of the microphone within the available management scope. It may affect work calls and dictation.

Verification: Check audio recording and the work communication application.

Disallow adding or removing accounts

Restricts the user from adding, changing, or removing accounts within the profile management scope.

Verification: Check the accounts menu and the operation of the already configured work account.

Disable using external media

Restricts the use of external media. It is not the same as a general prohibition of USB transfer.

Verification: Check reading of an agreed external medium and, separately, USB exchange.

Disallow mounting external storage

Prohibits connecting external storage to the device file system.

Verification: Check whether a USB/SD drive appears in the file manager.

Skip hints and onboarding on first device use

Skips the onboarding hints of first use; it does not enroll the device in MDM.

Verification: Check the initial setup screen on a prepared test device.

Disallow changing date, time and time zone

Prohibits the user from changing the date, time, and time zone. Correct time is important for TLS and events.

Verification: Check the availability of editing and the actual device time.

Disable USB data transfer

Restricts data transfer over USB. It should not be considered a prohibition of charging.

Verification: Check file transfer when connected to a test computer and that charging is preserved.

Disallow factory reset of the device

Blocks the user’s factory reset within the available management scope. It does not guarantee a ban on hardware recovery on all models.

Verification: Check the system reset menu; hardware methods require a separate manufacturer-specific test.

Disable the main sound

Restricts the main sound of the device according to the meaning of the template; different OS audio streams may behave differently.

Verification: Check work notifications, media, and the required audio signals.

Disallow printing

Prohibits printing; for BYOD, it explicitly restricts printing from the work profile.

Verification: Open the print action in a work application; check the personal profile separately.

COBO restrictions related to applications

This section groups the settings of this profile area. Each item defines a separate behavior; “Select all” changes all items of this block only.

Enable app verification features

Enables application verification available in the selected Android mode.

Verification: Check the system verification state and the installation event of a test application.

Disallow installing apps from unknown sources

Prohibits installation from unknown sources within the scope of the profile. Delivery of a managed application is a separate channel.

Verification: Check manual installation of an allowed test APK and, separately, installation through MDM.

Assignment and result

Create a configuration, run the preliminary check, and assign it to recipients. In the device card, check the assignment, contact, and application events. If there is no result, check the mode, channel, delivery, and compatibility; an “Active” entry in the configuration list does not by itself prove enforcement.