Corporate device with work profile (COPE)
The work profile of a corporate Android device; the scope of a specific restriction depends on the OS and the owner’s rights.
The current template contains 18 parameters. This is the list of the form, not a guarantee of enforcement on every device. For each item below, the meaning of the selected value and the way to verify it are given.
Meaning of the toggles
For “Disallow/Disable” parameters, turning the toggle on sets the restriction. For “Enable verification”, turning it on sets an additional check. A cleared checkbox does not prove permission: other profiles or system rules may apply.
Conditions of application
Check the management channel (proprietary DPC or Android Enterprise), mode, OS version, and management rights. Minimum OS versions are not shown in the received form; the former help tables are not considered confirmation of compatibility with the current template. First use the preliminary check, then a test device.
COPE restrictions related to connectivity
This section groups the settings of this profile area. Each item defines a separate behavior; “Select all” changes all items of this block only.
Disable access to Wi-Fi settings
Restricts the user from changing Wi-Fi; it is not the same as disabling all network connections.
Verification: Check the availability of the Wi-Fi menu and the operation of a preconfigured network.
Disable access to mobile networks
Restricts work with the mobile network according to the meaning of the selected template; availability depends on management rights.
Verification: Check the mobile network menu and data transfer over the SIM, keeping a backup connection.
Disable Bluetooth features
Restricts the use of Bluetooth. It may affect a work headset, scanner, and other peripherals.
Verification: Check pairing and data transfer with the peripherals needed for the work scenario.
Disable access to Bluetooth settings
Blocks the user from changing Bluetooth parameters; differs from fully disabling Bluetooth.
Verification: Check the availability of the pairing menu and, separately, the operation of an already paired device.
Disable data transfer while roaming
Blocks mobile data transfer while roaming; it does not set a tariff and does not control payment to the carrier.
Verification: Check the restriction state and data transfer in an agreed roaming test.
Disable the ability to use the device as a hotspot
Prohibits using the device to share the network with other devices.
Verification: Check whether the mobile hotspot can be turned on; check ordinary client connection separately.
Disallow the ability to make outgoing calls
Prohibits outgoing calls within the available management rights. Do not use this as a promise to block emergency calls.
Verification: Check an ordinary outgoing call to an allowed test number.
Disallow sending and receiving SMS
Restricts sending and receiving SMS according to the template description. It may affect verification codes and work processes.
Verification: Check a test SMS and the availability of the required sign-in method.
Disallow enabling airplane mode
Prohibits the user from enabling airplane mode. It does not confirm constant network availability or that the device is powered on.
Verification: Check the airplane mode switch and the time of the last contact with MDM.
COPE restrictions related to the device
This section groups the settings of the device and its system functions. Each item defines a separate behavior; “Select all” changes all items of this block only.
Disable camera access
Restricts the use of the camera. For BYOD, the current template explicitly specifies the work profile and keeping the camera in the personal profile.
Verification: Check the camera in a work application and, for BYOD, separately in a personal application.
Disallow enabling the microphone
Restricts the use of the microphone within the available management scope. It may affect work calls and dictation.
Verification: Check audio recording and the work communication application.
Disable using external media
Restricts the use of external media. It is not the same as a general prohibition of USB transfer.
Verification: Check reading of an agreed external medium and, separately, USB exchange.
Disallow mounting external storage
Prohibits connecting external storage to the device file system.
Verification: Check whether a USB/SD drive appears in the file manager.
Disallow booting the device in safe mode and the debugging feature
Restricts safe boot and debugging according to the template description. Implementation depends on the OS and the manufacturer.
Verification: Check the availability of debugging; check safe boot in an agreed test on the specific model.
Disable the ability to take screenshots
Prohibits taking screenshots within the available management scope.
Verification: Check the system screenshot combination on the screen of a work application.
Disallow changing date, time and time zone
Prohibits the user from changing the date, time, and time zone. Correct time is important for TLS and events.
Verification: Check the availability of editing and the actual device time.
COPE restrictions related to applications
This section groups the settings of this profile area. Each item defines a separate behavior; “Select all” changes all items of this block only.
Allow app verification without consent
Enables application verification according to the template description. It is not proof of the absence of malware.
Verification: Check the system verification state and application installation events.
Disallow installing apps from unknown sources
Prohibits installation from unknown sources within the scope of the profile. Delivery of a managed application is a separate channel.
Verification: Check manual installation of an allowed test APK and, separately, installation through MDM.
Assignment and result
Create a configuration, run the preliminary check, and assign it to recipients. In the device card, check the assignment, contact, and application events. If there is no result, check the mode, channel, delivery, and compatibility; an “Active” entry in the configuration list does not by itself prove enforcement.