1## 3.9\. Device Administration
2
3Android includes features that allow security-aware applications to perform
4device administration functions at the system level, such as enforcing password
5policies or performing remote wipe, through the
6[Android Device Administration API](http://developer.android.com/guide/topics/admin/device-admin.html).
7
8If device implementations implement the full range of [device administration](
9http://developer.android.com/guide/topics/admin/device-admin.html)
10policies defined in the Android SDK documentation, they:
11
12*   [C-1-1] MUST declare `android.software.device_admin`.
13*   [C-1-2] MUST support device owner provisioning as described in
14    [section 3.9.1](#3_9_1_device_provisioning) and
15    [section 3.9.1.1](#3_9_1_1_device_owner_provisioning).
16
17### 3.9.1 Device Provisioning
18
19#### 3.9.1.1 Device owner provisioning
20
21If device implementations declare `android.software.device_admin`, they:
22
23*   [C-1-1] MUST support enrolling a Device Policy Client (DPC) as a
24    [Device Owner app](
25    http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#isDeviceOwnerApp%28java.lang.String%29)
26    as described below:
27    *   When the device implementation has no user data is configured yet, it:
28        *    [C-1-3] MUST report `true` for [`DevicePolicyManager.isProvisioningAllowed(ACTION_PROVISION_MANAGED_DEVICE)`](https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html\#isProvisioningAllowed\(java.lang.String\)).
29        *    [C-1-4] MUST enroll the DPC application as the Device Owner app in
30             response to the intent action [`android.app.action.PROVISION_MANAGED_DEVICE`](http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#ACTION_PROVISION_MANAGED_DEVICE).
31        *    [C-1-5] MUST enroll the DPC application as the Device Owner app if the
32             device declares Near-Field Communications (NFC) support via the feature
33             flag `android.hardware.nfc` and receives an NFC message containing a
34             record with MIME type [`MIME_TYPE_PROVISIONING_NFC`](https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#MIME_TYPE_PROVISIONING_NFC).
35    *   When the device implementation has user data, it:
36        *    [C-1-6] MUST report `false` for the [`DevicePolicyManager.isProvisioningAllowed(ACTION_PROVISION_MANAGED_DEVICE)`](https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html\#isProvisioningAllowed\(java.lang.String\)).
37        *    [C-1-7] MUST not enroll any DPC application as the Device Owner App
38             any more.
39*   [C-1-2] MUST require some affirmative action during the provisioning process
40to consent to the app being set as Device Owner. Consent can be via user action
41or by some programmatic means during provisioning but it MUST NOT be hard coded
42or prevent the use of other Device Owner apps.
43
44If device implementations declare `android.software.device_admin`, but also
45include a proprietary Device Owner management solution and provide a mechanism
46to promote an application configured in their solution as a "Device Owner
47equivalent" to the standard "Device Owner" as recognized by the standard Android
48[DevicePolicyManager](
49http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html)
50APIs, they:
51
52*    [C-2-1] MUST have a process in place to verify that the specific app
53     being promoted belongs to a legitimate enterprise device management
54     solution and it has been already configured in the proprietary solution
55     to have the rights equivalent as a "Device Owner".
56*    [C-2-2] MUST show the same AOSP Device Owner consent disclosure as the
57     flow initiated by [`android.app.action.PROVISION_MANAGED_DEVICE`](http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#ACTION_PROVISION_MANAGED_DEVICE)
58     prior to enrolling the DPC application as "Device Owner".
59*    MAY have user data on the device prior to enrolling the DPC application
60     as "Device Owner".
61
62#### 3.9.1.2 Managed profile provisioning
63
64If device implementations declare `android.software.managed_users`, they:
65
66*   [C-1-1] MUST implement the [APIs](http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#ACTION_PROVISION_MANAGED_PROFILE)
67allowing a Device Policy Controller (DPC) application to become the
68[owner of a new Managed Profile](http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#isProfileOwnerApp%28java.lang.String%29).
69
70*   [C-1-2] The managed profile provisioning process (the flow initiated by
71[android.app.action.PROVISION_MANAGED_PROFILE](
72http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#ACTION_PROVISION_MANAGED_PROFILE))
73users experience MUST align with the AOSP implementation.
74
75*   [C-1-3] MUST provide the following user affordances within the Settings to
76    indicate to the user when a particular system function has been disabled by
77    the Device Policy Controller (DPC):
78    *   A consistent icon or other user affordance (for example the upstream
79        AOSP info icon) to represent when a particular setting is restricted by
80        a Device Admin.
81    *   A short explanation message, as provided by the Device Admin via the
82        [`setShortSupportMessage`](
83        https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#setShortSupportMessage%28android.content.ComponentName, java.lang.CharSequence%29).
84    *   The DPC application’s icon.
85
86### 3.9.2 Managed Profile Support
87
88If device implementations declare `android.software.managed_users`, they:
89
90*   [C-1-1] MUST support managed profiles via the `android.app.admin.DevicePolicyManager`
91    APIs.
92*   [C-1-2] MUST allow one and only [one managed profile to be created](http://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#ACTION_PROVISION_MANAGED_PROFILE).
93*   [C-1-3] MUST use an icon badge (similar to the AOSP upstream work badge) to
94    represent the managed applications and widgets and other badged UI elements
95    like Recents & Notifications.
96*   [C-1-4] MUST display a notification icon (similar to the AOSP upstream work
97    badge) to indicate when user is within a managed profile application.
98*   [C-1-5] MUST display a toast indicating that the user is in the managed
99    profile if and when the device wakes up (ACTION_USER_PRESENT) and the
100    foreground application is within the managed profile.
101*   [C-1-6] Where a managed profile exists, MUST show a visual affordance in the
102    Intent 'Chooser' to allow the user to forward the intent from the managed
103    profile to the primary user or vice versa, if enabled by the Device Policy
104    Controller.
105*   [C-1-7] Where a managed profile exists, MUST expose the following user
106    affordances for both the primary user and the managed profile:
107    *   Separate accounting for battery, location, mobile data and storage usage
108        for the primary user and managed profile.
109    *   Independent management of VPN Applications installed within the primary
110        user or managed profile.
111    *   Independent management of applications installed within the primary user
112        or managed profile.
113    *   Independent management of accounts within the primary user or managed
114        profile.
115*   [C-1-8] MUST ensure the preinstalled dialer, contacts and messaging
116    applications can search for and look up caller information from the managed
117    profile (if one exists) alongside those from the primary profile, if the
118    Device Policy Controller permits it.
119*   [C-1-9] MUST ensure that it satisfies all the security requirements
120    applicable for a device with multiple users enabled
121    (see [section 9.5](#9_5_multi-user_support)), even though the managed profile
122    is not counted as another user in addition to the primary user.
123*   [C-1-10] MUST support the ability to specify a separate lock screen meeting
124    the following requirements to grant access to apps running in a managed
125    profile.
126    *   Device implementations MUST honor the
127        [`DevicePolicyManager.ACTION_SET_NEW_PASSWORD`](https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#ACTION_SET_NEW_PASSWORD)
128        intent and show an interface to configure a separate lock screen
129        credential for the managed profile.
130    *   The lock screen credentials of the managed profile MUST use the same
131        credential storage and management mechanisms as the parent profile,
132        as documented on the
133        [Android Open Source Project Site](http://source.android.com/security/authentication/index.html).
134    *   The DPC [password policies](https://developer.android.com/guide/topics/admin/device-admin.html#pwd)
135        MUST apply to only the managed profile's lock screen credentials unless
136        called upon the `DevicePolicyManager` instance returned by
137        <a href="https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#getParentProfileInstance%28android.content.ComponentName%29">getParentProfileInstance</a>.
138*   When contacts from the managed profile are displayed
139    in the preinstalled call log, in-call UI, in-progress and missed-call
140    notifications, contacts and messaging apps they SHOULD be badged with the
141    same badge used to indicate managed profile applications.
142
143### 3.9.3 Managed User Support
144
145If device implementations declare `android.software.managed_users`, they:
146
147*   [C-1-1] MUST provide a user affordance to logout from the current user and
148    switch back to the primary user in multiple-user session when
149    [`isLogoutEnabled`](
150    https://developer.android.com/reference/android/app/admin/DevicePolicyManager.html#isLogoutEnabled%28%29)
151    returns `true`. The user affordance MUST be accessible from the lockscreen
152    without unlocking the device.
153