Release notes

November 2024

Android Management API

• We now prevent users from changing their email address during customers signup. We also introduced validation for admin_email when creating a signup URL.
• Various items of our documentation have been updated:
  • We updated the description for the addUserDisabled policy. For devices where managementMode is DEVICE_OWNER this field is ignored and the user is never allowed to add or remove users.
  • We updated the ExtensionConfig to clarify that exempt from battery restrictions applies to Android 11 and above.
  • We updated the description of the PermissionPolicy .
  • We clarified to how many applications a scope can be delegated in the DelegatedScope enum.

October 2024

Android Management API

• We updated the behavior of the CommonCriteriaMode policy.
  COMMON_CRITERIA_MODE_ENABLED will now enable cryptographic policy integrity check and additional network certificate validation. The result of the policy integrity check is set to PolicySignatureVerificationStatus if statusReportingSettings.commonCriteriaModeEnabled is set to true.
  There are no changes to the behaviour of the default value (COMMON_CRITERIA_MODE_UNSPECIFIED) or when explicitly disabling it with COMMON_CRITERIA_MODE_DISABLED.
• We updated the documentation for PERSONAL_USAGE_DISALLOWED_USERLESS to remind developers that this change is necessary before January 2025. If this change is omitted, users may encounter an "Authenticate with Google" prompt during enrollment, when their IT admin has this feature enabled.
  The complete timeline for this feature is published on the Android Enterprise partner portal: Feature Timeline: Improved sign-up flow, device enrollment, and on-device experiences.
• We updated the documentation for CrossProfileDataSharing to include details of simple data sharing via intents.

September 2024

Android Management API

The Android Management API now supports the following Android 15 features:

• For Android 15 and above a new policy has been added to control Wi-Fi roaming settings. IT Admins can use WifiRoamingPolicy to select the desired WifiRoamingMode. Supported on fully managed devices and work profiles on company-owned devices.

Android 15 release

Android Management API

The Android Management API now supports the following Android 15 features:

• Android 15 introduces a new policy to control Circle to Search. IT admins can use AssistContentPolicy to control this feature.
• Android 15 introduces a new policy to control Phishing Detection of apps. IT admins can use ContentProtectionPolicy to control whether the app is scanned by On Device Abuse Detection (ODAD) for phishing malware.
• Android 15 expands the support of screen brightness and screen timeout settings using the DisplaySettings policy to company-owned devices with a work profile. This setting was previously available only on fully managed devices.

August 2024

Android Management API

• On Android 13+, IT ​​Admins can now query the ICCID associated with the SIM card of the TelephonyInfo included in a NetworkInfo. This is supported on fully managed devices when the networkInfoEnabled field in statusReportingSettings is set to true.
• Various items of our documentation have been updated:
  • We updated the documentation for the Common Criteria Mode to clarify that it is only supported on company-owned devices running Android 11 or above.
  • We documented the optional field DefaultStatus in SigninDetail.

July 2024

Android Management API

• Various items of our documentation have been updated:
  • We removed the note in the documentation for enrollmentToket.create about not being able to retrieve the token content anymore as it is possible getting the enrollment token value using enrollmentTokens.get.
  • We clarified NonComplianceReason documentation.

June 2024

Android Management API

• IT admins can now control the screen brightness and screen timeout settings using the DisplaySettings policy. Supported on fully managed devices, on Android 9 and above.
• We've updated our documentation to explain that, even when using AUTO_UPDATE_HIGH_PRIORITY, updates to apps with larger deployments across Android's ecosystem can take up to 24h.
• We've updated the Android Management API SDK (AMAPI SDK) to explain the different use cases that this library (originally known as Extensibility SDK) now supports. The updated documentation covers:
  • How to integrate the library
  • Extension apps and local commands
  • DPC migration

  See AMAPI SDK release notes to know what is the latest version available.

May 2024

Android Management API

• The get and list methods for enrollmentTokens now return populated value, qrCode, and allowPersonalUsage fields.
• For fully managed devices, the AllowPersonalUsage setting now supports the PERSONAL_USAGE_DISALLOWED_USERLESS.
• On Android 11+ the new UserControlSettings policy allows to specify whether user control is permitted for a given app. UserControlSettings includes user actions like force-stopping and clearing app data.
• Version 1.1.5 of the AMAPI SDK is now available. Additional information is available on the release notes page.

  Note: We strongly recommend to always use the latest available version of the library to benefit from the available bug fixes and improvements.

April 2024

Android Management API

• On Android 13+, for company-owned devices, we added controls over which WiFi SSIDs devices can connect to. Using WifiSsidPolicy IT Admins can specify a list of SSIDs to be added to an allowlist ( WIFI_SSID_ALLOWLIST) or to a denylist ( WIFI_SSID_DENYLIST).
• For corporate-owned devices, we added hardware identifiers (IMEI, MEID, and serial number) to ProvisioningInfo that EMMs can now access during device setup using the sign-in URL.

March 2024

Android Management API

• We added additional controls over app installation using InstallConstraint, IT admins can restrict app installation based on specific criteria.
  By setting installPriority, IT admins can ensure that critical apps are installed first.
• On Android 10+, AMAPI supports configuring enterprise 192 bit networks in openNetworkConfiguration by passing Security value WPA3-Enterprise_192.
  On Android 13+, in the MinimumWifiSecurityLevel policy, we now support ENTERPRISE_BIT192_NETWORK_SECURITY, which can be used to ensure that devices do not connect to Wi-Fi networks below this security level.
• We have updated the UsbDataAccess setting so that the USB_DATA_ACCESS_UNSPECIFIED value defaults to DISALLOW_USB_FILE_TRANSFER.

February 2024

Android Management API

• On Android 9+, IT admins can now control whether printing is allowed using the printingPolicy field.
• For Android 14+, a new policy is added to control CredentialProvider apps. IT admins can use the credentialProviderPolicy field to control whether the app is allowed to act as a credential provider.
• A new policy is added to control Arm Memory Tagging Extension (MTE) on the device. The MtePolicy field is supported on fully managed devices and work profiles on company-owned devices with Android 14 and above.
• We have updated how AM API receives errors related to installs that are triggered by IT admins. As a result of this migration, the InstallationFailureReason field now also includes client errors (in addition to the server errors).
• For Android 12+, IT admins can use a key pair installed on the device for enterprise Wi-Fi authentication. See the new ClientCertKeyPairAlias field in Open Network Configuration (ONC) and our network configuration guide for more information.

January 2024

Android Management API

• Devices managed by your custom DPC can now be seamlessly migrated to use Android Management API.

December 2023

Android Management API

• Added MinimumWifiSecurityLevel to define the different minimum security levels required to connect to Wi-Fi networks. Supported on fully managed devices and work profiles on company-owned devices with Android 13 and above.

November 2023

Android Management API

• Android 12+ now supports passwordless enterprise Wi-Fi network configuration using Identity and Password fields in Open Network Configuration. This was already supported prior to Android 12.

  Note: On Android 12+, for Wi-Fi networks with EAP username/password authentication, if the user password is not provided and AutoConnect is set to true, the device might try to connect to the network with a randomly generated placeholder password. To avoid this when the user’s password is not provided, set AutoConnect to false.

• Local device events that occur in quick succession are batched and reported in a single Pub/Sub message to EMMs.

  Event type	Expected latency between on-device event and corresponding EMM notification1
  	Previous behavior	New behavior
  High priority keyed app states	Immediate, at most one report per minute	Immediate, at most one report per minute
  Standard priority keyed app states	Schedule-based	Within one minute
  Application-related events during provisioning, for apps with install states defined by the IT admin2	Integrated into other provisioning-related events	Within one minute on top of other related provisioning events
  Application-related events after provisioning, for apps with install states defined by the IT admin2	Schedule-based	Within 5 minutes
  Application-related events both during and after provisioning, for apps with install states defined by the employee3	Schedule-based	Within 60 minutes
  Other on-device app events	Schedule-based	Within 60 minutes

  ¹ Best effort targets based on controlled circumstances. Actual latency may vary according to a variety of device and environmental factors.
  ² InstallType of apps enforced in the policy: FORCE_INSTALLED, BLOCKED, REQUIRED_FOR_SETUP, PREINSTALLED and KIOSK.
  ³ InstallType of available apps: AVAILABLE, INSTALL_TYPE_UNSPECIFIED.

October 2023

Android Management API

• Apps launched as SetupAction can now cancel enrollment. This will reset a company-owned device or deletes the work profile on a personally-owned device.

Android 14 release

Android Management API

With the release of Android 14, the Android Management API now supports the following Android 14 features:

• Restricting work profile contacts access to system applications and personal apps specified in exemptionsToShowWorkContactsInPersonalProfile. Now access to work profile contacts can be enabled for all personal apps, select personal apps, or no personal apps.

  For convenience, the new SHOW_WORK_CONTACTS_IN_PERSONAL_PROFILE_DISALLOWED_EXCEPT_SYSTEM option in showWorkContactsInPersonalProfile ensures that the only personal apps to access work contacts are the device default Dialer, Messages, and Contacts apps. In this case, neither user-configured Dialer, Messages, and Contacts apps, nor any other system or user-installed personal apps, will be able to query work contacts.

• Disable use of the ultra wideband radio on the device. This can be achieved using the new deviceRadioState.ultraWidebandState policy.
• Block the use of cellular 2G, improving network security. This is offered through the new deviceRadioState.cellularTwoGState policy.
• Android 14 introduces customizable lock screen shortcuts.

  The lock screen features admin control, which includes camera, fingerprint unlock, face unlock, etc, has been extended to also disable lockscreen shortcuts using the new SHORTCUTS option.

September 2023

Android Management API

• Device and provisioning information can now be optionally retrieved during setup, allowing developers to create more targeted policies during setup or filter devices according to the supplied attributes. The sign-in url will now include a provisioningInfo parameter which can be exchanged for the corresponding device details using the new provisioningInfo get method.
• SigninDetails can now be distinguished from one another with a customizable tokenTag value.

August 2023

Android Management API

• Introduced Lost Mode for company-owned devices. Lost mode enables employers to remotely lock and secure a lost device and optionally to display a message on the device screen with contact information to facilitate asset recovery.
• Added support for certificate selection delegation which grants an app access to selection of KeyChain certificates on behalf of requesting apps. See DelegatedScope.CERT_SELECTION for more details.
• Added additional WiFi management policies:
  • configureWifi - Admins can now disable adding or configuring WiFi networks. wifiConfigDisabled is now deprecated.
  • wifiDirectSettings - This policy can be used to disable configuring WiFi direct.
  • tetheringSettings - This policy can be used to disable WiFi tethering or all forms of tethering. tetheringConfigDisabled is now deprecated.
  • wifiState - This policy can be used to force enable/disable WiFi in a user's device.
• Sharing of admin configured WiFi networks will be disabled from Android 13 and above

July 2023

Android Management API

• Added userFacingType field to ApplicationReport to signal whether an app is user facing.
• Added ONC_WIFI_INVALID_ENTERPRISE_CONFIG specific non-compliance reason.
  Non-compliance with reason INVALID_VALUE and specific reason ONC_WIFI_INVALID_ENTERPRISE_CONFIG is reported if enterprise Wi-Fi network does not have DomainSuffixMatch set.
• New Pub/Sub notification EnrollmentCompleteEvent added, as a type of UsageLogEvent that is published when the device finishes the enrollment.
• Added airplaneModeState in deviceRadioState to control the current state of airplane mode and whether the user can toggle it on or off. By default, the user is allowed to toggle airplane mode on or off. Supported on fully managed devices and work profiles on company-owned devices, on Android 9 and above.

June 2023

Android Management API

• Added support for the DomainSuffixMatch field in Open Network Configuration to configure enterprise WiFi networks for Android 6+. Enterprise WiFi configurations without DomainSuffixMatch are considered insecure and will be rejected by the platform.
• Added UsbDataAccess policy setting that allows admins to fully disable USB data transferring. usbFileTransferDisabled is now deprecated, please use UsbDataAccess.

December 2022

Android Management API

• Management capabilities over Work Profile Widgets have been improved with the addition of two new API fields: workProfileWidgets on the application level and workProfileWidgetsDefault on the device level. These allow greater control over whether an application running in the work profile can create widgets on the parent profile e.g. the home screen. This functionality is disallowed by default, but can be set to allowed using workProfileWidgets and workProfileWidgetsDefault, and is only supported for work profiles.
• We have added support to set MAC address randomization settings while configuring WiFi networks. Admins can now specify whether MACAddressRandomizationMode is set to Hardware or Automatic while configuring WiFi networks which takes effect on devices with OS version Android 13 and above and is applicable on all management modes. If set to Hardware the factory MAC address will be configured to the WiFi network, whereas Automatic the MAC address will be random.
• Various items of our documentation have been updated:
• Understanding Security Posture has been created to provide clarity on the potential responses from devicePosture and securityRisk evaluations.
• autoUpdateMode has been provided for autoUpdatePolicy as a recommended alternative due to greater flexibility with update frequency.
• We have provided clarification that BlockAction and WipeAction are restricted to company-owned devices.
• The Pub/Sub notifications page has been updated to accurately reflect the resource types for different notification types.
• For Android 13+, extension apps are exempt from battery restrictions so will not be placed into the restricted App Standby Bucket.

October 2022

Android Management API

• Various items of our documentation have been updated:
• We recommend having one policy per device, to enable granular device-level management capabilities.
• In order for FreezePeriods to work as expected, system update policy cannot be set as SYSTEM_UPDATE_TYPE_UNSPECIFIED.
• Additional suggestions have been provided for policy updates regarding visibility of password steps during company-owned device provisioning.
• shareLocationDisabled is supported for fully managed devices and personally owned work profiles.
• We have provided an updated description on the usage of enterprises.devices.delete and its effects on device visibility.
• Maximum enrollment token duration is now 10,000 years, where it was previously 90 days.

July 12 2022

Android Management API

• Added NETWORK_ACTIVITY_LOGS and SECURITY_LOGS values to the DelegatedScope to grant device policy applications access to the corresponding logs.

June 14 2022

Android Management API

• Added specificNonComplianceReason and specificNonComplianceContext to NonComplianceDetail to provide detailed context for policy application errors.

June 6 2022

Android Management API

• Added a command to allow the admin to remotely clear the application data of an app.
• Enrollment tokens can now be created with a longer duration than the previous maximum of 90 days, up to approximately 10,000 years. Enrollment tokens that last longer than 90 days will have a length of 24 characters, while tokens that last 90 days or less will continue to have 20 characters.

May 24 2022

Android Management API

• Hardware-backed security features such as key attestation will now be used in device integrity evaluations, when supported by the device. This provides a strong guarantee of system integrity. Devices that fail these evaluations or do not support such hardware-backed security features will report the new HARDWARE_BACKED_EVALUATION_FAILED SecurityRisk.

May 16 2022

Android Management API

• Added unifiedLockSettings in PasswordPolicies to allow the admin to configure if the work profile needs a separate lock.

March 25 2022

Android Management API

• Added alwaysOnVpnLockdownExemption to specify which apps should be exempt from the AlwaysOnVpnPackage setting.
• Added all available fields from the Play EMM API Products resource to the Application resource.

February 22 2022

Android Management API

• Added cameraAccess to control the use of camera and camera toggle, and microphoneAccess, to control the use of microphone and microphone toggle. These fields replace newly deprecated cameraDisabled and unmuteMicrophoneDisabled, respectively.

February 15 2022

AMAPI SDK

• Minor bug fixes. See Google's Maven Repository for more details.

November 15 2021

Android Device Policy

• Apps that are marked as unavailable in personalApplications will now be uninstalled from the personal profile of company-owned devices if already installed, as they are in the ApplicationPolicy for work profile and fully managed devices.

September 17 2021

Android Management API

• You can now designate an app as an extension app using ExtensionConfig. Extension apps can communicate directly with Android Device Policy and in future will be able to interact with the complete set of management features offered in the Android Management API, enabling a local interface for managing the device that does not require server connectivity.
  • This initial release includes support for local execution of Commands, and currently only the ClearAppData command. See the extensibility integration guide for more details.
  • The remaining commands will be added over time, as well as additional extension app features designed to expose the breadth of device management features to the extension app.

June 30 2021

Android Device Policy

• Minor bug fixes

June 2 2021

Android Device Policy

• Minor bug fixes

May 5 2021

Android Device Policy

• Minor bug fixes

April 6 2021

Android Device Policy

• Minor bug fixes

March 2021

Android Management API

• Added two new AdvancedSecurityOverrides. These policies enable Android Enterprise security best practices by default, while allowing organizations to override the default values for advanced use cases.
• googlePlayProtectVerifyApps enables Google Play's app verification by default.
• developerSettings prevents users from accessing developer options and safe mode by default, capabilities that would otherwise introduce risk of corporate data exfiltration.
• ChoosePrivateKeyRule now supports the direct grant of specific KeyChain keys to managed apps.
• This allows the target app(s) to access specified keys by calling getCertificateChain() and getPrivateKey() without having to first call choosePrivateKeyAlias().
• Android Management API defaults to granting direct access to the keys specified in policy, but otherwise falls back to granting access after the specified app has called choosePrivateKeyAlias(). See ChoosePrivateKeyRule for more details.

Deprecations

• ensureVerifyAppsEnabled is now deprecated. Use the googlePlayProtectVerifyApps AdvancedSecurityOverrides instead.
• Existing API users (Google Cloud projects with Android Management API enabled as of April 15, 2021) can continue to use ensureVerifyAppsEnabled until October 2021, but are encouraged to migrate to AdvancedSecurityOverrides as soon as possible. In October ensureVerifyAppsEnabled will no longer function.
• debuggingFeaturesAllowed and safeBootDisabled are now deprecated. Use the developerSettings AdvancedSecurityOverrides instead.
• Existing API users (Google Cloud projects with Android Management API enabled as of April 15, 2021) can continue to use debuggingFeaturesAllowed and safeBootDisabled until October 2021, but are encouraged to use AdvancedSecurityOverrides as soon as possible. In October debuggingFeaturesAllowed and safeBootDisabled will no longer function.

February 2021

Android Management API

• Added personalApplications support for company-owned devices starting from Android 8. The feature is now supported on all company-owned devices with a work profile.
• Device phone number is now reported on Fully Managed Devices as part of the Device resource.

January 2021

Android Device Policy

• Minor bug fixes