Security

74 Topics

Is there any way to disable Google Play Protect (GPP) from an EMM or to otherwise whitelist apps from scanning?
I am very concerned about the Enhanced GPP features coming soon that are currently being piloted in other regions. https://security.googleblog.com/2023/10/enhanced-google-play-protect-real-time.html This is not a welcome feature whatsoever for the fully managed space where we have business apps written internally that are being installed on business devices, owned by that business. In no way do we want Google sitting in between deciding whether a very legitimate app written internally for an organization should be installed on devices that are purchased and owned by the same organization on fully managed devices. I would like a way to disable GPP completely, or at a minimum whitelist applications from scanning as we don't want Google interfering in the business operations. GPP is a helpful consumer protection features but fully managed devices should have the ability to be opted in or out of the program. Otherwise GPP can incorrectly flag a mission critical app and disable or remove it from a device, thereby bringing down a line-of-business application and an end customers operations. While the intentions of GPP are good, by blocking business apps Google themselves is becoming the malicious actor that GPP is ironically trying. to prevent.
Solved
mattdermody
2 years ago Place General discussions
41KViews
17likes
58Comments
Master ownership of Android devices
Factory Reset Protection / persistence is a powerful tool but it does not yet feel complete, and it is quite frustrating and potentially dangerous in its current state. It is not always apparent whether any given device is persistently linked using ZeroTouch, Intune or even Google Account FRP. While these tools are available to some, they are not a financially viable option for everyone, especially for consumers. There may be documentation describing the intimate intricacies of how all of these tools work and when/where they leave signs of their presence, but I cannot find it. I have not found a PSA from google for consumers saying "if you buy a second hand phone, check x, y and z to make sure it is not locked, otherwise someone can potentially remotely brick it." As a small company we have various scenarios where we provide phones to employees and also distribute loan/event devices for other small-medium companies, and don't necessarily have the ability to invest in enterprise-grade tools like ZT, InTune or Android Enterprise. If you think, on Windows all you need is to set the BIOS password and the Admin password and User Account Control takes care of the rest. Now take the android example, you add a google account and think it's safe with the user not knowing the password, but there is nothing to stop the user from adding their own personal google account, removing yours (no password required), setting their own PIN, and turning a $1000 phone into a paperweight. If they can unlock the phone, they are the master owner. There did used to be a feature for Multi-User on android but I haven't seen it in a long time, and I think there were performance issues with it as they all had to be loaded at once. While I may be lacking understanding knowledge and making some assumptions, should a consumer really need to know exactly how Android Enterprise works in depth just to buy a second hand/"refurbished" phone? And I dare anyone to get into a device after it's been factory reset while attached to a personal google account with a PIN set without hacking tools. I know there have been exploits with Talkback in the past but it's been patched now, and again these are not lengths to which consumers should need to go. If I knew someone's pattern (most common security type and very hard to hide effectively), and had their phone for 2 minutes, I could turn it into a paperweight simply by adding a disposable google account, removing theirs, and setting a PIN. How are we supposed to protect against that as a small business?
Josh
3 years ago Place General discussions
14KViews
7likes
17Comments
Can you skip network connection in Android Enterprise Edition?
Hello community, We have Samsung XCover6 Pro Enterprise Edition sent to customer in May this year. (Android v.12) They have started the phone and then didn't enroll it. They have just started the phone and put it on the shelf and battery has died and now they have started the phone. There are two problems: 1. They can skip to connect to the Wi-Fi 2. Even if they connect to Wi-Fi the phone doesn't get enrolled, the enrollment phase never comes up, you can just continue to setup the normally If we remove the phone from Zero Touch Portal, hard wipe the device by connecting it to a PC and then upload it to ZTP and connect it to Wi-Fi. Then it starts with enrollment. So I wanted to test this myself. I took the exact same model of the phone Samsung XCover6 Pro Enterprise Edition from our shelf and started it and to my surprise I COULD NOT skip network connection. Now the only difference between the phone that I tested and the phone that we sent to the customer is that, we sent the phone to customer like 6 months ago. But my test phone purchased recently, like a month ago. I tested this with several different Enterprise phone models and got the exact same result! COULD NOT skip network connection. I had to connect to a network before continuing with the setup. This is exactly what I want because of the obvious reasons. So my questions: Isn't this policy / feature (that you MUST connect to a network) by default set to TRUE for all Android Enterprise? Or is it different based on Android version?
Solved
Arifn
3 years ago Place General discussions
7.7KViews
0likes
14Comments
Is my company monitoring traffic in my personal profile through mdm on my work profile?
I recently joined a new company, they're high on security. It's difficult to work with the company laptop remotely because once it goes to sleep(after about 2 mins of being idle) it disconnects from the internet and you need to log back in, connect to the wifi, connect to a VPN with your credentials, authorize the VPN via your phone and then click accept before you get internet access on the computer again. In other to reply emails and messages faster, I had to add a work profile, I installed the required apps, accepted polices etc. communications apps that connect to the company domains or work apps have to be funneled via a VPN (required installation by the company). So basically these apps don't work without the vpn. My main concern is that this VPN might be monitoring traffic in my personal profile although I have premium proton VPN installed, I don't feel entirely safe about it. I've checked online and the answers I've seen are generic. Any help here?
Peterstev
3 years ago Place General discussions
5.2KViews
1like
3Comments
Is there a way to force users to reset passcode without admin needing to give a temporary password.
Hi, We have a requirement to force few users to reset passcode. I have tried with https://developers.google.com/android/management/reference/rest/v1/enterprises.devices/issueCommand#CommandType and it works fine when we mention the new passcode. I am wondering if there is a way to force users to change passcode without us having to give and store temp passcodes for each user. I am aware that we can do this with password restrictions as part of policy https://developers.google.com/android/management/reference/rest/v1/PasswordRequirements, but is it possible with a one time issue command. Thank you
Solved
Prathik
3 years ago Place General discussions
5.2KViews
1like
8Comments
Work Profile Password Complexity affects Personal Space device password that unlocks the device : Intune
Hi, Personally owned devices with a work profile running on Android 12 and above devices today, we are over controlling their personal space by demanding complex password setup. there are two passwords affected by this Password complexity setting in Intune : The device password that unlocks the device The work profile password that allows users to access the work profile Even we choose medium complexity, user are getting a notification to change the device password to complex. this is not feasible for the BYOD scenario. Yes, i can understand security perspective avoid simple passcode, but policy shouldn't force for lengthy and complex passwords. how you configured this password complexity your environment ?.
govi
3 years ago Place General discussions
4.8KViews
1like
7Comments
Work profile on S25 Ultra
Just bought a Galaxy S25 Ultra a few weeks ago and unfortunately I'm not able to create a work profile with MS Intune. I've tried all workarounds that I found on Reddit and Samsung community (https://us.community.samsung.com/t5/Galaxy-S25/New-S25-Ultra-Unable-to-setup-work-profile-using-company-portal/td-p/3126410/page/29). I think that this can be related to some Android Enterprise support because I could not find any reference of the models when searching for it. Does anyone else are having issues when trying to create a work profile on S25 series?
gustavossilvas
10 months ago Place General discussions
4.4KViews
2likes
10Comments
Setting UntrustedAppsPolicy to DISALLOW_INSTALL does not prevent app installs
We have devices provisioned on an Android Enterprise policy where the AdvancedSecurityOverrides.UntrustedAppsPolicy is set to DISALLOW_INSTALL, but users are still able to download APKs via browser and install them. Is there another setting that someone is aware of that would prevent this behavior? Thanks all.
ekatz
2 years ago Place General discussions
3.7KViews
0likes
9Comments
Push pubsub not sending usage logs location event on lost mode
Hi, I am using an Android 12 device, company-owned and is fully managed. My enterprise is configured to receive "USAGE_LOGS" notifications and I enrolled the device with token parameter "allowPersonalUsage" set to "PERSONAL_USAGE_DISALLOWED". Also I enforced location mode with a policy. I can see the notification that command went through and device enters alert state as expected. Then, I move device in lost state by clicking "I found this device" and expecting location logs to appear. Nonetheless, no usage logs are coming from my push pubsub. Before I was using pull pubsub and actually was able to receive usage logs back then. Don't really know if it's related. Originally, I though that the problem is that I couldn't properly subscribe enterprise to receive USAGE LOGS but it seems that's not the case from my previous question. My previous question on Usage logs
bonnewu
2 years ago Place General discussions
3.6KViews
0likes
9Comments
Clarification on VPN Traffic Segregation in Android Work Profile
Hello everyone, I'd like to confirm whether Android imposes the restriction that a VPN running in the work profile can only handle traffic originating from within the work profile. Does this mean that traffic from the personal profile remains separate and is not routed through the VPN in the work profile? Thank you.
mayanknag1995
2 years ago Place General discussions
2.8KViews
0likes
1Comment