# Create a policy

[`policies`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies) (also
called a *policy*) are the core resource of the Android Management API. You use
them to create and save groups of device and app management settings for your
customers to apply to devices.

- To create or update a `policies` resource, call [`enterprises.policies.patch`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies/patch).
- To delete a `policies` resource, call [`enterprises.policies.delete`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies/delete).

## See example policies

We've created several examples of recommended policies for different device
setups and scenarios:

- [Devices with work profiles](https://developers.google.com/android/management/policies/work-profile)
- [Fully managed devices](https://developers.google.com/android/management/policies/fully-managed-devices)
- [Dedicated devices](https://developers.google.com/android/management/policies/dedicated-devices)
- [Network configurations](https://developers.google.com/android/management/configure-networks)

## Apply a policy to devices

A policy can be applied to one or more devices. However, a device can only have
a single policy at any given time.

A device should be associated with a policy during device enrollment. To do
this, include the `policyName` when [creating an enrollment
token](https://developers.google.com/android/management/provision-device#create_an_enrollment_token). After a
device is enrolled with the enrollment token, the `policies` resource linked to
the `policyName` is applied to the device or work profile, depending on the
[provisioning method](https://developers.google.com/android/management/provision-device#provisioning_methods)
used.

> [!IMPORTANT]
> **Key Point:** A `policies` resource not linked to any device or enrollment token for over seven days may be deleted automatically by the API.

Devices enrolled without a policy are blocked from all functions until a policy
is applied. **If a policy isn't applied within five minutes, then enrollment
will fail and the device will be factory reset.**

### Set a default policy for an enterprise

To prevent devices from being enrolled without a policy, you can define a single
default policy for an enterprise. To do this, set the `name` of a designated
default policy to `"default"`. This policy will then be applied to all newly
enrolled devices by default, unless another `policyName` is specified in the
device's enrollment token.

### Unspecified values

`_UNSPECIFIED` values are used to represent empty or unset policies. The
associated API documentation will outline the default behavior when the policy
is not explicitly set.

We generally avoid changing default behavior, except for example when required
for security reasons or to align with changes in Android platform. We will
provide advance notice to the EMM community when such a change is anticipated to
allow for EMMs and admins to adapt their policies accordingly.

As an example, see the `_UNSPECIFIED` enum value for
[`CrossProfileDataSharing`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#crossprofiledatasharing)
.

> [!IMPORTANT]
> **Important:** To ensure predictable results and minimize the need for future policy adjustments, we recommend EMMs and admins to explicitly define their policies whenever the required outcome is critical.

## Update or change a device's policy

To update a policy, call
[`enterprises.policies.patch`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies/patch)
.
When you update a `policies` resource, the update is enforced on all devices
associated with that policy.

To apply a different policy to the device, call
[`enterprises.devices.patch`](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices/patch)
.

**Note:** We recommend defining one policy per device to enable granular
device-level management capabilities. If there is no need for device-level
granularity, AM API supports having a single policy shared across several
devices. Automatic patch propagation will occur regardless of your choice to use
multiple or a single policy per device.