# MCP Tools Reference: Android Device Management MCP Server

## Tool: `get_policy`

Gets a policy for a given enterprise and policy ID. Requires the resource name in the format: enterprises/{enterpriseId}/policies/{policyId}.

The following sample demonstrate how to use `curl` to invoke the `get_policy` MCP tool.

| Curl Request |
|---|
| ```bash curl --location 'https://androidmanagement.googleapis.com/mcp' \ --header 'content-type: application/json' \ --header 'accept: application/json, text/event-stream' \ --data '{ "method": "tools/call", "params": { "name": "get_policy", "arguments": { // provide these details according to the tool's MCP specification } }, "jsonrpc": "2.0", "id": 1 }' ``` |

## Input Schema

Request to get a policy.

### GetPolicyRequest

| JSON representation |
|---|
| ``` { "name": string } ``` |

| Fields ||
|---|---|
| `name` | `string` The name of the policy in the form `enterprises/{enterpriseId}/policies/{policyId}`. |

## Output Schema

A policy resource represents a group of settings that govern the behavior of a managed device and the apps installed on it.

### Policy

| JSON representation |
|---|
| ``` { "name": string, "version": string, "applications": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApplicationPolicy`) } ], "maximumTimeToLock": string, "screenCaptureDisabled": boolean, "cameraDisabled": boolean, "keyguardDisabledFeatures": [ enum (`KeyguardDisabledFeature`) ], "defaultPermissionPolicy": enum (`PermissionPolicy`), "persistentPreferredActivities": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PersistentPreferredActivity`) } ], "openNetworkConfiguration": { object }, "systemUpdate": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.SystemUpdate`) }, "accountTypesWithManagementDisabled": [ string ], "addUserDisabled": boolean, "adjustVolumeDisabled": boolean, "factoryResetDisabled": boolean, "installAppsDisabled": boolean, "mountPhysicalMediaDisabled": boolean, "modifyAccountsDisabled": boolean, "safeBootDisabled": boolean, "uninstallAppsDisabled": boolean, "statusBarDisabled": boolean, "keyguardDisabled": boolean, "minimumApiLevel": integer, "statusReportingSettings": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.StatusReportingSettings`) }, "bluetoothContactSharingDisabled": boolean, "shortSupportMessage": { object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`) }, "longSupportMessage": { object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`) }, "passwordRequirements": { object (`https://developers.google.com/android/management/reference/mcp/get_device#Output.Schema.PasswordRequirements`) }, "wifiConfigsLockdownEnabled": boolean, "bluetoothConfigDisabled": boolean, "cellBroadcastsConfigDisabled": boolean, "credentialsConfigDisabled": boolean, "mobileNetworksConfigDisabled": boolean, "tetheringConfigDisabled": boolean, "vpnConfigDisabled": boolean, "wifiConfigDisabled": boolean, "createWindowsDisabled": boolean, "networkResetDisabled": boolean, "outgoingBeamDisabled": boolean, "outgoingCallsDisabled": boolean, "removeUserDisabled": boolean, "shareLocationDisabled": boolean, "smsDisabled": boolean, "unmuteMicrophoneDisabled": boolean, "usbFileTransferDisabled": boolean, "ensureVerifyAppsEnabled": boolean, "permittedInputMethods": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PackageNameList`) }, "stayOnPluggedModes": [ enum (`BatteryPluggedMode`) ], "recommendedGlobalProxy": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ProxyInfo`) }, "setUserIconDisabled": boolean, "setWallpaperDisabled": boolean, "choosePrivateKeyRules": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ChoosePrivateKeyRule`) } ], "alwaysOnVpnPackage": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.AlwaysOnVpnPackage`) }, "frpAdminEmails": [ string ], "deviceOwnerLockScreenInfo": { object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`) }, "dataRoamingDisabled": boolean, "locationMode": enum (`LocationMode`), "networkEscapeHatchEnabled": boolean, "bluetoothDisabled": boolean, "complianceRules": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ComplianceRule`) } ], "blockApplicationsEnabled": boolean, "installUnknownSourcesAllowed": boolean, "debuggingFeaturesAllowed": boolean, "funDisabled": boolean, "autoTimeRequired": boolean, "permittedAccessibilityServices": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PackageNameList`) }, "appAutoUpdatePolicy": enum (`AppAutoUpdatePolicy`), "kioskCustomLauncherEnabled": boolean, "androidDevicePolicyTracks": [ enum (`AppTrack`) ], "skipFirstUseHintsEnabled": boolean, "privateKeySelectionEnabled": boolean, "encryptionPolicy": enum (`EncryptionPolicy`), "usbMassStorageEnabled": boolean, "permissionGrants": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PermissionGrant`) } ], "playStoreMode": enum (`PlayStoreMode`), "setupActions": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.SetupAction`) } ], "passwordPolicies": [ { object (`https://developers.google.com/android/management/reference/mcp/get_device#Output.Schema.PasswordRequirements`) } ], "policyEnforcementRules": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PolicyEnforcementRule`) } ], "kioskCustomization": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.KioskCustomization`) }, "advancedSecurityOverrides": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.AdvancedSecurityOverrides`) }, "personalUsagePolicies": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PersonalUsagePolicies`) }, "autoDateAndTimeZone": enum (`AutoDateAndTimeZone`), "oncCertificateProviders": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.OncCertificateProvider`) } ], "crossProfilePolicies": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.CrossProfilePolicies`) }, "preferentialNetworkService": enum (`PreferentialNetworkService`), "usageLog": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.UsageLog`) }, "cameraAccess": enum (`CameraAccess`), "microphoneAccess": enum (`MicrophoneAccess`), "deviceConnectivityManagement": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DeviceConnectivityManagement`) }, "deviceRadioState": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DeviceRadioState`) }, "credentialProviderPolicyDefault": enum (`CredentialProviderPolicyDefault`), "printingPolicy": enum (`PrintingPolicy`), "displaySettings": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DisplaySettings`) }, "assistContentPolicy": enum (`AssistContentPolicy`), "workAccountSetupConfig": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WorkAccountSetupConfig`) }, "wipeDataFlags": [ enum (`WipeDataFlag`) ], "enterpriseDisplayNameVisibility": enum (`EnterpriseDisplayNameVisibility`), "appFunctions": enum (`AppFunctions`), "defaultApplicationSettings": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DefaultApplicationSetting`) } ] } ``` |

| Fields ||
|---|---|
| `name` | `string` The name of the policy in the form `enterprises/{enterpriseId}/policies/{policyId}`. |
| `version` | `string (https://developers.google.com/discovery/v1/type-format format)` The version of the policy. This is a read-only field. The version is incremented each time the policy is updated. |
| `applications[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApplicationPolicy`)`` Policy applied to apps. This can have at most 3,000 elements. |
| `maximumTimeToLock` | `string (https://developers.google.com/discovery/v1/type-format format)` Maximum time in milliseconds for user activity until the device locks. A value of 0 means there is no restriction. |
| `screenCaptureDisabled` | `boolean` Whether screen capture is disabled. |
| `cameraDisabled (deprecated)` | `boolean` > [!WARNING] > Use `` `cameraAccess` `` instead. If `` `camera_access` `` is set to any value other than `` `CAMERA_ACCESS_UNSPECIFIED` ``, this has no effect. Otherwise this field controls whether cameras are disabled: If true, all cameras are disabled, otherwise they are available. For fully managed devices this field applies for all apps on the device. For work profiles, this field applies only to apps in the work profile, and the camera access of apps outside the work profile is unaffected. |
| `keyguardDisabledFeatures[]` | ``enum (`KeyguardDisabledFeature`)`` Disabled keyguard customizations, such as widgets. |
| `defaultPermissionPolicy` | ``enum (`PermissionPolicy`)`` The default permission policy for runtime permission requests. |
| `persistentPreferredActivities[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PersistentPreferredActivity`)`` Default intent handler activities. |
| `openNetworkConfiguration` | ``object (`https://protobuf.dev/reference/protobuf/google.protobuf#struct` format)`` Network configuration for the device. See [configure networks](https://developers.google.com/android/management/configure-networks) for more information. |
| `systemUpdate` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.SystemUpdate`)`` The system update policy, which controls how OS updates are applied. If the update type is `WINDOWED`, the update window will automatically apply to Play app updates as well. **Note:** [Google Play system updates](https://source.android.com/docs/core/ota/modular-system) (also called Mainline updates) are automatically downloaded and require a device reboot to be installed. Refer to the mainline section in [Manage system updates](https://developer.android.com/work/dpc/system-updates#mainline) for further details. |
| `accountTypesWithManagementDisabled[]` | `string` Account types that can't be managed by the user. |
| `addUserDisabled` | `boolean` Whether adding new users and profiles is disabled. For devices where `` `managementMode` `` is `DEVICE_OWNER` this field is ignored and the user is never allowed to add or remove users. |
| `adjustVolumeDisabled` | `boolean` Whether adjusting the master volume is disabled. Also mutes the device. The setting has effect only on fully managed devices. |
| `factoryResetDisabled` | `boolean` Whether factory resetting from settings is disabled. |
| `installAppsDisabled` | `boolean` Whether user installation of apps is disabled. |
| `mountPhysicalMediaDisabled` | `boolean` Whether the user mounting physical external media is disabled. |
| `modifyAccountsDisabled` | `boolean` Whether adding or removing accounts is disabled. |
| `safeBootDisabled (deprecated)` | `boolean` > [!WARNING] > `safeBootDisabled` is deprecated. Please use `` `advancedSecurityOverrides.developerSettings` `` instead. Whether rebooting the device into safe boot is disabled. |
| `uninstallAppsDisabled` | `boolean` Whether user uninstallation of applications is disabled. This prevents apps from being uninstalled, even those removed using `` `applications` `` |
| `statusBarDisabled (deprecated)` | `boolean` > [!WARNING] > This item is deprecated! Whether the status bar is disabled. This disables notifications, quick settings, and other screen overlays that allow escape from full-screen mode. DEPRECATED. To disable the status bar on a kiosk device, use [InstallType](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#installtype) `KIOSK` or `kioskCustomLauncherEnabled`. |
| `keyguardDisabled` | `boolean` If true, this disables the [Lock Screen](https://source.android.com/docs/core/display/multi_display/lock-screen) for primary and/or secondary displays. This policy is supported only in dedicated device management mode. |
| `minimumApiLevel` | `integer` The minimum allowed Android API level. |
| `statusReportingSettings` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.StatusReportingSettings`)`` Status reporting settings |
| `bluetoothContactSharingDisabled` | `boolean` Whether bluetooth contact sharing is disabled. |
| `shortSupportMessage` | ``object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`)`` A message displayed to the user in the settings screen wherever functionality has been disabled by the admin. If the message is longer than 200 characters it may be truncated. |
| `longSupportMessage` | ``object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`)`` A message displayed to the user in the device administators settings screen. |
| `passwordRequirements (deprecated)` | ``object (`https://developers.google.com/android/management/reference/mcp/get_device#Output.Schema.PasswordRequirements`)`` > [!WARNING] > This item is deprecated! Password requirements. The field `password_requirements.require_password_unlock` must not be set. DEPRECATED - Use `` `passwordPolicies` ``. **Note:** Complexity-based values of `` `PasswordQuality` ``, that is, `COMPLEXITY_LOW`, `COMPLEXITY_MEDIUM`, and `COMPLEXITY_HIGH`, cannot be used here. `` `unified_lock_settings` `` cannot be used here. |
| `wifiConfigsLockdownEnabled (deprecated)` | `boolean` > [!WARNING] > Please use `` `deviceConnectivityManagement.configureWifi` `` instead. This is deprecated. |
| `bluetoothConfigDisabled` | `boolean` Whether configuring bluetooth is disabled. |
| `cellBroadcastsConfigDisabled` | `boolean` Whether configuring cell broadcast is disabled. |
| `credentialsConfigDisabled` | `boolean` Whether configuring user credentials is disabled. |
| `mobileNetworksConfigDisabled` | `boolean` Whether configuring mobile networks is disabled. |
| `tetheringConfigDisabled (deprecated)` | `boolean` > [!WARNING] > Please use `` `deviceConnectivityManagement.tetheringSettings` `` instead. Whether configuring tethering and portable hotspots is disabled. If `` `tetheringSettings` `` is set to anything other than `` `TETHERING_SETTINGS_UNSPECIFIED` ``, this setting is ignored. |
| `vpnConfigDisabled` | `boolean` Whether configuring VPN is disabled. |
| `wifiConfigDisabled (deprecated)` | `boolean` > [!WARNING] > Please use `` `deviceConnectivityManagement.configureWifi` `` instead. Whether configuring Wi-Fi networks is disabled. Supported on fully managed devices and work profiles on company-owned devices. For fully managed devices, setting this to true removes all configured networks and retains only the networks configured using `` `openNetworkConfiguration` ``. For work profiles on company-owned devices, existing configured networks are not affected and the user is not allowed to add, remove, or modify Wi-Fi networks. If `` `configureWifi` `` is set to anything other than `` `CONFIGURE_WIFI_UNSPECIFIED` ``, this setting is ignored. **Note:** If a network connection can't be made at boot time and configuring Wi-Fi is disabled then network escape hatch will be shown in order to refresh the device policy (see `` `networkEscapeHatchEnabled` ``). |
| `createWindowsDisabled` | `boolean` Whether creating windows besides app windows is disabled. |
| `networkResetDisabled` | `boolean` Whether resetting network settings is disabled. |
| `outgoingBeamDisabled` | `boolean` Whether using NFC to beam data from apps is disabled. |
| `outgoingCallsDisabled` | `boolean` Whether outgoing calls are disabled. |
| `removeUserDisabled` | `boolean` Whether removing other users is disabled. |
| `shareLocationDisabled` | `boolean` Whether location sharing is disabled. |
| `smsDisabled` | `boolean` Whether sending and receiving SMS messages is disabled. |
| `unmuteMicrophoneDisabled (deprecated)` | `boolean` > [!WARNING] > Use `` `microphoneAccess` `` instead. If `` `microphone_access` `` is set to any value other than `` `MICROPHONE_ACCESS_UNSPECIFIED` ``, this has no effect. Otherwise this field controls whether microphones are disabled: If true, all microphones are disabled, otherwise they are available. This is available only on fully managed devices. |
| `usbFileTransferDisabled (deprecated)` | `boolean` > [!WARNING] > `usbFileTransferDisabled` is deprecated. Please use `` `deviceConnectivityManagement.usbDataAccess` `` instead. Whether transferring files over USB is disabled. This is supported only on company-owned devices. |
| `ensureVerifyAppsEnabled (deprecated)` | `boolean` > [!WARNING] > `ensureVerifyAppsEnabled` is deprecated. Please use `` `advancedSecurityOverrides.googlePlayProtectVerifyApps` `` instead. Whether app verification is force-enabled. |
| `permittedInputMethods` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PackageNameList`)`` If present, only the input methods provided by packages in this list are permitted. If this field is present, but the list is empty, then only system input methods are permitted. |
| `stayOnPluggedModes[]` | ``enum (`BatteryPluggedMode`)`` The battery plugged in modes for which the device stays on. When using this setting, it is recommended to clear `maximum_time_to_lock` so that the device doesn't lock itself while it stays on. |
| `recommendedGlobalProxy` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ProxyInfo`)`` The network-independent global HTTP proxy. Typically proxies should be configured per-network in `open_network_configuration`. However for unusual configurations like general internal filtering a global HTTP proxy may be useful. If the proxy is not accessible, network access may break. The global proxy is only a recommendation and some apps may ignore it. |
| `setUserIconDisabled` | `boolean` Whether changing the user icon is disabled. This applies only on devices running Android 7 and above. |
| `setWallpaperDisabled` | `boolean` Whether changing the wallpaper is disabled. |
| `choosePrivateKeyRules[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ChoosePrivateKeyRule`)`` Rules for determining apps' access to private keys. See `https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ChoosePrivateKeyRule` for details. This must be empty if any application has `` `CERT_SELECTION` `` delegation scope. |
| `alwaysOnVpnPackage` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.AlwaysOnVpnPackage`)`` Configuration for an always-on VPN connection. Use with `vpn_config_disabled` to prevent modification of this setting. |
| `frpAdminEmails[]` | `string` Email addresses of device administrators for factory reset protection. When the device is factory reset, it will require one of these admins to log in with the Google account email and password to unlock the device. If no admins are specified, the device won't provide factory reset protection. |
| `deviceOwnerLockScreenInfo` | ``object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`)`` The device owner information to be shown on the lock screen. |
| `dataRoamingDisabled` | `boolean` Whether roaming data services are disabled. |
| `locationMode` | ``enum (`LocationMode`)`` The degree of location detection enabled. |
| `networkEscapeHatchEnabled` | `boolean` Whether the network escape hatch is enabled. If a network connection can't be made at boot time, the escape hatch prompts the user to temporarily connect to a network in order to refresh the device policy. After applying policy, the temporary network will be forgotten and the device will continue booting. This prevents being unable to connect to a network if there is no suitable network in the last policy and the device boots into an app in lock task mode, or the user is otherwise unable to reach device settings. **Note:** Setting `` `wifiConfigDisabled` `` to true will override this setting under specific circumstances. Please see `` `wifiConfigDisabled` `` for further details. Setting `` `configureWifi` `` to `` `DISALLOW_CONFIGURING_WIFI` `` will override this setting under specific circumstances. Please see `` `DISALLOW_CONFIGURING_WIFI` `` for further details. |
| `bluetoothDisabled` | `boolean` Whether bluetooth is disabled. Prefer this setting over `bluetooth_config_disabled` because `bluetooth_config_disabled` can be bypassed by the user. |
| `complianceRules[] (deprecated)` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ComplianceRule`)`` > [!WARNING] > This item is deprecated! Rules declaring which mitigating actions to take when a device is not compliant with its policy. When the conditions for multiple rules are satisfied, all of the mitigating actions for the rules are taken. There is a maximum limit of 100 rules. Use policy enforcement rules instead. |
| `blockApplicationsEnabled (deprecated)` | `boolean` > [!WARNING] > This item is deprecated! Whether applications other than the ones configured in `applications` are blocked from being installed. When set, applications that were installed under a previous policy but no longer appear in the policy are automatically uninstalled. |
| `installUnknownSourcesAllowed (deprecated)` | `boolean` > [!WARNING] > `installUnknownSourcesAllowed` is deprecated. This field has no effect - please use `advancedSecurityOverrides.untrustedAppsPolicy` instead. This field has no effect. |
| `debuggingFeaturesAllowed (deprecated)` | `boolean` > [!WARNING] > `debuggingFeaturesAllowed` is deprecated. Please use `` `advancedSecurityOverrides.developerSettings` `` instead. Whether the user is allowed to enable debugging features. |
| `funDisabled` | `boolean` Whether the user is allowed to have fun. Controls whether the Easter egg game in Settings is disabled. |
| `autoTimeRequired (deprecated)` | `boolean` > [!WARNING] > Use [`autoDateAndTimeZone`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#autodateandtimezone) instead. Whether auto time is required, which prevents the user from manually setting the date and time. If [`autoDateAndTimeZone`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#autodateandtimezone) is set, this field is ignored. |
| `permittedAccessibilityServices` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PackageNameList`)`` Specifies permitted accessibility services. If the field is not set, any accessibility service can be used. If the field is set, only the accessibility services in this list and the system's built-in accessibility service can be used. In particular, if the field is set to empty, only the system's built-in accessibility servicess can be used. This can be set on fully managed devices and on work profiles. When applied to a work profile, this affects both the personal profile and the work profile. |
| `appAutoUpdatePolicy` | ``enum (`AppAutoUpdatePolicy`)`` Recommended alternative: `` `autoUpdateMode` `` which is set per app, provides greater flexibility around update frequency. When `` `autoUpdateMode` `` is set to `` `AUTO_UPDATE_POSTPONED` `` or `` `AUTO_UPDATE_HIGH_PRIORITY` ``, this field has no effect. The app auto update policy, which controls when automatic app updates can be applied. |
| `kioskCustomLauncherEnabled` | `boolean` Whether the kiosk custom launcher is enabled. This replaces the home screen with a launcher that locks down the device to the apps installed via the `applications` setting. Apps appear on a single page in alphabetical order. Use [kioskCustomization](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#kioskcustomization) to further configure the kiosk device behavior. |
| `androidDevicePolicyTracks[] (deprecated)` | ``enum (`AppTrack`)`` > [!WARNING] > This setting is not supported. This setting is not supported. Any value is ignored. |
| `skipFirstUseHintsEnabled` | `boolean` Flag to skip hints on the first use. Enterprise admin can enable the system recommendation for apps to skip their user tutorial and other introductory hints on first start-up. |
| `privateKeySelectionEnabled` | `boolean` Allows showing UI on a device for a user to choose a private key alias if there are no matching rules in ChoosePrivateKeyRules. For devices below Android P, setting this may leave enterprise keys vulnerable. This value will have no effect if any application has `` `CERT_SELECTION` `` delegation scope. |
| `encryptionPolicy` | ``enum (`EncryptionPolicy`)`` Whether encryption is enabled |
| `usbMassStorageEnabled (deprecated)` | `boolean` > [!WARNING] > This item is deprecated! Whether USB storage is enabled. Deprecated. |
| `permissionGrants[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PermissionGrant`)`` Explicit permission or group grants or denials for all apps. These values override the `default_permission_policy`. |
| `playStoreMode` | ``enum (`PlayStoreMode`)`` This mode controls which apps are available to the user in the Play Store and the behavior on the device when apps are removed from the policy. |
| `setupActions[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.SetupAction`)`` Action to take during the setup process. At most one action may be specified. |
| `passwordPolicies[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_device#Output.Schema.PasswordRequirements`)`` Password requirement policies. Different policies can be set for work profile or fully managed devices by setting the `password_scope` field in the policy. |
| `policyEnforcementRules[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PolicyEnforcementRule`)`` Rules that define the behavior when a particular policy can not be applied on device |
| `kioskCustomization` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.KioskCustomization`)`` Settings controlling the behavior of a device in kiosk mode. To enable kiosk mode, set `kioskCustomLauncherEnabled` to `true` or specify an app in the policy with `installType` `KIOSK`. |
| `advancedSecurityOverrides` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.AdvancedSecurityOverrides`)`` Advanced security settings. In most cases, setting these is not needed. |
| `personalUsagePolicies` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PersonalUsagePolicies`)`` Policies managing personal usage on a company-owned device. |
| `autoDateAndTimeZone` | ``enum (`AutoDateAndTimeZone`)`` Whether auto date, time, and time zone are enabled on a company-owned device. If this is set, then [`autoTimeRequired`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#autoTimeRequired) is ignored. |
| `oncCertificateProviders[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.OncCertificateProvider`)`` This feature is not generally available. |
| `crossProfilePolicies` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.CrossProfilePolicies`)`` Cross-profile policies applied on the device. |
| `preferentialNetworkService` | ``enum (`PreferentialNetworkService`)`` Controls whether preferential network service is enabled on the work profile or on fully managed devices. For example, an organization may have an agreement with a carrier that all of the work data from its employees' devices will be sent via a network service dedicated for enterprise use. An example of a supported preferential network service is the enterprise slice on 5G networks. This policy has no effect if `https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PreferentialNetworkServiceSettings` or `` `ApplicationPolicy.preferentialNetworkId` `` is set on devices running Android 13 or above. |
| `usageLog` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.UsageLog`)`` Configuration of device activity logging. |
| `cameraAccess` | ``enum (`CameraAccess`)`` Controls the use of the camera and whether the user has access to the camera access toggle. |
| `microphoneAccess` | ``enum (`MicrophoneAccess`)`` Controls the use of the microphone and whether the user has access to the microphone access toggle. This applies only on fully managed devices. |
| `deviceConnectivityManagement` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DeviceConnectivityManagement`)`` Covers controls for device connectivity such as Wi-Fi, USB data access, keyboard/mouse connections, and more. |
| `deviceRadioState` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DeviceRadioState`)`` Covers controls for radio state such as Wi-Fi, bluetooth, and more. |
| `credentialProviderPolicyDefault` | ``enum (`CredentialProviderPolicyDefault`)`` Controls which apps are allowed to act as credential providers on Android 14 and above. These apps store credentials, see [this](https://developer.android.com/training/sign-in/passkeys) and [this](https://developer.android.com/reference/androidx/credentials/CredentialManager) for details. See also `` `credentialProviderPolicy` ``. |
| `printingPolicy` | ``enum (`PrintingPolicy`)`` Optional. Controls whether printing is allowed. This is supported on devices running Android 9 and above. . |
| `displaySettings` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DisplaySettings`)`` Optional. Controls for the display settings. |
| `assistContentPolicy` | ``enum (`AssistContentPolicy`)`` Optional. Controls whether [AssistContent](https://developer.android.com/reference/android/app/assist/AssistContent) is allowed to be sent to a privileged app such as an assistant app. AssistContent includes screenshots and information about an app, such as package name. This is supported on Android 15 and above. |
| `workAccountSetupConfig` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WorkAccountSetupConfig`)`` Optional. Controls the work account setup configuration, such as details of whether a Google authenticated account is required. |
| `wipeDataFlags[]` | ``enum (`WipeDataFlag`)`` Optional. Wipe flags to indicate what data is wiped when a device or profile wipe is triggered due to any reason (for example, non-compliance). This does not apply to the `` `enterprises.devices.delete` `` method. . This list must not have duplicates. |
| `enterpriseDisplayNameVisibility` | ``enum (`EnterpriseDisplayNameVisibility`)`` Optional. Controls whether the `` `enterpriseDisplayName` `` is visible on the device (e.g. lock screen message on company-owned devices). |
| `appFunctions` | ``enum (`AppFunctions`)`` Optional. Controls whether apps on the device for fully managed devices or in the work profile for devices with work profiles are allowed to expose app functions. |
| `defaultApplicationSettings[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DefaultApplicationSetting`)`` Optional. The default application setting for supported types. If the default application is successfully set for at least one app type on a profile, users are prevented from changing *any* default applications on that profile. Only one `https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DefaultApplicationSetting` is allowed for each `` `DefaultApplicationType` ``. See [Default application settings](https://developers.google.com/android/management/default-application-settings) guide for more details. |

### ApplicationPolicy

| JSON representation |
|---|
| ``` { "packageName": string, "installType": enum (`InstallType`), "lockTaskAllowed": boolean, "defaultPermissionPolicy": enum (`PermissionPolicy`), "permissionGrants": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PermissionGrant`) } ], "managedConfiguration": { object }, "disabled": boolean, "minimumVersionCode": integer, "delegatedScopes": [ enum (`DelegatedScope`) ], "managedConfigurationTemplate": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ManagedConfigurationTemplate`) }, "accessibleTrackIds": [ string ], "connectedWorkAndPersonalApp": enum (`ConnectedWorkAndPersonalApp`), "autoUpdateMode": enum (`AutoUpdateMode`), "extensionConfig": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ExtensionConfig`) }, "alwaysOnVpnLockdownExemption": enum (`AlwaysOnVpnLockdownExemption`), "workProfileWidgets": enum (`WorkProfileWidgets`), "credentialProviderPolicy": enum (`CredentialProviderPolicy`), "customAppConfig": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.CustomAppConfig`) }, "installConstraint": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.InstallConstraint`) } ], "installPriority": integer, "userControlSettings": enum (`UserControlSettings`), "preferentialNetworkId": enum (`PreferentialNetworkId`), "signingKeyCerts": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApplicationSigningKeyCert`) } ], "roles": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.Role`) } ] } ``` |

| Fields ||
|---|---|
| `packageName` | `string` The package name of the app. For example, `com.google.android.youtube` for the YouTube app. |
| `installType` | ``enum (`InstallType`)`` The type of installation to perform. |
| `lockTaskAllowed (deprecated)` | `boolean` > [!WARNING] > This item is deprecated! Whether the app is allowed to lock itself in full-screen mode. DEPRECATED. Use [InstallType](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#installtype) `KIOSK` or `kioskCustomLauncherEnabled` to configure a dedicated device. |
| `defaultPermissionPolicy` | ``enum (`PermissionPolicy`)`` The default policy for all permissions requested by the app. If specified, this overrides the policy-level `default_permission_policy` which applies to all apps. It does not override the `permission_grants` which applies to all apps. |
| `permissionGrants[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PermissionGrant`)`` Explicit permission grants or denials for the app. These values override the `default_permission_policy` and `permission_grants` which apply to all apps. |
| `managedConfiguration` | ``object (`https://protobuf.dev/reference/protobuf/google.protobuf#struct` format)`` Managed configuration applied to the app. The format for the configuration is dictated by the [`ManagedProperty`](https://developers.google.com/android/management/reference/rest/v1/enterprises.applications#ManagedProperty) values supported by the app. Each field name in the managed configuration must match the `key` field of the `ManagedProperty`. The field value must be compatible with the `type` of the `ManagedProperty`: |---|---| | *type* | *JSON value* | | `BOOL` | `true` or `false` | | `STRING` | string | | `INTEGER` | number | | `CHOICE` | string | | `MULTISELECT` | array of strings | | `HIDDEN` | string | | `BUNDLE_ARRAY` | array of objects | Note: string values cannot be longer than 65535 characters. <br /> |
| `disabled` | `boolean` Whether the app is disabled. When disabled, the app data is still preserved. |
| `minimumVersionCode` | `integer` The minimum version of the app that runs on the device. If set, the device attempts to update the app to at least this version code. If the app is not up-to-date, the device will contain a `NonComplianceDetail` with `non_compliance_reason` set to `APP_NOT_UPDATED`. The app must already be published to Google Play with a version code greater than or equal to this value. At most 20 apps may specify a minimum version code per policy. |
| `delegatedScopes[]` | ``enum (`DelegatedScope`)`` The scopes delegated to the app from Android Device Policy. These provide additional privileges for the applications they are applied to. |
| `managedConfigurationTemplate` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ManagedConfigurationTemplate`)`` The managed configurations template for the app, saved from the [managed configurations iframe](https://developers.google.com/android/management/managed-configurations-iframe). This field is ignored if managed_configuration is set. |
| `accessibleTrackIds[]` | `string` List of the app's track IDs that a device belonging to the enterprise can access. If the list contains multiple track IDs, devices receive the latest version among all accessible tracks. If the list contains no track IDs, devices only have access to the app's production track. More details about each track are available in [AppTrackInfo](https://developers.google.com/android/management/reference/rest/v1/enterprises.applications#apptrackinfo). |
| `connectedWorkAndPersonalApp` | ``enum (`ConnectedWorkAndPersonalApp`)`` Controls whether the app can communicate with itself across a device's work and personal profiles, subject to user consent. |
| `autoUpdateMode` | ``enum (`AutoUpdateMode`)`` Controls the auto-update mode for the app. |
| `extensionConfig (deprecated)` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ExtensionConfig`)`` > [!WARNING] > `extensionConfig` is deprecated - use `` `COMPANION_APP` `` role instead. Configuration to enable this app as an extension app, with the capability of interacting with Android Device Policy offline. This field can be set for at most one app. If there is any app with `` `COMPANION_APP` `` role, this field cannot be set. The signing key certificate fingerprint of the app on the device must match one of the entries in `` `ApplicationPolicy.signingKeyCerts` `` or `` `ExtensionConfig.signingKeyFingerprintsSha256` `` (deprecated) or the signing key certificate fingerprints obtained from Play Store for the app to be able to communicate with Android Device Policy. If the app is not on Play Store and if `` `ApplicationPolicy.signingKeyCerts` `` and `` `ExtensionConfig.signingKeyFingerprintsSha256` `` (deprecated) are not set, a `` `NonComplianceDetail` `` with `` `INVALID_VALUE` `` is reported. |
| `alwaysOnVpnLockdownExemption` | ``enum (`AlwaysOnVpnLockdownExemption`)`` Specifies whether the app is allowed networking when the VPN is not connected and `` `alwaysOnVpnPackage.lockdownEnabled` `` is enabled. If set to `VPN_LOCKDOWN_ENFORCED`, the app is not allowed networking, and if set to `VPN_LOCKDOWN_EXEMPTION`, the app is allowed networking. Only supported on devices running Android 10 and above. If this is not supported by the device, the device will contain a `NonComplianceDetail` with `non_compliance_reason` set to `API_LEVEL` and a fieldPath. If this is not applicable to the app, the device will contain a `NonComplianceDetail` with `non_compliance_reason` set to `UNSUPPORTED` and a fieldPath. The fieldPath is set to `applications[i].alwaysOnVpnLockdownExemption`, where `i` is the index of the package in the `applications` policy. |
| `workProfileWidgets` | ``enum (`WorkProfileWidgets`)`` Specifies whether the app installed in the work profile is allowed to add widgets to the home screen. |
| `credentialProviderPolicy` | ``enum (`CredentialProviderPolicy`)`` Optional. Whether the app is allowed to act as a credential provider on Android 14 and above. |
| `customAppConfig` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.CustomAppConfig`)`` Optional. Configuration for this custom app. `` `install_type` `` must be set to `` `CUSTOM` `` for this to be set. |
| `installConstraint[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.InstallConstraint`)`` Optional. The constraints for installing the app. You can specify a maximum of one `InstallConstraint`. Multiple constraints are rejected. |
| `installPriority` | `integer` Optional. Amongst apps with `` `installType` `` set to: - `FORCE_INSTALLED` - `PREINSTALLED` this controls the relative priority of installation. A value of 0 (default) means this app has no priority over other apps. For values between 1 and 10,000, a lower value means a higher priority. Values outside of the range 0 to 10,000 inclusive are rejected. |
| `userControlSettings` | ``enum (`UserControlSettings`)`` Optional. Specifies whether user control is permitted for the app. User control includes user actions like force-stopping and clearing app data. Certain types of apps have special treatment, see `` `USER_CONTROL_SETTINGS_UNSPECIFIED` `` and `` `USER_CONTROL_ALLOWED` `` for more details. |
| `preferentialNetworkId` | ``enum (`PreferentialNetworkId`)`` Optional. ID of the preferential network the application uses. There must be a configuration for the specified network ID in `` `preferentialNetworkServiceConfigs` ``. If set to `PREFERENTIAL_NETWORK_ID_UNSPECIFIED`, the application will use the default network ID specified in `` `defaultPreferentialNetworkId` ``. See the documentation of `defaultPreferentialNetworkId` for the list of apps excluded from this defaulting. This applies on both work profiles and fully managed devices on Android 13 and above. |
| `signingKeyCerts[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApplicationSigningKeyCert`)`` Optional. Signing key certificates of the app. This field is required in the following cases: - The app has `` `installType` `` set to `` `CUSTOM` `` (i.e. a custom app). - The app has `` `roles` `` set to a nonempty list and the app does not exist on the Play Store. - The app has `` `extensionConfig` `` set (i.e. an extension app) but `` `ExtensionConfig.signingKeyFingerprintsSha256` `` (deprecated) is not set and the app does not exist on the Play Store. If this field is not set for a custom app, the policy is rejected. If it is not set when required for a non-custom app, a `` `NonComplianceDetail` `` with `` `INVALID_VALUE` `` is reported. For other cases, this field is optional and the signing key certificates obtained from Play Store are used. See following policy settings to see how this field is used: - `` `choosePrivateKeyRules` `` - `` `ApplicationPolicy.InstallType.CUSTOM` `` - `` `ApplicationPolicy.extensionConfig` `` - `` `ApplicationPolicy.roles` `` |
| `roles[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.Role`)`` Optional. Roles the app has. Apps having certain roles can be exempted from power and background execution restrictions, suspension and hibernation on Android 14 and above. The user control can also be disallowed for apps with certain roles on Android 11 and above. Refer to the documentation of each `` `RoleType` `` for more details. The app is notified about the roles that are set for it if the app has a notification receiver service with `<meta-data android:name="com.google.android.managementapi.notification.NotificationReceiverService.SERVICE_APP_ROLES" android:value="" />`. The app is notified whenever its roles are updated or after the app is installed when it has nonempty list of roles. The app can use this notification to bootstrap itself after the installation. See [Integrate with the AMAPI SDK](https://developers.google.com/android/management/sdk-integration) and [Manage app roles](https://developers.google.com/android/management/app-roles) guides for more details on the requirements for the service. For the exemptions to be applied and the app to be notified about the roles, the signing key certificate fingerprint of the app on the device must match one of the signing key certificate fingerprints obtained from Play Store or one of the entries in `` `ApplicationPolicy.signingKeyCerts` ``. Otherwise, a `` `NonComplianceDetail` `` with `` `APP_SIGNING_CERT_MISMATCH` `` is reported. There must not be duplicate roles with the same `` `roleType` ``. Multiple apps cannot hold a role with the same `` `roleType` ``. A role with type `` `ROLE_TYPE_UNSPECIFIED` `` is not allowed. |

### PermissionGrant

| JSON representation |
|---|
| ``` { "permission": string, "policy": enum (`PermissionPolicy`) } ``` |

| Fields ||
|---|---|
| `permission` | `string` The Android permission or group, e.g. `android.permission.READ_CALENDAR` or `android.permission_group.CALENDAR`. |
| `policy` | ``enum (`PermissionPolicy`)`` The policy for granting the permission. |

### Struct

| JSON representation |
|---|
| ``` { "fields": { string: value, ... } } ``` |

| Fields ||
|---|---|
| `fields` | ``map (key: string, value: value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format))`` Unordered map of dynamically typed values. An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`. |

### FieldsEntry

| JSON representation |
|---|
| ``` { "key": string, "value": value } ``` |

| Fields ||
|---|---|
| `key` | `string` |
| `value` | ``value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format)`` |

### Value

| JSON representation |
|---|
| ``` { // Union field `kind` can be only one of the following: "nullValue": null, "numberValue": number, "stringValue": string, "boolValue": boolean, "structValue": { object }, "listValue": array // End of list of possible types for union field `kind`. } ``` |

| Fields ||
|---|---|
| Union field `kind`. The kind of value. `kind` can be only one of the following: ||
| `nullValue` | `null` Represents a null value. |
| `numberValue` | `number` Represents a double value. |
| `stringValue` | `string` Represents a string value. |
| `boolValue` | `boolean` Represents a boolean value. |
| `structValue` | ``object (`https://protobuf.dev/reference/protobuf/google.protobuf#struct` format)`` Represents a structured value. |
| `listValue` | ``array (`https://protobuf.dev/reference/protobuf/google.protobuf#list-value` format)`` Represents a repeated `Value`. |

### ListValue

| JSON representation |
|---|
| ``` { "values": [ value ] } ``` |

| Fields ||
|---|---|
| `values[]` | ``value (`https://protobuf.dev/reference/protobuf/google.protobuf#value` format)`` Repeated field of dynamically typed values. |

### ManagedConfigurationTemplate

| JSON representation |
|---|
| ``` { "templateId": string, "configurationVariables": { string: string, ... } } ``` |

| Fields ||
|---|---|
| `templateId` | `string` The ID of the managed configurations template. |
| `configurationVariables` | `map (key: string, value: string)` Optional, a map containing \<key, value\> configuration variables defined for the configuration. An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`. |

### ConfigurationVariablesEntry

| JSON representation |
|---|
| ``` { "key": string, "value": string } ``` |

| Fields ||
|---|---|
| `key` | `string` |
| `value` | `string` |

### ExtensionConfig

| JSON representation |
|---|
| ``` { "signingKeyFingerprintsSha256": [ string ], "notificationReceiver": string } ``` |

| Fields ||
|---|---|
| `signingKeyFingerprintsSha256[] (deprecated)` | `string` > [!WARNING] > `signingKeyFingerprintsSha256` is deprecated - use `` `ApplicationPolicy.signingKeyCerts` `` instead. If `` `ApplicationPolicy.signingKeyCerts` `` is set, this field must be empty or must contain the same signing key certificate fingerprints. Otherwise, the policy is rejected. Hex-encoded SHA-256 hashes of the signing key certificates of the extension app. Only hexadecimal string representations of 64 characters are valid. The signing key certificate fingerprints are always obtained from the Play Store and this field is used to provide additional signing key certificate fingerprints. However, if the application is not available on the Play Store, this field needs to be set. A `` `NonComplianceDetail` `` with `` `INVALID_VALUE` `` is reported if this field is not set when the application is not available on the Play Store. The signing key certificate fingerprint of the extension app on the device must match one of the signing key certificate fingerprints obtained from the Play Store or the ones provided in this field for the app to be able to communicate with Android Device Policy. In production use cases, it is recommended to leave this empty. |
| `notificationReceiver (deprecated)` | `string` > [!WARNING] > `notificationReceiver` is deprecated - use `` `COMPANION_APP` `` role instead. Fully qualified class name of the receiver service class for Android Device Policy to notify the extension app of any local command status updates. The service must be exported in the extension app's `AndroidManifest.xml` and extend [`NotificationReceiverService`](https://developers.google.com/android/management/reference/amapi/com/google/android/managementapi/notification/NotificationReceiverService) (see [Integrate with the AMAPI SDK](https://developers.google.com/android/management/sdk-integration) guide for more details). |

### CustomAppConfig

| JSON representation |
|---|
| ``` { "userUninstallSettings": enum (`UserUninstallSettings`) } ``` |

| Fields ||
|---|---|
| `userUninstallSettings` | ``enum (`UserUninstallSettings`)`` Optional. User uninstall settings of the custom app. |

### InstallConstraint

| JSON representation |
|---|
| ``` { "networkTypeConstraint": enum (`NetworkTypeConstraint`), "chargingConstraint": enum (`ChargingConstraint`), "deviceIdleConstraint": enum (`DeviceIdleConstraint`) } ``` |

| Fields ||
|---|---|
| `networkTypeConstraint` | ``enum (`NetworkTypeConstraint`)`` Optional. Network type constraint. |
| `chargingConstraint` | ``enum (`ChargingConstraint`)`` Optional. Charging constraint. |
| `deviceIdleConstraint` | ``enum (`DeviceIdleConstraint`)`` Optional. Device idle constraint. |

### ApplicationSigningKeyCert

| JSON representation |
|---|
| ``` { "signingKeyCertFingerprintSha256": string } ``` |

| Fields ||
|---|---|
| `signingKeyCertFingerprintSha256` | `string (https://developers.google.com/discovery/v1/type-format format)` Required. The SHA-256 hash value of the signing key certificate of the app. This must be a valid SHA-256 hash value, i.e. 32 bytes. Otherwise, the policy is rejected. A base64-encoded string. |

### Role

| JSON representation |
|---|
| ``` { "roleType": enum (`RoleType`) } ``` |

| Fields ||
|---|---|
| `roleType` | ``enum (`RoleType`)`` Required. The type of the role an app can have. |

### PersistentPreferredActivity

| JSON representation |
|---|
| ``` { "receiverActivity": string, "actions": [ string ], "categories": [ string ] } ``` |

| Fields ||
|---|---|
| `receiverActivity` | `string` The activity that should be the default intent handler. This should be an Android component name, e.g. `com.android.enterprise.app/.MainActivity`. Alternatively, the value may be the package name of an app, which causes Android Device Policy to choose an appropriate activity from the app to handle the intent. |
| `actions[]` | `string` The intent actions to match in the filter. If any actions are included in the filter, then an intent's action must be one of those values for it to match. If no actions are included, the intent action is ignored. |
| `categories[]` | `string` The intent categories to match in the filter. An intent includes the categories that it requires, all of which must be included in the filter in order to match. In other words, adding a category to the filter has no impact on matching unless that category is specified in the intent. |

### SystemUpdate

| JSON representation |
|---|
| ``` { "type": enum (`SystemUpdateType`), "startMinutes": integer, "endMinutes": integer, "allowedDaysWithoutUpdate": integer, "freezePeriods": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.FreezePeriod`) } ] } ``` |

| Fields ||
|---|---|
| `type` | ``enum (`SystemUpdateType`)`` The type of system update to configure. |
| `startMinutes` | `integer` If the type is `WINDOWED`, the start of the maintenance window, measured as the number of minutes after midnight in the device's local time. This value must be between 0 and 1439, inclusive. |
| `endMinutes` | `integer` If the type is `WINDOWED`, the end of the maintenance window, measured as the number of minutes after midnight in device's local time. This value must be between 0 and 1439, inclusive. If this value is less than `start_minutes`, then the maintenance window spans midnight. If the maintenance window specified is smaller than 30 minutes, the actual window is extended to 30 minutes beyond the start time. |
| `allowedDaysWithoutUpdate` | `integer` If this is greater than zero, then this is the number of days after a pending update becoming available that a device can remain compliant, without taking the update. Has no effect otherwise. |
| `freezePeriods[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.FreezePeriod`)`` An annually repeating time period in which over-the-air (OTA) system updates are postponed to freeze the OS version running on a device. To prevent freezing the device indefinitely, each freeze period must be separated by at least 60 days. |

### FreezePeriod

| JSON representation |
|---|
| ``` { "startDate": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.Date`) }, "endDate": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.Date`) } } ``` |

| Fields ||
|---|---|
| `startDate` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.Date`)`` The start date (inclusive) of the freeze period. Note: `day` and `month` must be set. `year` should not be set as it is not used. For example, `{"month": 1,"date": 30}`. |
| `endDate` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.Date`)`` The end date (inclusive) of the freeze period. Must be no later than 90 days from the start date. If the end date is earlier than the start date, the freeze period is considered wrapping year-end. Note: `day` and `month` must be set. `year` should not be set as it is not used. For example, `{"month": 1,"date": 30}`. |

### Date

| JSON representation |
|---|
| ``` { "year": integer, "month": integer, "day": integer } ``` |

| Fields ||
|---|---|
| `year` | `integer` Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year. |
| `month` | `integer` Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day. |
| `day` | `integer` Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant. |

### StatusReportingSettings

| JSON representation |
|---|
| ``` { "applicationReportsEnabled": boolean, "deviceSettingsEnabled": boolean, "softwareInfoEnabled": boolean, "memoryInfoEnabled": boolean, "networkInfoEnabled": boolean, "displayInfoEnabled": boolean, "powerManagementEventsEnabled": boolean, "hardwareStatusEnabled": boolean, "systemPropertiesEnabled": boolean, "applicationReportingSettings": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApplicationReportingSettings`) }, "commonCriteriaModeEnabled": boolean, "defaultApplicationInfoReportingEnabled": boolean } ``` |

| Fields ||
|---|---|
| `applicationReportsEnabled` | `boolean` Whether [app reports](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#applicationreport) are enabled. |
| `deviceSettingsEnabled` | `boolean` Whether [device settings](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#devicesettings) reporting is enabled. |
| `softwareInfoEnabled` | `boolean` Whether [software info](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#softwareinfo) reporting is enabled. |
| `memoryInfoEnabled` | `boolean` Whether [memory event](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#memoryevent) reporting is enabled. |
| `networkInfoEnabled` | `boolean` Whether [network info](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#networkinfo) reporting is enabled. |
| `displayInfoEnabled` | `boolean` Whether [displays](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#display) reporting is enabled. Report data is not available for personally owned devices with work profiles. |
| `powerManagementEventsEnabled` | `boolean` Whether [power management event](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#powermanagementevent) reporting is enabled. Report data is not available for personally owned devices with work profiles. |
| `hardwareStatusEnabled` | `boolean` Whether [hardware status](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#hardwarestatus) reporting is enabled. Report data is not available for personally owned devices with work profiles. |
| `systemPropertiesEnabled` | `boolean` Whether system properties reporting is enabled. |
| `applicationReportingSettings` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApplicationReportingSettings`)`` Application reporting settings. Only applicable if application_reports_enabled is true. |
| `commonCriteriaModeEnabled` | `boolean` Whether `Common Criteria Mode` reporting is enabled. This is supported only on company-owned devices. |
| `defaultApplicationInfoReportingEnabled` | `boolean` Optional. Whether `` `defaultApplicationInfo` `` reporting is enabled. |

### ApplicationReportingSettings

| JSON representation |
|---|
| ``` { "includeRemovedApps": boolean } ``` |

| Fields ||
|---|---|
| `includeRemovedApps` | `boolean` Whether removed apps are included in application reports. |

### UserFacingMessage

| JSON representation |
|---|
| ``` { "localizedMessages": { string: string, ... }, "defaultMessage": string } ``` |

| Fields ||
|---|---|
| `localizedMessages` | `map (key: string, value: string)` A map containing \<locale, message\> pairs, where locale is a well-formed [BCP 47 language](https://www.w3.org/International/articles/language-tags/) code, such as en-US, es-ES, or fr. An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`. |
| `defaultMessage` | `string` The default message displayed if no localized message is specified or the user's locale doesn't match with any of the localized messages. A default message must be provided if any localized messages are provided. |

### LocalizedMessagesEntry

| JSON representation |
|---|
| ``` { "key": string, "value": string } ``` |

| Fields ||
|---|---|
| `key` | `string` |
| `value` | `string` |

### PasswordRequirements

| JSON representation |
|---|
| ``` { "passwordMinimumLength": integer, "passwordMinimumLetters": integer, "passwordMinimumLowerCase": integer, "passwordMinimumNonLetter": integer, "passwordMinimumNumeric": integer, "passwordMinimumSymbols": integer, "passwordMinimumUpperCase": integer, "passwordQuality": enum (`PasswordQuality`), "passwordHistoryLength": integer, "maximumFailedPasswordsForWipe": integer, "passwordExpirationTimeout": string, "passwordScope": enum (`PasswordPolicyScope`), "requirePasswordUnlock": enum (`RequirePasswordUnlock`), "unifiedLockSettings": enum (`UnifiedLockSettings`) } ``` |

| Fields ||
|---|---|
| `passwordMinimumLength` | `integer` The minimum allowed password length. A value of 0 means there is no restriction. Only enforced when `password_quality` is `NUMERIC`, `NUMERIC_COMPLEX`, `ALPHABETIC`, `ALPHANUMERIC`, or `COMPLEX`. |
| `passwordMinimumLetters` | `integer` Minimum number of letters required in the password. Only enforced when `password_quality` is `COMPLEX`. |
| `passwordMinimumLowerCase` | `integer` Minimum number of lower case letters required in the password. Only enforced when `password_quality` is `COMPLEX`. |
| `passwordMinimumNonLetter` | `integer` Minimum number of non-letter characters (numerical digits or symbols) required in the password. Only enforced when `password_quality` is `COMPLEX`. |
| `passwordMinimumNumeric` | `integer` Minimum number of numerical digits required in the password. Only enforced when `password_quality` is `COMPLEX`. |
| `passwordMinimumSymbols` | `integer` Minimum number of symbols required in the password. Only enforced when `password_quality` is `COMPLEX`. |
| `passwordMinimumUpperCase` | `integer` Minimum number of upper case letters required in the password. Only enforced when `password_quality` is `COMPLEX`. |
| `passwordQuality` | ``enum (`PasswordQuality`)`` The required password quality. |
| `passwordHistoryLength` | `integer` The length of the password history. After setting this field, the user won't be able to enter a new password that is the same as any password in the history. A value of 0 means there is no restriction. |
| `maximumFailedPasswordsForWipe` | `integer` Number of incorrect device-unlock passwords that can be entered before a device is wiped. A value of 0 means there is no restriction. |
| `passwordExpirationTimeout` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#duration` format)`` Password expiration timeout. A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: `"3.5s"`. |
| `passwordScope` | ``enum (`PasswordPolicyScope`)`` The scope that the password requirement applies to. |
| `requirePasswordUnlock` | ``enum (`RequirePasswordUnlock`)`` The length of time after a device or work profile is unlocked using a strong form of authentication (password, PIN, pattern) that it can be unlocked using any other authentication method (e.g. fingerprint, trust agents, face). After the specified time period elapses, only strong forms of authentication can be used to unlock the device or work profile. |
| `unifiedLockSettings` | ``enum (`UnifiedLockSettings`)`` Controls whether a unified lock is allowed for the device and the work profile, on devices running Android 9 and above with a work profile. This can be set only if `` `password_scope` `` is set to `` `SCOPE_PROFILE` ``, the policy will be rejected otherwise. If user has not set a separate work lock and this field is set to `REQUIRE_SEPARATE_WORK_LOCK`, a `` `NonComplianceDetail` `` is reported with `` `nonComplianceReason` `` set to `USER_ACTION`. |

### Duration

| JSON representation |
|---|
| ``` { "seconds": string, "nanos": integer } ``` |

| Fields ||
|---|---|
| `seconds` | `string (https://developers.google.com/discovery/v1/type-format format)` Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min \* 60 min/hr \* 24 hr/day \* 365.25 days/year \* 10000 years |
| `nanos` | `integer` Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 `seconds` field and a positive or negative `nanos` field. For durations of one second or more, a non-zero value for the `nanos` field must be of the same sign as the `seconds` field. Must be from -999,999,999 to +999,999,999 inclusive. |

### PackageNameList

| JSON representation |
|---|
| ``` { "packageNames": [ string ] } ``` |

| Fields ||
|---|---|
| `packageNames[]` | `string` A list of package names. |

### ProxyInfo

| JSON representation |
|---|
| ``` { "host": string, "port": integer, "excludedHosts": [ string ], "pacUri": string } ``` |

| Fields ||
|---|---|
| `host` | `string` The host of the direct proxy. |
| `port` | `integer` The port of the direct proxy. |
| `excludedHosts[]` | `string` For a direct proxy, the hosts for which the proxy is bypassed. The host names may contain wildcards such as \*.example.com. |
| `pacUri` | `string` The URI of the PAC script used to configure the proxy. |

### ChoosePrivateKeyRule

| JSON representation |
|---|
| ``` { "urlPattern": string, "packageNames": [ string ], "privateKeyAlias": string } ``` |

| Fields ||
|---|---|
| `urlPattern` | `string` The URL pattern to match against the URL of the request. If not set or empty, it matches all URLs. This uses the regular expression syntax of `java.util.regex.Pattern`. |
| `packageNames[]` | `string` The package names to which this rule applies. The signing key certificate fingerprint of the app is verified against the signing key certificate fingerprints provided by Play Store and `` `ApplicationPolicy.signingKeyCerts` `` . If no package names are specified, then the alias is provided to all apps that call [`KeyChain.choosePrivateKeyAlias`](https://developer.android.com/reference/android/security/KeyChain#choosePrivateKeyAlias%28android.app.Activity,%20android.security.KeyChainAliasCallback,%20java.lang.String[],%20java.security.Principal[],%20java.lang.String,%20int,%20java.lang.String%29) or any overloads (but not without calling `KeyChain.choosePrivateKeyAlias`, even on Android 11 and above). Any app with the same Android UID as a package specified here will have access when they call `KeyChain.choosePrivateKeyAlias`. |
| `privateKeyAlias` | `string` The alias of the private key to be used. |

### AlwaysOnVpnPackage

| JSON representation |
|---|
| ``` { "packageName": string, "lockdownEnabled": boolean } ``` |

| Fields ||
|---|---|
| `packageName` | `string` The package name of the VPN app. |
| `lockdownEnabled` | `boolean` Disallows networking when the VPN is not connected. |

### ComplianceRule

| JSON representation |
|---|
| ``` { "disableApps": boolean, "packageNamesToDisable": [ string ], // Union field `condition` can be only one of the following: "nonComplianceDetailCondition": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.NonComplianceDetailCondition`) }, "apiLevelCondition": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApiLevelCondition`) } // End of list of possible types for union field `condition`. } ``` |

| Fields ||
|---|---|
| `disableApps` | `boolean` If set to true, the rule includes a mitigating action to disable apps so that the device is effectively disabled, but app data is preserved. If the device is running an app in locked task mode, the app will be closed and a UI showing the reason for non-compliance will be displayed. |
| `packageNamesToDisable[]` | `string` If set, the rule includes a mitigating action to disable apps specified in the list, but app data is preserved. |
| Union field `condition`. The condition, which when satisfied, triggers the mitigating actions defined in the rule. Exactly one of the conditions must be set. `condition` can be only one of the following: ||
| `nonComplianceDetailCondition` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.NonComplianceDetailCondition`)`` A condition which is satisfied if there exists *any* matching [`NonComplianceDetail`](https://developers.google.com/android/management/reference/rest/v1/enterprises.devices#NonComplianceDetail) for the device. |
| `apiLevelCondition` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApiLevelCondition`)`` A condition which is satisfied if the Android Framework API level on the device doesn't meet a minimum requirement. |

### NonComplianceDetailCondition

| JSON representation |
|---|
| ``` { "settingName": string, "nonComplianceReason": enum (`NonComplianceReason`), "packageName": string } ``` |

| Fields ||
|---|---|
| `settingName` | `string` The name of the policy setting. This is the JSON field name of a top-level [`Policy`](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#Policy) field. If not set, then this condition matches any setting name. |
| `nonComplianceReason` | ``enum (`NonComplianceReason`)`` The reason the device is not in compliance with the setting. If not set, then this condition matches any reason. |
| `packageName` | `string` The package name of the app that's out of compliance. If not set, then this condition matches any package name. |

### ApiLevelCondition

| JSON representation |
|---|
| ``` { "minApiLevel": integer } ``` |

| Fields ||
|---|---|
| `minApiLevel` | `integer` The minimum desired Android Framework API level. If the device doesn't meet the minimum requirement, this condition is satisfied. Must be greater than zero. |

### SetupAction

| JSON representation |
|---|
| ``` { "title": { object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`) }, "description": { object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`) }, // Union field `action` can be only one of the following: "launchApp": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.LaunchAppAction`) } // End of list of possible types for union field `action`. } ``` |

| Fields ||
|---|---|
| `title` | ``object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`)`` Title of this action. |
| `description` | ``object (`https://developers.google.com/android/management/reference/mcp/get_enterprise#Output.Schema.UserFacingMessage`)`` Description of this action. |
| Union field `action`. The action to execute during setup. `action` can be only one of the following: ||
| `launchApp` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.LaunchAppAction`)`` An action to launch an app. The app will be launched with an intent containing an extra with key `com.google.android.apps.work.clouddpc.EXTRA_LAUNCHED_AS_SETUP_ACTION` set to the boolean value `true` to indicate that this is a setup action flow. If `SetupAction` references an app, the corresponding `` `installType` `` in the application policy must be set as `REQUIRED_FOR_SETUP` or said setup will fail. |

### LaunchAppAction

| JSON representation |
|---|
| ``` { // Union field `launch` can be only one of the following: "packageName": string // End of list of possible types for union field `launch`. } ``` |

| Fields ||
|---|---|
| Union field `launch`. `launch` can be only one of the following: ||
| `packageName` | `string` Package name of app to be launched |

### PolicyEnforcementRule

| JSON representation |
|---|
| ``` { "blockAction": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.BlockAction`) }, "wipeAction": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WipeAction`) }, // Union field `trigger` can be only one of the following: "settingName": string // End of list of possible types for union field `trigger`. } ``` |

| Fields ||
|---|---|
| `blockAction` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.BlockAction`)`` An action to block access to apps and data on a company owned device or in a work profile. This action also triggers a user-facing notification with information (where possible) on how to correct the compliance issue. Note: `wipeAction` must also be specified. |
| `wipeAction` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WipeAction`)`` An action to reset a company owned device or delete a work profile. Note: `blockAction` must also be specified. |
| Union field `trigger`. Condition which will trigger this rule. `trigger` can be only one of the following: ||
| `settingName` | `string` The top-level policy to enforce. For example, `applications` or `passwordPolicies`. |

### BlockAction

| JSON representation |
|---|
| ``` { "blockAfterDays": integer, "blockScope": enum (`BlockScope`) } ``` |

| Fields ||
|---|---|
| `blockAfterDays` | `integer` Number of days the policy is non-compliant before the device or work profile is blocked. To block access immediately, set to 0. `blockAfterDays` must be less than `wipeAfterDays`. |
| `blockScope` | ``enum (`BlockScope`)`` Specifies the scope of this `BlockAction`. Only applicable to devices that are company-owned. |

### WipeAction

| JSON representation |
|---|
| ``` { "wipeAfterDays": integer, "preserveFrp": boolean } ``` |

| Fields ||
|---|---|
| `wipeAfterDays` | `integer` Number of days the policy is non-compliant before the device or work profile is wiped. `wipeAfterDays` must be greater than `blockAfterDays`. |
| `preserveFrp` | `boolean` Whether the factory-reset protection data is preserved on the device. This setting doesn't apply to work profiles. |

### KioskCustomization

| JSON representation |
|---|
| ``` { "powerButtonActions": enum (`PowerButtonActions`), "systemErrorWarnings": enum (`SystemErrorWarnings`), "systemNavigation": enum (`SystemNavigation`), "statusBar": enum (`StatusBar`), "deviceSettings": enum (`DeviceSettings`) } ``` |

| Fields ||
|---|---|
| `powerButtonActions` | ``enum (`PowerButtonActions`)`` Sets the behavior of a device in kiosk mode when a user presses and holds (long-presses) the Power button. |
| `systemErrorWarnings` | ``enum (`SystemErrorWarnings`)`` Specifies whether system error dialogs for crashed or unresponsive apps are blocked in kiosk mode. When blocked, the system will force-stop the app as if the user chooses the "close app" option on the UI. |
| `systemNavigation` | ``enum (`SystemNavigation`)`` Specifies which navigation features are enabled (e.g. Home, Overview buttons) in kiosk mode. |
| `statusBar` | ``enum (`StatusBar`)`` Specifies whether system info and notifications are disabled in kiosk mode. |
| `deviceSettings` | ``enum (`DeviceSettings`)`` Specifies whether the Settings app is allowed in kiosk mode. |

### AdvancedSecurityOverrides

| JSON representation |
|---|
| ``` { "untrustedAppsPolicy": enum (`UntrustedAppsPolicy`), "googlePlayProtectVerifyApps": enum (`GooglePlayProtectVerifyApps`), "developerSettings": enum (`DeveloperSettings`), "commonCriteriaMode": enum (`CommonCriteriaMode`), "personalAppsThatCanReadWorkNotifications": [ string ], "mtePolicy": enum (`MtePolicy`), "contentProtectionPolicy": enum (`ContentProtectionPolicy`) } ``` |

| Fields ||
|---|---|
| `untrustedAppsPolicy` | ``enum (`UntrustedAppsPolicy`)`` The policy for untrusted apps (apps from unknown sources) enforced on the device. Replaces `install_unknown_sources_allowed (deprecated).` |
| `googlePlayProtectVerifyApps` | ``enum (`GooglePlayProtectVerifyApps`)`` Whether [Google Play Protect verification](https://support.google.com/accounts/answer/2812853) is enforced. Replaces `` `ensureVerifyAppsEnabled` `` (deprecated). |
| `developerSettings` | ``enum (`DeveloperSettings`)`` Controls access to developer settings: developer options and safe boot. Replaces `` `safeBootDisabled` `` (deprecated) and `` `debuggingFeaturesAllowed` `` (deprecated). On personally-owned devices with a work profile, setting this policy will not disable safe boot. In this case, a `` `NonComplianceDetail` `` with `` `MANAGEMENT_MODE` `` is reported. |
| `commonCriteriaMode` | ``enum (`CommonCriteriaMode`)`` Controls Common Criteria Mode---security standards defined in the [Common Criteria for Information Technology Security Evaluation](https://www.commoncriteriaportal.org/) (CC). Enabling Common Criteria Mode increases certain security components on a device, see `` `CommonCriteriaMode` `` for details. Warning: Common Criteria Mode enforces a strict security model typically only required for IT products used in national security systems and other highly sensitive organizations. Standard device use may be affected. Only enabled if required. If Common Criteria Mode is turned off after being enabled previously, all user-configured Wi-Fi networks may be lost and any enterprise-configured Wi-Fi networks that require user input may need to be reconfigured. |
| `personalAppsThatCanReadWorkNotifications[]` | `string` Personal apps that can read work profile notifications using a [NotificationListenerService](https://developer.android.com/reference/android/service/notification/NotificationListenerService). By default, no personal apps (aside from system apps) can read work notifications. Each value in the list must be a package name. |
| `mtePolicy` | ``enum (`MtePolicy`)`` Optional. Controls [Memory Tagging Extension (MTE)](https://source.android.com/docs/security/test/memory-safety/arm-mte) on the device. The device needs to be rebooted to apply changes to the MTE policy. On Android 15 and above, a `` `NonComplianceDetail` `` with `` `PENDING` `` is reported if the policy change is pending a device reboot. |
| `contentProtectionPolicy` | ``enum (`ContentProtectionPolicy`)`` Optional. Controls whether content protection, which scans for deceptive apps, is enabled. This is supported on Android 15 and above. |

### PersonalUsagePolicies

| JSON representation |
|---|
| ``` { "cameraDisabled": boolean, "screenCaptureDisabled": boolean, "accountTypesWithManagementDisabled": [ string ], "maxDaysWithWorkOff": integer, "personalPlayStoreMode": enum (`PlayStoreMode`), "personalApplications": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PersonalApplicationPolicy`) } ], "privateSpacePolicy": enum (`PrivateSpacePolicy`), "bluetoothSharing": enum (`BluetoothSharing`) } ``` |

| Fields ||
|---|---|
| `cameraDisabled` | `boolean` If true, the camera is disabled on the personal profile. |
| `screenCaptureDisabled` | `boolean` If true, screen capture is disabled for all users. |
| `accountTypesWithManagementDisabled[]` | `string` Account types that can't be managed by the user. |
| `maxDaysWithWorkOff` | `integer` Controls how long the work profile can stay off. The minimum duration must be at least 3 days. Other details are as follows: - If the duration is set to 0, the feature is turned off. - If the duration is set to a value smaller than the minimum duration, the feature returns an error. **Note:** If you want to avoid personal profiles being [suspended](https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setPersonalAppsSuspended(android.content.ComponentName,%20boolean)) during long periods of off-time, you can temporarily set a large value for this parameter. <br /> |
| `personalPlayStoreMode` | ``enum (`PlayStoreMode`)`` Used together with `personalApplications` to control how apps in the personal profile are allowed or blocked. |
| `personalApplications[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PersonalApplicationPolicy`)`` Policy applied to applications in the personal profile. |
| `privateSpacePolicy` | ``enum (`PrivateSpacePolicy`)`` Optional. Controls whether a private space is allowed on the device. |
| `bluetoothSharing` | ``enum (`BluetoothSharing`)`` Optional. Whether bluetooth sharing is allowed. |

### PersonalApplicationPolicy

| JSON representation |
|---|
| ``` { "packageName": string, "installType": enum (`InstallType`) } ``` |

| Fields ||
|---|---|
| `packageName` | `string` The package name of the application. |
| `installType` | ``enum (`InstallType`)`` The type of installation to perform. |

### OncCertificateProvider

| JSON representation |
|---|
| ``` { "certificateReferences": [ string ], // Union field `endpoint` can be only one of the following: "contentProviderEndpoint": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ContentProviderEndpoint`) } // End of list of possible types for union field `endpoint`. } ``` |

| Fields ||
|---|---|
| `certificateReferences[]` | `string` This feature is not generally available. |
| Union field `endpoint`. This feature is not generally available. `endpoint` can be only one of the following: ||
| `contentProviderEndpoint` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ContentProviderEndpoint`)`` This feature is not generally available. |

### ContentProviderEndpoint

| JSON representation |
|---|
| ``` { "uri": string, "packageName": string, "signingCertsSha256": [ string ] } ``` |

| Fields ||
|---|---|
| `uri` | `string` This feature is not generally available. |
| `packageName` | `string` This feature is not generally available. |
| `signingCertsSha256[]` | `string` Required. This feature is not generally available. |

### CrossProfilePolicies

| JSON representation |
|---|
| ``` { "showWorkContactsInPersonalProfile": enum (`ShowWorkContactsInPersonalProfile`), "crossProfileCopyPaste": enum (`CrossProfileCopyPaste`), "crossProfileDataSharing": enum (`CrossProfileDataSharing`), "workProfileWidgetsDefault": enum (`WorkProfileWidgetsDefault`), "crossProfileAppFunctions": enum (`CrossProfileAppFunctions`), "exemptionsToShowWorkContactsInPersonalProfile": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PackageNameList`) } } ``` |

| Fields ||
|---|---|
| `showWorkContactsInPersonalProfile` | ``enum (`ShowWorkContactsInPersonalProfile`)`` Whether personal apps can access contacts stored in the work profile. See also `` `exemptions_to_show_work_contacts_in_personal_profile` ``. |
| `crossProfileCopyPaste` | ``enum (`CrossProfileCopyPaste`)`` Whether text copied from one profile (personal or work) can be pasted in the other profile. |
| `crossProfileDataSharing` | ``enum (`CrossProfileDataSharing`)`` Whether data from one profile (personal or work) can be shared with apps in the other profile. Specifically controls simple data sharing via intents. Management of other cross-profile communication channels, such as contact search, copy/paste, or connected work \& personal apps, are configured separately. |
| `workProfileWidgetsDefault` | ``enum (`WorkProfileWidgetsDefault`)`` Specifies the default behaviour for work profile widgets. If the policy does not specify `` `work_profile_widgets` `` for a specific application, it will behave according to the value specified here. |
| `crossProfileAppFunctions` | ``enum (`CrossProfileAppFunctions`)`` Optional. Controls whether personal profile apps can invoke app functions exposed by apps in the work profile. |
| `exemptionsToShowWorkContactsInPersonalProfile` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PackageNameList`)`` List of apps which are excluded from the `` `ShowWorkContactsInPersonalProfile` `` setting. For this to be set, `` `ShowWorkContactsInPersonalProfile` `` must be set to one of the following values: - `` `SHOW_WORK_CONTACTS_IN_PERSONAL_PROFILE_ALLOWED` ``. In this case, these exemptions act as a blocklist. - `` `SHOW_WORK_CONTACTS_IN_PERSONAL_PROFILE_DISALLOWED` ``. In this case, these exemptions act as an allowlist. - `` `SHOW_WORK_CONTACTS_IN_PERSONAL_PROFILE_DISALLOWED_EXCEPT_SYSTEM` ``. In this case, these exemptions act as an allowlist, in addition to the already allowlisted system apps. Supported on Android 14 and above. A `` `NonComplianceDetail` `` with `` `API_LEVEL` `` is reported if the Android version is less than 14. |

### UsageLog

| JSON representation |
|---|
| ``` { "enabledLogTypes": [ enum (`LogType`) ], "uploadOnCellularAllowed": [ enum (`LogType`) ] } ``` |

| Fields ||
|---|---|
| `enabledLogTypes[]` | ``enum (`LogType`)`` Specifies which log types are enabled. Note that users will receive on-device messaging when usage logging is enabled. |
| `uploadOnCellularAllowed[]` | ``enum (`LogType`)`` Specifies which of the enabled log types can be uploaded over mobile data. By default logs are queued for upload when the device connects to WiFi. |

### DeviceConnectivityManagement

| JSON representation |
|---|
| ``` { "usbDataAccess": enum (`UsbDataAccess`), "configureWifi": enum (`ConfigureWifi`), "wifiDirectSettings": enum (`WifiDirectSettings`), "tetheringSettings": enum (`TetheringSettings`), "wifiSsidPolicy": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WifiSsidPolicy`) }, "wifiRoamingPolicy": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WifiRoamingPolicy`) }, "bluetoothSharing": enum (`BluetoothSharing`), "preferentialNetworkServiceSettings": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PreferentialNetworkServiceSettings`) }, "apnPolicy": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApnPolicy`) } } ``` |

| Fields ||
|---|---|
| `usbDataAccess` | ``enum (`UsbDataAccess`)`` Controls what files and/or data can be transferred via USB. Supported only on company-owned devices. |
| `configureWifi` | ``enum (`ConfigureWifi`)`` Controls Wi-Fi configuring privileges. Based on the option set, user will have either full or limited or no control in configuring Wi-Fi networks. |
| `wifiDirectSettings` | ``enum (`WifiDirectSettings`)`` Controls configuring and using Wi-Fi direct settings. Supported on company-owned devices running Android 13 and above. |
| `tetheringSettings` | ``enum (`TetheringSettings`)`` Controls tethering settings. Based on the value set, the user is partially or fully disallowed from using different forms of tethering. |
| `wifiSsidPolicy` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WifiSsidPolicy`)`` Restrictions on which Wi-Fi SSIDs the device can connect to. Note that this does not affect which networks can be configured on the device. Supported on company-owned devices running Android 13 and above. |
| `wifiRoamingPolicy` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WifiRoamingPolicy`)`` Optional. Wi-Fi roaming policy. |
| `bluetoothSharing` | ``enum (`BluetoothSharing`)`` Optional. Controls whether Bluetooth sharing is allowed. |
| `preferentialNetworkServiceSettings` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PreferentialNetworkServiceSettings`)`` Optional. Preferential network service configuration. Setting this field will override `` `preferentialNetworkService` ``. This can be set on both work profiles and fully managed devices on Android 13 and above. See [5G network slicing](https://developers.google.com/android/management/5g-network-slicing) guide for more details. |
| `apnPolicy` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApnPolicy`)`` Optional. Access Point Name (APN) policy. Configuration for Access Point Names (APNs) which may override any other APNs on the device. See `` `OVERRIDE_APNS_ENABLED` `` and `` `overrideApns` `` for details. |

### WifiSsidPolicy

| JSON representation |
|---|
| ``` { "wifiSsidPolicyType": enum (`WifiSsidPolicyType`), "wifiSsids": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WifiSsid`) } ] } ``` |

| Fields ||
|---|---|
| `wifiSsidPolicyType` | ``enum (`WifiSsidPolicyType`)`` Type of the Wi-Fi SSID policy to be applied. |
| `wifiSsids[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WifiSsid`)`` Optional. List of Wi-Fi SSIDs that should be applied in the policy. This field must be non-empty when WifiSsidPolicyType is set to `` `WIFI_SSID_ALLOWLIST` ``. If this is set to a non-empty list, then a `` `NonComplianceDetail` `` detail with `` `API_LEVEL` `` is reported if the Android version is less than 13 and a `` `NonComplianceDetail` `` with `` `MANAGEMENT_MODE` `` is reported for non-company-owned devices. |

### WifiSsid

| JSON representation |
|---|
| ``` { "wifiSsid": string } ``` |

| Fields ||
|---|---|
| `wifiSsid` | `string` Required. Wi-Fi SSID represented as a string. |

### WifiRoamingPolicy

| JSON representation |
|---|
| ``` { "wifiRoamingSettings": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WifiRoamingSetting`) } ] } ``` |

| Fields ||
|---|---|
| `wifiRoamingSettings[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.WifiRoamingSetting`)`` Optional. Wi-Fi roaming settings. SSIDs provided in this list must be unique, the policy will be rejected otherwise. |

### WifiRoamingSetting

| JSON representation |
|---|
| ``` { "wifiSsid": string, "wifiRoamingMode": enum (`WifiRoamingMode`) } ``` |

| Fields ||
|---|---|
| `wifiSsid` | `string` Required. SSID of the Wi-Fi network. |
| `wifiRoamingMode` | ``enum (`WifiRoamingMode`)`` Required. Wi-Fi roaming mode for the specified SSID. |

### PreferentialNetworkServiceSettings

| JSON representation |
|---|
| ``` { "preferentialNetworkServiceConfigs": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PreferentialNetworkServiceConfig`) } ], "defaultPreferentialNetworkId": enum (`PreferentialNetworkId`) } ``` |

| Fields ||
|---|---|
| `preferentialNetworkServiceConfigs[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.PreferentialNetworkServiceConfig`)`` Required. Preferential network service configurations which enables having multiple enterprise slices. There must not be multiple configurations with the same `` `preferentialNetworkId` ``. If a configuration is not referenced by any application by setting `` `ApplicationPolicy.preferentialNetworkId` `` or by setting `` `defaultPreferentialNetworkId` ``, it will be ignored. For devices on 4G networks, enterprise APN needs to be configured additionally to set up data call for preferential network service. These APNs can be added using `` `apnPolicy` ``. |
| `defaultPreferentialNetworkId` | ``enum (`PreferentialNetworkId`)`` Required. Default preferential network ID for the applications that are not in `` `applications` `` or if `` `ApplicationPolicy.preferentialNetworkId` `` is set to `` `PREFERENTIAL_NETWORK_ID_UNSPECIFIED` ``. There must be a configuration for the specified network ID in `preferentialNetworkServiceConfigs`, unless this is set to `` `NO_PREFERENTIAL_NETWORK` ``. If set to `` `PREFERENTIAL_NETWORK_ID_UNSPECIFIED` `` or unset, this defaults to `` `NO_PREFERENTIAL_NETWORK` ``. Note: If the default preferential network is misconfigured, applications with no `ApplicationPolicy.preferentialNetworkId` set are not able to access the internet. This setting does not apply to the following critical apps: - `com.google.android.apps.work.clouddpc` - `com.google.android.gms` `` `ApplicationPolicy.preferentialNetworkId` `` can still be used to configure the preferential network for them. |

### PreferentialNetworkServiceConfig

| JSON representation |
|---|
| ``` { "preferentialNetworkId": enum (`PreferentialNetworkId`), "fallbackToDefaultConnection": enum (`FallbackToDefaultConnection`), "nonMatchingNetworks": enum (`NonMatchingNetworks`) } ``` |

| Fields ||
|---|---|
| `preferentialNetworkId` | ``enum (`PreferentialNetworkId`)`` Required. Preferential network identifier. This must not be set to `` `NO_PREFERENTIAL_NETWORK` `` or `` `PREFERENTIAL_NETWORK_ID_UNSPECIFIED` ``, the policy will be rejected otherwise. |
| `fallbackToDefaultConnection` | ``enum (`FallbackToDefaultConnection`)`` Optional. Whether fallback to the device-wide default network is allowed. If this is set to `FALLBACK_TO_DEFAULT_CONNECTION_ALLOWED`, then `` `nonMatchingNetworks` `` must not be set to `NON_MATCHING_NETWORKS_DISALLOWED`, the policy will be rejected otherwise. Note: If this is set to `FALLBACK_TO_DEFAULT_CONNECTION_DISALLOWED`, applications are not able to access the internet if the 5G slice is not available. |
| `nonMatchingNetworks` | ``enum (`NonMatchingNetworks`)`` Optional. Whether apps this configuration applies to are blocked from using networks other than the preferential service. If this is set to `NON_MATCHING_NETWORKS_DISALLOWED`, then `` `fallbackToDefaultConnection` `` must be set to `FALLBACK_TO_DEFAULT_CONNECTION_DISALLOWED`. |

### ApnPolicy

| JSON representation |
|---|
| ``` { "overrideApns": enum (`OverrideApns`), "apnSettings": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApnSetting`) } ] } ``` |

| Fields ||
|---|---|
| `overrideApns` | ``enum (`OverrideApns`)`` Optional. Whether override APNs are disabled or enabled. See [`DevicePolicyManager.setOverrideApnsEnabled`](https://developer.android.com/reference/android/app/admin/DevicePolicyManager#setOverrideApnsEnabled) for more details. |
| `apnSettings[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApnSetting`)`` Optional. APN settings for override APNs. There must not be any conflict between any of APN settings provided, otherwise the policy will be rejected. Two `ApnSetting`s are considered to conflict when all of the following fields match on both: `numericOperatorId`, `apn`, `proxyAddress`, `proxyPort`, `mmsProxyAddress`, `mmsProxyPort`, `mmsc`, `mvnoType`, `protocol`, `roamingProtocol`. If some of the APN settings result in non-compliance of `` `INVALID_VALUE` `` , they will be ignored. This can be set on fully managed devices on Android 10 and above. This can also be set on work profiles on Android 13 and above and only with `https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ApnSetting`'s with `` `ENTERPRISE` `` APN type. A `` `NonComplianceDetail` `` with `` `API_LEVEL` `` is reported if the Android version is less than 10. A `` `NonComplianceDetail` `` with `` `MANAGEMENT_MODE` `` is reported for work profiles on Android versions less than 13. |

### ApnSetting

| JSON representation |
|---|
| ``` { "apnTypes": [ enum (`ApnType`) ], "apn": string, "displayName": string, "alwaysOnSetting": enum (`AlwaysOnSetting`), "authType": enum (`AuthType`), "carrierId": integer, "mmsProxyAddress": string, "mmsProxyPort": integer, "mmsc": string, "mtuV4": integer, "mtuV6": integer, "mvnoType": enum (`MvnoType`), "networkTypes": [ enum (`NetworkType`) ], "username": string, "password": string, "numericOperatorId": string, "protocol": enum (`Protocol`), "roamingProtocol": enum (`Protocol`), "proxyAddress": string, "proxyPort": integer } ``` |

| Fields ||
|---|---|
| `apnTypes[]` | ``enum (`ApnType`)`` Required. Usage categories for the APN. Policy will be rejected if this field is empty or contains `APN_TYPE_UNSPECIFIED` or duplicates. Multiple APN types can be set on fully managed devices. `ENTERPRISE` is the only allowed APN type on work profiles. A `` `NonComplianceDetail` `` with `` `MANAGEMENT_MODE` `` is reported for any other value on work profiles. APN types that are not supported on the device or management mode will be ignored. If this results in the empty list, the APN setting will be ignored, because `` `apnTypes` `` is a required field. A `` `NonComplianceDetail` `` with `` `INVALID_VALUE` `` is reported if none of the APN types are supported on the device or management mode. |
| `apn` | `string` Required. Name of the APN. Policy will be rejected if this field is empty. |
| `displayName` | `string` Required. Human-readable name that describes the APN. Policy will be rejected if this field is empty. |
| `alwaysOnSetting` | ``enum (`AlwaysOnSetting`)`` Optional. Whether User Plane resources have to be activated during every transition from CM-IDLE mode to CM-CONNECTED state for this APN. See 3GPP TS 23.501 section 5.6.13. |
| `authType` | ``enum (`AuthType`)`` Optional. Authentication type of the APN. |
| `carrierId` | `integer` Optional. Carrier ID for the APN. A value of 0 (default) means not set and negative values are rejected. |
| `mmsProxyAddress` | `string` Optional. MMS (Multimedia Messaging Service) proxy address of the APN which can be an IP address or hostname (not a URL). |
| `mmsProxyPort` | `integer` Optional. MMS (Multimedia Messaging Service) proxy port of the APN. A value of 0 (default) means not set and negative values are rejected. |
| `mmsc` | `string` Optional. MMSC (Multimedia Messaging Service Center) URI of the APN. |
| `mtuV4` | `integer` Optional. The default MTU (Maximum Transmission Unit) size in bytes of the IPv4 routes brought up by this APN setting. A value of 0 (default) means not set and negative values are rejected. Supported on Android 13 and above. A `` `NonComplianceDetail` `` with `` `API_LEVEL` `` is reported if the Android version is less than 13. |
| `mtuV6` | `integer` Optional. The MTU (Maximum Transmission Unit) size of the IPv6 mobile interface to which the APN connected. A value of 0 (default) means not set and negative values are rejected. Supported on Android 13 and above. A `` `NonComplianceDetail` `` with `` `API_LEVEL` `` is reported if the Android version is less than 13. |
| `mvnoType` | ``enum (`MvnoType`)`` Optional. MVNO match type for the APN. |
| `networkTypes[]` | ``enum (`NetworkType`)`` Optional. Radio technologies (network types) the APN may use. Policy will be rejected if this field contains `NETWORK_TYPE_UNSPECIFIED` or duplicates. |
| `username` | `string` Optional. APN username of the APN. |
| `password` | `string` Optional. APN password of the APN. |
| `numericOperatorId` | `string` Optional. The numeric operator ID of the APN. Numeric operator ID is defined as MCC (Mobile Country Code) + MNC (Mobile Network Code). |
| `protocol` | ``enum (`Protocol`)`` Optional. The protocol to use to connect to this APN. |
| `roamingProtocol` | ``enum (`Protocol`)`` Optional. The protocol to use to connect to this APN while the device is roaming. |
| `proxyAddress` | `string` Optional. The proxy address of the APN. |
| `proxyPort` | `integer` Optional. The proxy port of the APN. A value of 0 (default) means not set and negative values are rejected. |

### DeviceRadioState

| JSON representation |
|---|
| ``` { "wifiState": enum (`WifiState`), "airplaneModeState": enum (`AirplaneModeState`), "ultraWidebandState": enum (`UltraWidebandState`), "cellularTwoGState": enum (`CellularTwoGState`), "minimumWifiSecurityLevel": enum (`MinimumWifiSecurityLevel`), "userInitiatedAddEsimSettings": enum (`UserInitiatedAddEsimSettings`) } ``` |

| Fields ||
|---|---|
| `wifiState` | ``enum (`WifiState`)`` Controls current state of Wi-Fi and if user can change its state. |
| `airplaneModeState` | ``enum (`AirplaneModeState`)`` Controls whether airplane mode can be toggled by the user or not. |
| `ultraWidebandState` | ``enum (`UltraWidebandState`)`` Controls the state of the ultra wideband setting and whether the user can toggle it on or off. |
| `cellularTwoGState` | ``enum (`CellularTwoGState`)`` Controls whether cellular 2G setting can be toggled by the user or not. |
| `minimumWifiSecurityLevel` | ``enum (`MinimumWifiSecurityLevel`)`` The minimum required security level of Wi-Fi networks that the device can connect to. |
| `userInitiatedAddEsimSettings` | ``enum (`UserInitiatedAddEsimSettings`)`` Optional. Controls whether the user is allowed to add eSIM profiles. |

### DisplaySettings

| JSON representation |
|---|
| ``` { "screenBrightnessSettings": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ScreenBrightnessSettings`) }, "screenTimeoutSettings": { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ScreenTimeoutSettings`) } } ``` |

| Fields ||
|---|---|
| `screenBrightnessSettings` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ScreenBrightnessSettings`)`` Optional. Controls the screen brightness settings. |
| `screenTimeoutSettings` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.ScreenTimeoutSettings`)`` Optional. Controls the screen timeout settings. |

### ScreenBrightnessSettings

| JSON representation |
|---|
| ``` { "screenBrightnessMode": enum (`ScreenBrightnessMode`), "screenBrightness": integer } ``` |

| Fields ||
|---|---|
| `screenBrightnessMode` | ``enum (`ScreenBrightnessMode`)`` Optional. Controls the screen brightness mode. |
| `screenBrightness` | `integer` Optional. The screen brightness between 1 and 255 where 1 is the lowest and 255 is the highest brightness. A value of 0 (default) means no screen brightness set. Any other value is rejected. `` `screenBrightnessMode` `` must be either `` `BRIGHTNESS_AUTOMATIC` `` or `` `BRIGHTNESS_FIXED` `` to set this. Supported on Android 9 and above on fully managed devices. A `` `NonComplianceDetail` `` with `` `API_LEVEL` `` is reported if the Android version is less than 9. Supported on work profiles on company-owned devices on Android 15 and above. |

### ScreenTimeoutSettings

| JSON representation |
|---|
| ``` { "screenTimeoutMode": enum (`ScreenTimeoutMode`), "screenTimeout": string } ``` |

| Fields ||
|---|---|
| `screenTimeoutMode` | ``enum (`ScreenTimeoutMode`)`` Optional. Controls whether the user is allowed to configure the screen timeout. |
| `screenTimeout` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#duration` format)`` Optional. Controls the screen timeout duration. The screen timeout duration must be greater than 0, otherwise it is rejected. Additionally, it should not be greater than `` `maximumTimeToLock` ``, otherwise the screen timeout is set to `` `maximumTimeToLock` `` and a `` `NonComplianceDetail` `` with `` `INVALID_VALUE` `` reason and `` `SCREEN_TIMEOUT_GREATER_THAN_MAXIMUM_TIME_TO_LOCK` `` specific reason is reported. If the screen timeout is less than a certain lower bound, it is set to the lower bound. The lower bound may vary across devices. If this is set, `` `screenTimeoutMode` `` must be `` `SCREEN_TIMEOUT_ENFORCED` ``. Supported on Android 9 and above on fully managed devices. A `` `NonComplianceDetail` `` with `` `API_LEVEL` `` is reported if the Android version is less than 9. Supported on work profiles on company-owned devices on Android 15 and above. A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: `"3.5s"`. |

### WorkAccountSetupConfig

| JSON representation |
|---|
| ``` { "authenticationType": enum (`AuthenticationType`), "requiredAccountEmail": string } ``` |

| Fields ||
|---|---|
| `authenticationType` | ``enum (`AuthenticationType`)`` Optional. The authentication type of the user on the device. |
| `requiredAccountEmail` | `string` Optional. The specific google work account email address to be added. This field is only relevant if `` `authenticationType` `` is `` `GOOGLE_AUTHENTICATED` ``. This must be an enterprise account and not a consumer account. Once set and a Google authenticated account is added to the device, changing this field will have no effect, and thus recommended to be set only once. |

### DefaultApplicationSetting

| JSON representation |
|---|
| ``` { "defaultApplicationType": enum (`DefaultApplicationType`), "defaultApplications": [ { object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DefaultApplication`) } ], "defaultApplicationScopes": [ enum (`DefaultApplicationScope`) ] } ``` |

| Fields ||
|---|---|
| `defaultApplicationType` | ``enum (`DefaultApplicationType`)`` Required. The app type to set the default application. |
| `defaultApplications[]` | ``object (`https://developers.google.com/android/management/reference/mcp/get_policy#Output.Schema.DefaultApplication`)`` Required. The list of applications that can be set as the default app for a given type. This list must not be empty or contain duplicates. The first app in the list that is installed and qualified for the `` `defaultApplicationType` `` (e.g. SMS app for `` `DEFAULT_SMS` ``) is set as the default app. The signing key certificate fingerprint of the app on the device must also match one of the signing key certificate fingerprints obtained from Play Store or one of the entries in `` `ApplicationPolicy.signingKeyCerts` `` in order to be set as the default. If the `` `defaultApplicationScopes` `` contains `` `SCOPE_FULLY_MANAGED` `` or `` `SCOPE_WORK_PROFILE` ``, the app must have an entry in `` `applications` `` with `` `installType` `` set to a value other than `` `BLOCKED` ``. A `` `NonComplianceDetail` `` with `` `APP_NOT_INSTALLED` `` reason and `` `DEFAULT_APPLICATION_SETTING_FAILED_FOR_SCOPE` `` specific reason is reported if *none* of the apps in the list are installed. A `` `NonComplianceDetail` `` with `` `INVALID_VALUE` `` reason and `` `DEFAULT_APPLICATION_SETTING_FAILED_FOR_SCOPE` `` specific reason is reported if at least one app is installed but the policy fails to apply due to other reasons (e.g. the app is not of the right type). When applying to `` `SCOPE_PERSONAL_PROFILE` `` on a company-owned device with a work profile, only pre-installed system apps can be set as the default. A `` `NonComplianceDetail` `` with `` `INVALID_VALUE` `` reason and `` `DEFAULT_APPLICATION_SETTING_FAILED_FOR_SCOPE` `` specific reason is reported if the policy fails to apply to the personal profile. |
| `defaultApplicationScopes[]` | ``enum (`DefaultApplicationScope`)`` Required. The scopes to which the policy should be applied. This list must not be empty or contain duplicates. A `` `NonComplianceDetail` `` with `` `MANAGEMENT_MODE` `` reason and `` `DEFAULT_APPLICATION_SETTING_UNSUPPORTED_SCOPES` `` specific reason is reported if *none* of the specified scopes can be applied to the management mode (e.g. a fully managed device receives a policy with only `` `SCOPE_PERSONAL_PROFILE` `` in the list). |

### DefaultApplication

| JSON representation |
|---|
| ``` { "packageName": string } ``` |

| Fields ||
|---|---|
| `packageName` | `string` Required. The package name that should be set as the default application. The policy is rejected if the package name is invalid. |

### Tool Annotations

Destructive Hint: ❌ \| Idempotent Hint: ✅ \| Read Only Hint: ✅ \| Open World Hint: ❌