瞭解安全防護設定
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
securityPosture 是裝置的安全性評估，取決於目前的裝置狀態。裝置目前的狀態取決於多項因素，例如裝置是否已啟用 Root 權限、是否搭載自訂 ROM 等等。
securityPosture 會在回應中細分為 devicePosture 和額外的 postureDetails 清單，其中包含欄位 securityRisk。
securityRisk 欄位可讓您瞭解為何裝置未處於最安全的狀態，而 advice 清單則可協助執行改善裝置安全態勢的動作。例如：
{
"devicePosture": "POTENTIALLY_COMPROMISED",
"postureDetails": [
{
"securityRisk": "UNKNOWN_OS",
"advice": [
{
"defaultMessage": "The user should lock their device's bootloader."
}
]
},
{
"securityRisk": "HARDWARE_BACKED_EVALUATION_FAILED"
}
]
}
評估安全防護機制
根據預設，securityPosture 會透過金鑰認證進行評估，特別是硬體支援金鑰認證 (HBKA) (如適用)，以便在安全硬體中產生並簽署認證，提供可信賴的安全性判定結果。
有時 HBKA 可能無法用於這項評估。為反映這項情況，securityRisk 會傳回「HARDWARE_BACKED_EVALUATION_FAILED」。這表示可以評估 securityPosture，但無法使用 HBKA，也就是說，裝置的啟動完整性狀態可能遭到入侵 (例如裝置可能已取得 root 權限)，並且無法透過軟體偵測。
瞭解安全防護機制判定結果
您可以解讀 devicePosture 和 securityRisk 的不同組合，瞭解裝置的整體安全性。請注意，以下清單僅列舉部分示例：
- 如果
devicePosture 傳回「SECURE」，而 securityRisk 傳回「HARDWARE_BACKED_EVALUATION_FAILED」，表示裝置的完整性安全無虞，但 HBKA 無法確認這項資訊。
- 如果
devicePosture 傳回「POTENTIALLY_COMPROMISED」，且未傳回 securityRisk 結果，則會在評估中使用 HBKA，並將裝置視為遭到入侵。
- 如果
devicePosture 傳回「POTENTIALLY_COMPROMISED」，而 securityRisk 傳回「HARDWARE_BACKED_EVALUATION_FAILED」，則只能執行軟體檢查，但完整性威脅信號強度足以將裝置視為已遭駭入。
- 如果
devicePosture 傳回「POSTURE_UNSPECIFIED」，表示無法完成安全性評估。建議您等待 HBKA 重新發布 (在新的判定結果傳回時)，看看是否能傳回特定值。不過，在初次安裝的短暫時間內，系統預期會發生「POSTURE_UNSPECIFIED」的情況。
Android Management API 與 Play Integrity API 對應
下表列出 AM API 判定結果與 Play Integrity API 判定結果回應之間的對應關係。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-26 (世界標準時間)。
[null,null,["上次更新時間：2025-07-26 (世界標準時間)。"],[[["\u003cp\u003e\u003ccode\u003esecurityPosture\u003c/code\u003e provides a security evaluation of an Android device based on factors like rooting, custom ROMs, and key attestation.\u003c/p\u003e\n"],["\u003cp\u003eIt uses \u003ccode\u003edevicePosture\u003c/code\u003e and \u003ccode\u003esecurityRisk\u003c/code\u003e fields to determine if a device is secure, potentially compromised, or if evaluation failed.\u003c/p\u003e\n"],["\u003cp\u003eHardware-backed key attestation (HBKA) provides a trustworthy security verdict, but software-based checks are used if HBKA fails.\u003c/p\u003e\n"],["\u003cp\u003eDifferent combinations of \u003ccode\u003edevicePosture\u003c/code\u003e and \u003ccode\u003esecurityRisk\u003c/code\u003e values offer insight into the specific security state of a device.\u003c/p\u003e\n"],["\u003cp\u003eThe Android Management API security verdicts have corresponding mappings to Play Integrity API verdict responses.\u003c/p\u003e\n"]]],["`securityPosture` evaluates device security based on factors like rooting or custom ROMs. It breaks down into `devicePosture` and `postureDetails`, the latter including `securityRisk` and `advice`. `securityRisk` highlights potential security issues. Evaluations use hardware-backed key attestation (HBKA) when possible; failures are marked by `HARDWARE_BACKED_EVALUATION_FAILED` in `securityRisk`. Different `devicePosture` and `securityRisk` combinations indicate varying security levels, such as \"SECURE\" with HBKA failure, or \"POTENTIALLY_COMPROMISED\". It also maps the AM API verdicts to the Play Integrity API.\n"],null,["# Understanding Security Posture\n\n[`securityPosture`](/android/management/reference/rest/v1/enterprises.devices#securityposture) is the security evaluation of a device, determined by the current device status.\nCurrent device status is determined by factors such as if the device has been rooted, if it is running a custom ROM, and more.\n\n`securityPosture` is broken down in the response into [`devicePosture`](/android/management/reference/rest/v1/enterprises.devices#deviceposture) and an additional list of [`postureDetails`](/android/management/reference/rest/v1/enterprises.devices#posturedetail) which contains the field [`securityRisk`](/android/management/reference/rest/v1/enterprises.devices#securityrisk).\n\nThe `securityRisk` field gives an idea of why the device is not considered to be in the most secure state, while the `advice` list can help perform actions to improve the security posture of the device.\nFor example: \n\n```gdscript\n {\n \"devicePosture\": \"POTENTIALLY_COMPROMISED\",\n \"postureDetails\": [\n {\n \"securityRisk\": \"UNKNOWN_OS\",\n \"advice\": [\n {\n \"defaultMessage\": \"The user should lock their device's bootloader.\"\n }\n ]\n },\n {\n \"securityRisk\": \"HARDWARE_BACKED_EVALUATION_FAILED\"\n }\n ]\n}\n```\n\nEvaluating Security Posture\n---------------------------\n\nBy default, `securityPosture` is evaluated using key attestation, specifically [hardware-backed key attestation (HBKA)](https://developer.android.com/training/articles/security-key-attestation) if applicable, providing a trustworthy security verdict as it generates and signs the attestation in secure hardware.\n\nIt may sometimes be the case that HBKA cannot be used for this evaluation. To reflect this, `securityRisk` will return \"HARDWARE_BACKED_EVALUATION_FAILED\". This means that `securityPosture` can be evaluated but not with HBKA, meaning that the device's boot integrity state could be compromised (e.g. the device could be rooted) and go undetected by software-based detection.\n\nUnderstanding Security Posture Verdicts\n---------------------------------------\n\nDifferent combinations of `devicePosture` and `securityRisk` can be interpreted to understand the overall security of the device. Please be aware that the list below is not exhaustive:\n\n- If `devicePosture` returns \"SECURE\" and `securityRisk` returns \"HARDWARE_BACKED_EVALUATION_FAILED\" the device's integrity is secure, but this could not be confirmed by HBKA.\n- If `devicePosture` returns \"POTENTIALLY_COMPROMISED\" and no `securityRisk` result is returned, then HBKA is used in the evaluation and considers the device as compromised.\n- If `devicePosture` returns \"POTENTIALLY_COMPROMISED\" and `securityRisk` returns \"HARDWARE_BACKED_EVALUATION_FAILED\" then only software based checks could be performed, yet the integrity threat signals are strong enough to consider the device as compromised.\n- If `devicePosture` returns \"POSTURE_UNSPECIFIED\" then the security evaluation could not be completed. We recommend waiting for the re-issuance of the HBKA, which occurs when a new verdict is returned, to see if it can return a specific value. However, it is expected for \"POSTURE_UNSPECIFIED\" to occur on initial install for a short period of time.\n\n### Android Management API to Play Integrity API mappings\n\nThe following table provides the mapping equivalence between AM API verdict and\nthe Play Integrity API verdict response.\n\n| [AM API DevicePosture](/android/management/reference/rest/v1/enterprises.devices#deviceposture) | [AM API Posture.Detail.SecurityRisk](/android/management/reference/rest/v1/enterprises.devices#PostureDetail.FIELDS.security_risk) | [Play Integrity API verdict equivalent](/google/play/integrity/verdicts#device-integrity-field) |\n|------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|\n| [`SECURE`](/android/management/reference/rest/v1/enterprises.devices#DevicePosture.ENUM_VALUES.SECURE) | [`SECURITY_RISK_UNSPECIFIED`](/android/management/reference/rest/v1/enterprises.devices#SecurityRisk.ENUM_VALUES.SECURITY_RISK_UNSPECIFIED) | `MEETS_STRONG_INTEGRITY` |\n| [`SECURE`](/android/management/reference/rest/v1/enterprises.devices#DevicePosture.ENUM_VALUES.SECURE) | contains: [`HARDWARE_BACKED_EVALUATION_FAILED`](/android/management/reference/rest/v1/enterprises.devices#SecurityRisk.ENUM_VALUES.HARDWARE_BACKED_EVALUATION_FAILED) | `MEETS_DEVICE_INTEGRITY` |\n| [`AT_RISK`](/android/management/reference/rest/v1/enterprises.devices#DevicePosture.ENUM_VALUES.AT_RISK) | contains: [`HARDWARE_BACKED_EVALUATION_FAILED`](/android/management/reference/rest/v1/enterprises.devices#SecurityRisk.ENUM_VALUES.HARDWARE_BACKED_EVALUATION_FAILED) | `MEETS_DEVICE_INTEGRITY` |\n| [`POTENTIALLY_COMPROMISED`](/android/management/reference/rest/v1/enterprises.devices#DevicePosture.ENUM_VALUES.POTENTIALLY_COMPROMISED) | contains: [`UNKNOWN_OS`](/android/management/reference/rest/v1/enterprises.devices#SecurityRisk.ENUM_VALUES.UNKNOWN_OS) | `MEETS_BASIC_INTEGRITY` |\n| [`POTENTIALLY_COMPROMISED`](/android/management/reference/rest/v1/enterprises.devices#DevicePosture.ENUM_VALUES.POTENTIALLY_COMPROMISED) | contains: [`COMPROMISED_OS`](/android/management/reference/rest/v1/enterprises.devices#SecurityRisk.ENUM_VALUES.COMPROMISED_OS) | `\u003cunset\u003e` |\n| [`POSTURE_UNSPECIFIED`](/android/management/reference/rest/v1/enterprises.devices#DevicePosture.ENUM_VALUES.POSTURE_UNSPECIFIED) | `\u003cany\u003e` | `\u003cunset\u003e` |"]]
