# Restrictions

Last updated: August 14, 2026

This page provides a comprehensive reference for configuring Android Restrictions profiles in Mobile Device Manager Plus. Administrators can allow or restrict device features across categories including Device Functionality, Security, Sync and Storage, Applications, Browser, Network and Roaming, Device Connectivity, Tethering, Location, Phone, Display, and Miscellaneous settings. The profile description table details feature support across deployment modes — Fully Managed, Work Profile on Personally Owned, Fully Managed with Work Profile, and Legacy — helping admins identify the right restrictions for their Android fleet.

**Mobile Device Manager Plus** allows administrators to create an Android Restriction profile to manage various aspects of device functionality effectively. The profile encompasses several key sections, including Device Functionality, Security, Sync and Storage, Applications, Browser Restrictions, Network and Roaming, Device Connectivity, Tethering, Location Settings, Phone, Date/Time Settings, Display Settings, and Miscellaneous. Within each of these sections, administrators can specify features to either allow or restrict during the profile creation process. For detailed information on each section, please refer to the Profile Description section below.

**Only devices running Android 5.0 or above can be provisioned as** [Personally-Owned Work Profile (BYOD, or previously Profile Owner)](https://www.manageengine.com/mobile-device-management/help/android_for_work/mdm_android_for_work_introduction.html#Profile_Owner) **or** [Fully Managed (COSU and COBO, or previously Device Owner)](https://www.manageengine.com/mobile-device-management/help/android_for_work/mdm_android_for_work_introduction.html#Device_Owner).

**Note:** To view a detailed comparison of various policies supported with respect to a specific OS version, click [here](https://www.manageengine.com/mobile-device-management/mdm-android-feature-comparison.html).

**Note:** For enhanced security, the admin can configure a kiosk profile to lockdown the device with specific apps and settings or blocklist unwanted apps in the [Inventory](https://www.manageengine.com/mobile-device-management/help/profile_management/android/android_kiosk.html). The admin can further ensure corporate security by ensuring only safe apps are installed by users on devices by configuring [application settings](https://www.manageengine.com/mobile-device-management/help/profile_management/android/mdm_android_restrictions.html) for Corporate Owned devices and [Workspace Security](https://www.manageengine.com/mobile-device-management/help/profile_management/android/mdm_workspace_security.html) for BYOD devices.

## Profile Creation

To create a Restriction Profile, follow these steps:

1. On the Mobile Device Manager Plus console, navigate to Device Management → Profiles → +Create Profile → Choose Android.
   ![Create Android Profile](https://www.manageengine.com/mobile-device-management/help/images/ar_1.png)
2. Provide the Profile Name, choose the Profile type, provide a description, and continue.
   ![Create Android Profile description](https://www.manageengine.com/mobile-device-management/help/images/ar_2.png)
3. Select the Restrictions tab and configure the restrictions as required. Save and publish the restriction. Associate the restriction profile to the desired groups or devices.
   ![Create Android Profile creation](https://www.manageengine.com/mobile-device-management/help/images/ar_3.png)

## Profile Description

**Note:**

1. Since images are from Samsung devices, every OEM does not follow the same text or screens. Images or information texts shown may vary based on OEMs.
2. When a restriction is applied through MDM, the corresponding setting on the user's device is disabled (grayed out) and cannot be modified by the user until the restriction is removed.

## Profile Description Table

Additional details on each section can be found in the Profile Description table below. **A tick symbol** indicates that a feature is applicable, **a cross symbol** means it is not supported, and **the Knox symbol** denotes applicability only for Knox-enrolled devices. [Export Profile Description in Tab-Separated Values (.tsv) Format](https://workdrive.zohoexternal.com/external/48885d7fdbb2452e3235f258094bd996518709f548b35e9088b079931843d6d4/download?directDownload=true).

**Note:** For this restriction to work, the certificate must be pushed by the administrator.

- Restricting the option **Users can install unapproved apps** for an Android device will also prevent the update and installation of **Non-Market apps**, even if the profile settings in the MDM console allowed for “Non-Market apps.”
- Pre-loaded non-system apps will also be disabled due to this restriction.
- For **Work Profile on Company-Owned Devices**, restrictions apply only to the Work Container.

## Frequently Asked Questions

### How to prevent Gmail app from bypassing MDM content sharing restrictions?

For BYOD devices enrolled as **Personally-Owned Work Profile (BYOD, or previously Profile Owner)**, sharing managed data between the Work Profile and unmanaged apps is restricted by default. To tighten this further, configure a [Workspace Security](https://www.manageengine.com/mobile-device-management/help/profile_management/android/mdm_workspace_security.html) profile and restrict sharing between work and personal space, disable clipboard sharing, and restrict app connectivity.

On managed Android devices, you can also use **Restrict Specific Accounts** under **Profiles → Android → Restrictions** to block personal Google or Gmail accounts from being added to the device.

### Can the device time be set remotely using MDM?

Yes, administrators can remotely configure the device time and timezone using a Restrictions profile in MDM.

**Steps:**

1. Navigate to **Profiles → Restrictions → Date/Time Settings**.
2. Under **Set device time**, select **“Select timezone manually”** from the dropdown.
3. Choose the appropriate **Timezone** from the list, for example, *UTC+02:00 — CAT*.
4. Set **Modify date/time** to **Restrict** to prevent end users from manually changing the time on the device.
5. Save and distribute the profile to the target devices or groups.

Once the profile is applied, the device time will automatically reflect the configured timezone. This is especially useful for managing devices deployed across different regions or ensuring consistent time settings for compliance purposes.

### Why does app uninstall behavior differ even after configuring the “Allow Uninstalling Apps” restriction?

Some apps can be uninstalled even when uninstalling is restricted, while others cannot be uninstalled even when it is allowed. This is because app distribution settings always take priority over the restriction profile.

- When set to **Allow**, users can uninstall apps from the device.
- On **Fully Managed Devices**, enabling this prevents users from uninstalling apps they installed themselves.
- On **Company-Owned Work Profile Devices**, this restriction applies only to apps inside the Work Profile.
- If you chose **Silent Installation** with **“Restrict users from uninstalling the app”** enabled, the app cannot be uninstalled regardless of the restriction profile.
- If you chose **Silent Installation** without restricting uninstall, users can uninstall the app even if the restriction profile says otherwise.