Kaspersky Secure Mobility Management

Managing app permissions

Expand all | Collapse all

These settings apply to corporate devices and devices with a corporate container.

App permission management settings let you configure rules for granting runtime permissions to installed apps.

To add app permissions:

1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
2. In the policy properties window, select Application settings.
3. Select Android and go to the App configuration section.
4. On the App permission management card, click Settings.

   The App permission management window opens.

5. Enable the settings using the App permission management toggle switch.
6. Click Add.

   The Add app with permission granting rules window opens.

7. In the Method for adding configuration section, select how to add a configuration with permission granting rules:
   • App package uploaded by administrator

     When adding a configuration by uploading an app package, you need to select an APK file saved on your computer.

     After that, you can view a list of runtime permissions and select an action to be performed for each permission.

   • Kaspersky Security Center installation package

     When adding a configuration using an installation package added to Kaspersky Security Center, you need to select the app from the list of mobile app packages.

     After that, you can view a list of runtime permissions and select the action to be performed for each permission.

   • Manual configuration

     When adding a configuration manually, you must click the Add rule button to select a permission and a corresponding action from the drop-down lists.

8. In the App data section, specify the following settings:
   • App name

     Name of the app for which permissions are to be configured.

     When importing a configuration from an APK file or an installation package, the value is inserted automatically.

   • Package name

     Name of the package for which permissions are to be configured.

     How to get the package name of an app

     To get the name of an app package:

     1. Open Google Play.
     2. Find the app and open its page.

     The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).

     To get the name of an app package that has been added to Kaspersky Security Center:

     1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps.
     2. Click Android apps.

        In the list of apps that opens, app identifiers are displayed in the Package name column.

     When importing a configuration from an APK file or an installation package, the value is inserted automatically.

   • Comment

     An optional comment.

9. Click the Add rule button to add and configure a new rule. You can add several permissions.

   Select one of the following permissions.

   • Permission for call handover
   • Location permissions
   • Permission to use saved geographic locations
   • Permission for activity recognition
   • Permission for answerphone voice mails
   • Permission to answer phone calls
   • Permissions for Bluetooth
   • Permissions to access body sensors data
   • Permission for phone calls
   • Permissions for camera
   • Permission to access account list
   • Permissions to access nearby devices via Wi-Fi
   • Permission to send notifications
   • Permission to manage outgoing calls
   • Permission to read calendar data
   • Permission to read call log
   • Permission to read contact list
   • Permissions to read external storage
   • Permission to read device's phone numbers
   • Permission to read phone state
   • Permissions to monitor SMS and MMS incoming messages
   • Permission to receive WAP push messages
   • Permission to record audio
   • Permission to send SMS
   • Permission to use SIP telephony
   • Permission to access devices that use UWB
   • Permission to write data to calendar
   • Permission to write and read data of call log
   • Permission to write contacts
   • Permission to write data to external storage

   To configure granting rules for app runtime permissions, you need to select one of the following actions for each permission:

   • Allow users to configure permissions

     When a permission is requested, the user decides whether to grant the specified permission to the app.

     This option is selected by default.

   • Grant permissions automatically

     The app is granted the permission without user interaction.

     On devices with a corporate container running Android 12 or later, the following permissions can't be granted automatically but can be denied automatically. If you select this option, the app will prompt the user for these permissions:

     • Location permissions
     • Permissions for camera
     • Permissions to record audio
     • Permission for activity recognition
     • Permissions to access body sensor data
   • Deny permissions automatically

     The app is denied the permission without user interaction.

   You can save only one granting rule for each app permission.

10. Click Add.

    The configuration appears in the Apps with configured permission granting rules list.

    You can modify or delete configurations in the list using the Edit and Delete buttons at the top of the list.

11. Click OK.
12. Click Save to save the changes you have made.

The configuration with permission granting rules is applied. Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Permission granting rules configured for specific apps have precedence over the general policy for granting permissions. For example, if you first select the Deny permissions automatically option in the Corporate container on devices section, and then select the Grant permissions automatically option for a specific app in the App permission management section, the permission for this app will be granted automatically.