Kaspersky Secure Mobility Management help

To keep an Android device secure, Kaspersky Mobile Devices Protection and Management lets you configure user access to the following features of mobile devices:

Wi-Fi
Camera
Bluetooth

By default, the user can use Wi-Fi, camera, and Bluetooth on the device without restrictions.

To configure the Wi-Fi, camera, and Bluetooth usage restrictions on the device:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select Android and go to the Restrictions section.
On the Device feature restrictions card, click Settings.
The Device feature restrictions window opens.
Enable the settings using the Device feature restrictions toggle switch.
Configure usage of Wi-Fi, camera, and Bluetooth:
- To disable the Wi-Fi module on the user's mobile device, select the Prohibit use of Wi-Fi check box.
  On personal devices and devices with a corporate container running Android 10 or later, prohibiting the use of Wi-Fi networks is not supported.
- To disable the camera on the user's mobile device, select the Prohibit use of camera check box.
  When camera usage is prohibited, the app displays a notification upon opening and then closes shortly after. On Asus and OnePlus devices, the notification is shown in full screen. The device user can tap the Close button to exit the app.
  
  On devices running Android 11 or later, Kaspersky Endpoint Security for Android must be set as an Accessibility feature. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or later disable this service in the device settings. If this is the case, you will not be able to restrict use of the camera.
- To disable Bluetooth on the user's mobile device, select the Prohibit use of Bluetooth check box.
  On Android 12 or later, the use of Bluetooth can be disabled only if the device user granted the Nearby devices permission. The user can grant this permission during the Initial Configuration Wizard or later.
  
  On personal devices running Android 13 or later, the use of Bluetooth cannot be disabled.
Click OK.
Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

You can also restrict additional operating system features on corporate devices.

Page top

Configuring iOS MDM device restrictions

Expand all | Collapse all

To ensure compliance with corporate security requirements, configure restrictions on the operation of iOS MDM devices.

Configuring feature restrictions

To configure iOS MDM device feature restrictions:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select iOS and go to the Restrictions section.
On the Device feature restrictions card, click Settings.
The Device feature restrictions window opens.
Enable the settings using the Device feature restrictions toggle switch.
Enable iOS MDM device feature restrictions using toggle switches on corresponding tabs and select the required restrictions.
List of device feature restrictions
- Restrictions on the General tab:
  - In the Device settings section:
    - Prohibit voice dial on a locked device
      Use of the voice dialing function on a locked mobile device.
      
      If the check box is cleared, the user can use voice commands to dial phone numbers on a locked mobile device.
      
      If the check box is selected, the user cannot use voice commands to dial phone numbers on a locked mobile device.
      
      This check box is cleared by default.
    - Limit ad tracking
      Use of IFA (Identifier for advertisers) technology for keeping track of websites visited and apps launched on the iOS MDM device. IFA makes it possible to configure ad tracking on the mobile device according to the user's interests.
      
      If the check box is selected, IFA technology is disabled on the user's mobile device.
      
      If the check box is cleared, IFA technology is enabled on the mobile device and keeps track of visited websites and started apps in order to show targeted ads.
      
      This check box is cleared by default.
    - Prohibit Handoff
      Use of the Handoff function on the user's mobile device. Handoff enables you to start working with data on one Apple device and then switch to another Apple device and continue working with that data.
      
      If the check box is cleared, Handoff is available to the user.
      
      If the check box is selected, Handoff is not available.
      
      This check box is cleared by default.
    - Prohibit editing device name
      Ability to modify the name of the mobile device.
      
      If the check box is cleared, the user can edit the mobile device name.
      
      If the check box is selected, the device name cannot be edited.
      
      This check box is cleared by default.
    - Prohibit modifying restrictions
      Ability to configure the settings for restrictions on the mobile device. Restrictions may be utilized by the user to perform parental control functions on the mobile device. The user can restrict device functions (for example, block use of the camera), access to media content (for example, set age restrictions on viewing films), use of apps (for example, block the use of iTunes Store), and configure other restrictions.
      
      If the check box is cleared, the user can configure the settings for restrictions on the mobile device.
      
      If the check box is selected, restrictions cannot be configured on the mobile device.
      
      This check box is cleared by default.
    - Prohibit Spotlight suggestions
      Use of Spotlight internet search results in Siri Suggestions. When using Spotlight suggestions, search queries and their associated user data are sent to Apple.
      
      If the check box is cleared, the user can allow displaying Spotlight internet search results in Siri Suggestions.
      
      If the check box is selected, Spotlight internet search results are not available in Siri Suggestions. User data is not sent to Apple.
      
      The user may be able to enable Spotlight internet search results in Siri Suggestions even if the check box is selected. This is due to an issue known to Apple.
      
      This check box is cleared by default.
  - In the Data loss protection section:
    - Prohibit screenshots and screen recording
      Ability to take a screenshot or video from the screen of the iOS MDM device.
      
      If the check box is cleared, the user can take and save screenshots and videos from the screen of the mobile device.
      
      If the check box is selected, the user cannot take and save screenshots and videos from the screen of the mobile device.
      
      This check box is cleared by default.
    - Prohibit non-managed apps from using documents from managed apps
      Ability to use non-managed (personal) apps on the iOS MDM device to open documents created using managed (corporate) apps and accounts. Non-managed apps are apps installed, configured, and managed by the mobile device user.
      
      If the check box is cleared, the user can use non-managed apps to open documents created in managed corporate apps.
      
      If the check box is selected, the user is not allowed to use non-managed apps to open documents created using managed apps. For example, this setting prevents a confidential email attachment from a managed email account from being opened in the user's personal apps.
      
      This check box is cleared by default.
    - Prohibit managed apps from using documents from non-managed apps
      Ability to use managed (corporate) apps on the iOS MDM device to open documents created using non-managed (personal) apps and accounts of the user. Non-managed apps are apps installed, configured, and managed by the mobile device user.
      
      If the check box is cleared, the user can use managed apps to open documents created using non-managed apps.
      
      If the check box is selected, the user is not allowed to use managed apps to open documents created using non-managed apps. For example, this setting prevents a document from a personal iCloud account from being opened in a corporate app.
      
      This check box is cleared by default.
    - Disable encryption of backup copies
      Encryption of backup copies of iOS MDM device data in the iTunes app on the user's computer.
      
      If the check box is cleared, when a backup copy of mobile device data is created in the iTunes app, data is encrypted automatically and protected with a password. In this case, the user cannot encrypt backup copies of device data in the iTunes app.
      
      If the check box is selected, the user can choose whether to encrypt backup copies of data in the iTunes app.
      
      This check box is cleared by default.
    - Prohibit reset to factory settings
      Ability to wipe all data from the device and reset the device to its factory settings.
      
      If the check box is cleared, the user can wipe all data from the device and reset it to factory settings.
      
      If the check box is selected, full reset to factory settings is not available.
      
      This check box is cleared by default.
    - Prohibit modifying account settings
      Option that lets the user add new accounts (such as email accounts) and edit account settings on the iOS MDM device.
      
      If the check box is cleared, the mobile device user can add new accounts and edit the settings of existing accounts.
      
      If the check box is selected, the mobile device user is not allowed to add new accounts and edit the settings of existing accounts.
      
      This check box is cleared by default.
  - In the Security and privacy section:
    - Prohibit sending diagnostic and personal data to Apple
      Automatic receiving of diagnostic data and information on iOS MDM device usage and transmission of a report with this data to Apple for analysis.
      
      If the check box is cleared, after being shown a warning the user may allow transmission of reports with diagnostic data and information on mobile device usage to Apple.
      
      If the check box is selected, transmission of reports with diagnostic data and information on mobile device usage to Apple is blocked.
      
      This check box is cleared by default.
    - Prohibit changing password
      Ability to set, change, or delete the mobile device unlock password.
      
      If the check box is cleared, the user can set, change, or delete the password used for unlocking the mobile device.
      
      If the check box is selected, management of the device unlock password is not available.
      
      This check box is cleared by default.
    - Prohibit modifying Touch ID and Face ID settings
      Ability to add and remove Touch ID fingerprints or Face ID data.
      
      If the check box is cleared, the user can add and remove Touch ID fingerprints or Face ID data.
      
      If the check box is selected, management of Touch ID fingerprint or Face ID data is not available.
      
      This check box is cleared by default.
    - Prohibit device unlock using Touch ID and Face ID
      Touch ID and Face ID make it possible to use a fingerprint or facial recognition as a password for unlocking the iOS MDM device. Touch ID and Face ID can also be used for authentication of purchases by means of Apple Pay, iTunes Store, App Store, and Book Store, and to sign in to apps.
      
      If the check box is cleared, the user can use a fingerprint or facial recognition instead of entering a password to unlock the mobile device.
      
      If the check box is selected, the user cannot use Touch ID or Face ID for unlocking the mobile device.
      
      This check box is cleared by default.
    - Prompt for password for each purchase on iTunes Store
      Use of the restriction password for purchasing media content in iTunes Store.
      
      If the check box is selected, prior to making the first purchase via iTunes Store the user has to specify a restriction password in the purchase restriction settings and subsequently use it for preventing accidental or unauthorized purchases. After the account has been verified when the user is making purchases, the restriction password does not have to be re-entered for 15 minutes.
      
      If the check box is cleared, the user is not required to enter the restriction password before making purchases in iTunes Store.
      
      This check box is cleared by default.
    - Prompt for password on first connection via AirPlay
      Use of a password upon connection of the iOS MDM device to devices compatible with AirPlay. The password is used for safe transmission of media content.
      
      If the check box is selected, before the first connection of the mobile device to devices compatible with AirPlay, the user must specify a password in the AirPlay security settings and subsequently enter it.
      
      If the check box is cleared, the user can decide whether to use a password when connecting the mobile device to devices compatible with AirPlay.
      
      This check box is cleared by default.
    - Prohibit installing configuration profiles
      Use of additional configuration profiles on the iOS MDM device.
      
      If the check box is cleared, the user can install additional configuration profiles on the mobile device.
      
      If the check box is selected, the user cannot install additional configuration profiles on the mobile device.
      
      This check box is cleared by default.
    - Prohibit non-Configurator hosts
      Protection of the iOS MDM device against third-party connections. A third-party connection is a connection to other devices or synchronization with Apple services, such as iTunes.
      
      If the check box is cleared, the user can synchronize the iOS MDM device with other devices and Apple services.
      
      If the check box is selected, non-Configurator hosts on the user's mobile device are blocked.
      
      This check box is cleared by default.
    - Prohibit modifying settings for sending diagnostic data
      Automatic receiving of diagnostic data and information on iOS MDM device usage and transmission of a report with this data to Apple for analysis.
      
      If the check box is cleared, the user can configure the submission of reports containing diagnostic information and mobile device usage data to Apple.
      
      If the check box is selected, the settings for submission of reports containing diagnostic information are not available.
      
      This check box is cleared by default.
  - In the iCloud section:
    - Prohibit backup in iCloud
      Automatic backup of data from the iOS MDM device to iCloud. Copies of data already stored in iCloud are not created during the backup process. Copies of media content that was received by synchronizing the device with a computer and not purchased from iTunes Store are not created either.
      
      If the check box is cleared, the user can save backup copies of mobile device data in iCloud. Backup copies of data are saved in iCloud on a daily basis when the device is enabled, locked, and connected to a power source.
      
      If the check box is selected, the user cannot save backup copies of mobile device data in iCloud.
      
      This check box is cleared by default.
    - Prohibit storing documents and data in iCloud
      Automatic backup of documents in iCloud. iCloud documents can be opened and edited on other devices on which the iCloud service is configured.
      
      If the check box is cleared, the user can save documents in iCloud, open and edit them on other devices in applications that support iCloud (such as TextEdit).
      
      If the check box is selected, the user is not allowed to save documents in iCloud.
      
      This check box is cleared by default.
    - Prohibit iCloud keychain
      Automatic synchronization of the account credentials of an iOS MDM device user with the user's other Apple devices. The synchronized data is stored in iCloud Keychain. Data in iCloud Keychain is encrypted. iCloud Keychain makes it possible to save the following data in iCloud:
      
      Website accounts
      Bank card numbers and expiration dates
      Wireless network passwords
      If the check box is cleared, the user can synchronize data of accounts with the user's other Apple devices.
      
      If the check box is selected, the user is not allowed to use iCloud Keychain on the mobile device.
      
      This check box is cleared by default.
    - Prohibit managed apps from storing data in iCloud
      Creation of a backup copy of the data of managed apps in iCloud.
      
      If the check box is cleared, the user can store the data of managed apps in iCloud.
      
      If the check box is selected, the user cannot store corporate data in iCloud.
      
      This check box is cleared by default.
    - Prohibit backup of enterprise books
      Backup of enterprise books using iCloud or iTunes. You can provide access to enterprise books by placing them on the corporate web server.
      
      If the check box is cleared, backup of enterprise books using iCloud or iTunes is available to the user.
      
      If the check box is selected, backup of enterprise books is not available.
      
      This check box is cleared by default.
    - Prohibit synchronizing notes and highlights in enterprise books
      Ability to synchronize notes, bookmarks, and highlighted text in enterprise books using iCloud.
      
      If the check box is cleared, the user can synchronize notes, bookmarks, and highlights in enterprise books. Changes will be available on all the user's Apple devices using iCloud.
      
      If the check box is selected, notes, bookmarks and highlighted text will be available only on this mobile device.
      
      This check box is cleared by default.
    - Prohibit iCloud photo sharing
      Use of iCloud photo sharing on the iOS MDM device to grant other users access to photos and videos on the iCloud server. The other users need to have the iCloud photo sharing feature configured.
      
      If the check box is cleared, the iCloud photo sharing feature is available to the user. Users of other devices can view the user's photos and videos, leave comments, and add their own photos and videos. The user can also access the data of other users on the iCloud server.
      
      If the check box is selected, the iCloud photo sharing feature is not available to the user. The user cannot grant other users access to the user's photos and videos on the iCloud server or access the data of other users on the iCloud server.
      
      This check box is cleared by default.
    - Prohibit iCloud Media Library
      Use of the iCloud Media Library function for automatic uploading of photos and videos from the iOS MDM device to the user's other Apple devices.
      
      If the check box is cleared, the iCloud Media Library function is available to the user when working with the Photos app.
      
      If the check box is selected, the iCloud Media Library function is not available to the user. The user's photos and videos saved in the iCloud Media Library are removed from the iCloud server.
      
      This check box is cleared by default.
  - In the Certificates section:
    - Prohibit users from accepting untrusted TLS certificates
      Use of untrusted TLS certificates for providing an encrypted communication channel between apps on the iOS MDM device (Mail, Contacts, Calendar, Safari) and corporate resources.
      
      If the check box is cleared, the user may allow the use of an untrusted TLS certificate after being shown a warning.
      
      If the check box is selected, the use of untrusted TLS certificates is blocked.
      
      This check box is cleared by default.
    - Prohibit automatic updates of trusted certificates
      Automatic updates of trusted certificates on the iOS MDM device.
      
      If the check box is cleared, changes made to the trust settings of a certificate are applied automatically.
      
      If the check box is selected, changes to trust settings of a certificate are not applied automatically. After being shown a warning, the user may choose to apply changes to trust settings of the certificate.
      
      This check box is cleared by default.
- Restrictions on the Apps tab:
  - In the General section:
    - Prohibit use of camera
      Use of the camera on the user's mobile device.
      
      If the check box is cleared, the user is allowed to use the device camera.
      
      If the check box is selected, use of the device camera is disabled. The user cannot take photos, record videos, or use the FaceTime app. The camera icon on the device home screen is hidden.
      
      This check box is cleared by default.
    - Prohibit FaceTime
      Use of the FaceTime app on the user's mobile device. This check box is available if the use of the device camera is allowed. This setting is available if the Prohibit use of camera check box is cleared.
      
      If the check box is cleared, the user can make and receive calls using FaceTime.
      
      If the check box is selected, the FaceTime app is disabled on the user device. The user cannot make or receive video calls.
      
      This check box is cleared by default.
    - Prohibit iMessage
      Use of the iMessage service on the user's mobile device.
      
      If the check box is cleared, the user can send and receive messages using the iMessage service.
      
      If the check box is selected, the iMessage is not available on the mobile device. The user cannot send or receive messages via iMessage.
      
      This check box is cleared by default.
    - Prohibit Book Store
      Access to Book Store from the Apple Books app on the user's mobile device.
      
      If the check box is cleared, the user can visit Book Store from the Apple Books app installed on the device.
      
      If the check box is selected, the user cannot visit Book Store from the Apple Books app.
      
      This check box is cleared by default.
    - Prohibit installation of apps from Apple Configurator and iTunes
      The user can independently install apps on an iOS MDM device.
      
      If the check box is cleared, the user can independently install or update apps on a mobile device from App Store using iTunes or Apple Configurator.
      
      If the check box is selected, the user cannot install or update apps from App Store using iTunes or Apple Configurator on a mobile device. Installation and updates are available only for corporate apps. The App Store icon is hidden on the home screen of the iOS MDM device.
      
      This check box is cleared by default.
    - Prohibit installation of apps from the App Store
      Ability to independently install apps on a mobile device from the App Store. The check box is available if the Prohibit installation of apps from Apple Configurator and iTunes check box is cleared.
      
      If the check box is cleared, the user can independently install or update apps from the App Store.
      
      If the check box is selected, the user cannot install or update apps from the App Store on the mobile device. The App Store icon is hidden on the home screen of the iOS MDM device.
      
      This check box is cleared by default.
    - Prohibit automatic app downloads
      Use of automatic app downloads on the user's mobile device. The check box is available if the Prohibit installation of apps from Apple Configurator and iTunes check box is cleared.
      
      If the check box is cleared, automatic app downloads are available to the user. After this function is enabled, the apps that the user downloaded from the App Store are automatically downloaded to the user's other Apple devices.
      
      If the check box is selected, automatic app downloads are disabled and unavailable.
      
      This check box is cleared by default.
    - Prohibit in-app purchases
      Use of the in-app purchase system on the mobile device.
      
      If the check box is cleared, the user can make purchases in apps installed on the mobile device.
      
      If the check box is selected, the user cannot make purchases in apps installed on the mobile device.
      
      This check box is cleared by default.
    - Prohibit trusting new enterprise developers
      Ability to configure trusting of corporate apps on a mobile device. You can develop corporate apps and distribute them among employees for internal use. To work with a corporate app, the mobile device user must make it a trusted app.
      
      If the check box is cleared, the user can configure trusting of corporate apps.
      
      If the check box is selected, the user cannot set the trust level for corporate apps when installing an app manually.
      
      This check box is cleared by default.
    - Prohibit removing apps
      This option allows removing apps from the mobile device.
      
      If the check box is cleared, the user can remove apps installed via the App Store or iTunes from the device.
      
      If the check box is selected, the user cannot remove apps installed via the App Store or iTunes from the mobile device.
      
      This check box is cleared by default.
  - In the AirPrint section:
    - Prohibit AirPrint
      Selecting or clearing this check box specifies whether the device user can use AirPrint.
      
      The check box is cleared by default.
    - Prohibit storing AirPrint credentials
      Selecting or clearing this check box specifies whether the device user can store a keychain of user name and password for AirPrint.
      
      The restriction is supported on devices with iOS 11 and later.
      
      The check box is cleared by default.
    - Prohibit iBeacon discovery of AirPrint printers
      Selecting or clearing this check box specifies whether iBeacon discovery of AirPrint printers is enabled. Disabling iBeacon discovery of AirPrint printers prevents spurious AirPrint Bluetooth beacons from getting information about network traffic.
      
      The restriction is supported on devices with iOS 11 and later.
      
      The check box is cleared by default.
    - Force AirPrint to use a trusted TLS certificate
      Selecting or clearing this check box specifies whether a trusted certificate is required for TLS printing communication.
      
      The restriction is supported on devices with iOS 11 and later.
      
      The check box is cleared by default.
  - In the AirDrop section:
    - Prohibit AirDrop
      Use of the AirDrop feature for transmitting user data from the iOS MDM device to other Apple devices.
      
      If the check box is cleared, the user can use AirDrop to transmit data to other Apple devices.
      
      If the check box is selected, the user cannot transmit data to other Apple devices using AirDrop.
      
      This check box is cleared by default.
    - Treat AirDrop as a managed app
      Use of AirDrop as a managed app for transferring data from the mobile device to other Apple devices. This restriction requires that you select the Prohibit non-managed apps from using documents from managed apps check box. Non-managed apps are apps installed, configured, and managed by the mobile device user.
      
      If the check box is cleared, AirDrop is treated as a non-managed app.
      
      If the check box is selected, AirDrop is treated as a managed app.
      
      This check box is cleared by default.
  - In the Apple Music section:
    - Prohibit Apple Music
      Listening to music on the user's mobile device using the Apple Music service.
      
      If the check box is cleared, the user can listen to music on the mobile device in the Music app.
      
      If the check box is selected, the Apple Music service is not available to the user.
      
      This check box is cleared by default.
    - Prohibit Radio in Apple Music
      Listening to the radio using the Apple Music service on the user's mobile device.
      
      If the check box is cleared, the user can listen to the radio in the Music app on the mobile device.
      
      If the check box is selected, the user cannot listen to the radio.
      
      This check box is cleared by default.
  - In the Apple Watch section:
    - Disable Apple Watch wrist detection
      Automatic locking of Apple Watch when the user removes the watch from their hand.
      
      If the check box is cleared, Apple Watch is locked when the user removes a watch from their hand. To unlock it, the user must enter a password on the mobile device.
      
      If the check box is selected, Apple Watch cannot be locked after a watch is removed.
      
      This check box is cleared by default.
    - Prohibit pairing with Apple Watch
      Pairing of Apple Watch with a supervised mobile device.
      
      If the check box is cleared, the user of the supervised mobile device can pair it with Apple Watch.
      
      If the check box is selected, pairing with Apple Watch is not available.
      
      This check box is cleared by default.
  - In the Siri section:
    - Prohibit Siri
      Usage of the Siri app on the user's mobile device.
      
      If the check box is cleared, the user can use Siri voice commands on the mobile device.
      
      If the check box is selected, the user cannot use Siri voice commands on the mobile device.
      
      This check box is cleared by default.
    - Prohibit when device is locked
      Use of Siri voice commands when the user's mobile device is locked. The user's mobile device has to be password-protected.
      
      If the check box is cleared, the user can use Siri voice commands on a locked mobile device.
      
      If the check box is selected, the user cannot use Siri voice commands on a locked device.
      
      This check box is cleared by default.
    - Prohibit use of profanity filter
      This option disables the filtering of profanity while using the Siri app on the mobile device.
      
      If the check box is cleared, profanity is filtered while the user uses the Siri app.
      
      If the check box is selected, profanity is not filtered while the user uses the Siri app.
      
      This check box is cleared by default.
    - Prohibit Siri from using internet search
      This option prohibits Siri from using internet search for voice commands on the iOS MDM device.
      
      If the check box is cleared, Siri can search the internet for answers to the user's questions.
      
      If the check box is selected, Siri cannot search the internet for information.
      
      This check box is cleared by default.
  - In the Find My section:
    - Prohibit locating devices in Find My
      Selecting or clearing this check box specifies whether the device user can find devices in the Find My app.
      
      The restriction is supported on devices with iOS 13 and later.
      
      The check box is cleared by default.
    - Prohibit locating friends in Find My
      Selecting or clearing this check box specifies whether the device user can find friends in the Find My app.
      
      The restriction is supported on devices with iOS 13 and later.
      
      The check box is cleared by default.
  - In the Classroom section:
    - Prohibit screen viewing via Classroom
      Ability for an instructor to view students' iPad screens using the Classroom application.
      
      If the check box is cleared, the instructor can view students' iPad screens in the Classroom application.
      
      If the check box is selected, the instructor cannot view students' iPad screens in the Classroom application.
      
      This check box is cleared by default.
- Restrictions on the Storage tab:
  - In the General section:
    - Prohibit access to USB devices in Files
      If the check box is cleared, the user can access connected USB devices in the Files app.
      
      If the check box is selected, access to connected USB devices in the Files app is blocked.
      
      The setting is available for mobile devices running iOS 13.1 or later.
      
      This check box is cleared by default.
    - Disable access to USB devices when the device is locked
      Specifies whether USB Restricted Mode is enabled when the device is locked.
      
      If the check box is selected, then when the device is locked, connections to USB drives are limited by USB Restricted Mode.
      
      If the check box is cleared, the device is allowed to connect to USB drives when locked.
      
      The setting is available for mobile devices running iOS 11.4.1 or later.
      
      This check box is cleared by default.
- Restrictions on the Network tab:
  - In the General section:
    - Prohibit use of NFC
      If the check box is cleared, the use of NFC is allowed.
      
      If the check box is selected, the use of NFC is disabled.
      
      The setting is available for mobile devices running iOS version 14.2 or later.
      
      This check box is cleared by default.
    - Prohibit creating VPN configurations
      If the check box is cleared, the user can create a VPN configuration on the managed device.
      
      If the check box is selected, the user can't create a VPN configuration on the managed device.
      
      The setting is available for mobile devices running iOS version 11 or later.
      
      This check box is cleared by default.
    - Prohibit modifying eSIM settings
      Selecting or clearing this check box specifies whether the device user can change settings related to the carrier plan.
      
      The restriction is supported on devices with iOS 11 and later.
      
      The check box is cleared by default.
  - In the Wi-Fi section:
    - Force Wi-Fi on
      Specifies whether Wi-Fi on the managed device should be always on. The device can connect to any Wi-Fi network.
      
      If the check box is selected, Wi-Fi on the device is always on, even in flight mode. The user cannot disable Wi-Fi in the device settings.
      
      If the check box is cleared, the user can disable Wi-Fi in the device settings.
      
      The setting is available for mobile devices running iOS version 13 or later.
      
      This check box is cleared by default.
    - Force connection to allowed Wi-Fi networks only
      Specifies whether the device can connect to allowed Wi-Fi networks only. This option is available if you add at least one Wi-Fi network to the list of Wi-Fi networks in the Wi-Fi section.
      
      If the check box is selected, the device connects to allowed Wi-Fi networks only. The user cannot disable Wi-Fi in the device settings.
      
      If the check box is cleared, the user can connect to any Wi-Fi network.
      
      The setting is available for mobile devices running iOS version 14.5 or later.
      
      This check box is cleared by default.
    - Prohibit modifying Personal Hotspot settings
      If the check box is cleared, the device user can modify Personal Hotspot settings.
      
      If the check box is selected, the device user cannot modify Personal Hotspot settings.
      
      The setting is available for mobile devices running iOS 12.2 or later.
      
      This check box is cleared by default.
  - In the Bluetooth section:
    - Prohibit modifying Bluetooth settings
      If the check box is cleared, the user can modify Bluetooth settings on the mobile device.
      
      If the check box is selected, Bluetooth settings cannot be modified on the mobile device.
      
      The setting is available for mobile devices running iOS 11 or later.
      
      This check box is cleared by default.
  - In the Cellular section:
    - Prohibit automatic sync while roaming
      Prohibit automatic synchronization of user data when the iOS MDM device is roaming.
      
      If the check box is cleared, the user can enable automatic data synchronization when the device is roaming. Enabling automatic synchronization in roaming can result in unexpected mobile service costs.
      
      If the check box is selected, the user is not allowed to use automatic data synchronization when the device is roaming.
      
      This check box is cleared by default.
    - Prohibit modifying cellular settings
      Ability to configure cellular network data transfer by apps installed on a mobile device.
      
      If the check box is cleared, the user can configure the settings for data transfer over a cellular network.
      
      If the check box is selected, the settings for cellular network data transfer by apps cannot be modified.
      
      This check box is cleared by default.
- Restrictions on the Additional settings tab:
  - In the Display section:
    - Prohibit changing wallpaper
      Ability to select the image that will be displayed on the lock screen or Home screen.
      
      If the check box is cleared, the user can select the wallpaper for the mobile device.
      
      If the check box is selected, wallpaper selection is not available.
      
      This check box is cleared by default.
  - In the Text section:
    - Prohibit spellcheck
      Use of spellcheck when entering text on a mobile device. The spellcheck function underlines incorrectly spelled words and suggests corrections.
      
      If the check box is cleared, the user can enable and use the spellcheck function.
      
      If the check box is selected, spellcheck is not available when entering text.
      
      This check box is cleared by default.
    - Prohibit auto-correction
      Use of the auto-correct function when entering text.
      
      If the check box is cleared, the user can enable and use the auto-correct function.
      
      If the check box is selected, auto-correct is not available when entering text.
      
      This check box is cleared by default.
    - Prohibit dictionary search
      Use of a dictionary to get the definitions of words on the mobile device. Only a software keyboard has a dictionary function.
      
      If the check box is cleared, the user can highlight any word on the screen of the mobile device and get the definition of that word.
      
      If the check box is selected, dictionary search is not available.
      
      This check box is cleared by default.
  - In the Keyboard section:
    - Prohibit predictive text
      Use of the predictive text input function. The predictive text input function shows options for completing words and suggestions based on available dictionaries.
      
      If the check box is cleared, the user can enable and use the predictive text input function.
      
      If the check box is selected, the predictive text function is not available. In this case, suggestions are not displayed when entering text.
      
      This check box is cleared by default.
    - Prohibit keyboard shortcuts
      Use of keyboard shortcuts for quick access to mobile device functions.
      
      If the check box is cleared, the user can enable the keyboard shortcut function and use it when working with the mobile device.
      
      If the check box is selected, the keyboard shortcut function is not available.
      
      This check box is cleared by default.
  - In the Notifications section:
    - Prohibit Wallet on-screen notifications when screen is locked
      Use of Wallet notifications on the lock screen of the iOS MDM device.
      
      If the check box is cleared, Wallet notifications are displayed on the lock screen of the mobile device.
      
      If the check box is selected, Wallet notifications are not displayed on the lock screen of the mobile device. To work with Wallet, the user must unlock the device.
      
      This check box is cleared by default.
    - Hide Control Center when screen is locked
      Ability to go to the Control Center of the iOS MDM device when the device is locked.
      
      If the check box is cleared, the user can go to the Control Center when the device is locked.
      
      If the check box is selected, the user cannot go to the Control Center when the device is locked.
      
      This check box is cleared by default.
    - Hide Notification Center when screen is locked
      Ability to go to the Notification Center of the iOS MDM device when the device is locked.
      
      If the check box is cleared, the user can go to the Notification Center by swiping the lock screen down.
      
      If the check box is selected, the user cannot go to the Notification Center when the device is locked.
      
      This check box is cleared by default.
    - Hide Today View when screen is locked
      Display of information from the Today View on the screen of a locked iOS MDM device. The Today section of the Notification View shows the following information:
      
      Calendar events
      Reminders
      Stock prices
      Weather
      If the check box is cleared, the user can view notifications from the Today View on a locked mobile device.
      
      If the check box is selected, the Today View is not displayed on the locked mobile device.
      
      This check box is cleared by default.
    - Prohibit modifying notification settings
      Ability to configure the display of notifications on the mobile device.
      
      If the check box is cleared, the user can configure the settings for displaying notifications on the mobile device.
      
      If the check box is selected, the display of notifications cannot be configured.
      
      This check box is cleared by default.
- Restrictions on the OS update tab:
  - In the General section:
    - Delay software updates (days)
      Allows delaying operating system updates on the device.
      
      If the check box is selected, the user cannot access updates for the specified period. The default delay is 30 days. You can specify another period in the Number of days from 1 to 90 field.
      
      If the check box is cleared, the user can update the software as soon as updates are available.
      
      The setting is available for mobile devices running iOS version 11.3 or later.
      
      This check box is cleared by default.
Click OK.
Click Save to save the changes you have made.

As a result, feature restrictions will be configured on the user's mobile device after the policy is applied.

Configuring app restrictions

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select iOS and go to the Restrictions section.
On the App restrictions card, click Settings.
The App restrictions window opens.
Enable the settings using the App restrictions toggle switch.
Configure iOS MDM device app restrictions.
List of app restrictions
Restrictions in the Safari section:
- Allow use of Safari
  Use of the Safari browser on the iOS MDM device.
  
  If the check box is selected, the user is allowed to use the Safari browser.
  
  If the check box is cleared, the user is not allowed to use the Safari browser. The Safari icon is hidden on the home screen of the iOS MDM device.
  
  This check box is selected by default.
- Allow AutoFill
  Saving and autofilling of data entered by the user in web forms in the Safari browser.
  
  If this check box is selected, user data entered in web forms is saved. Later it is automatically inserted in web forms.
  
  If this check box is cleared, user data is not inserted in web forms.
  
  This check box is selected by default.
- Warn the user when visiting a dangerous website
  Option that enables a user warning prior to a visit to a website that Kaspersky Mobile Devices Protection and Management has found to be dangerous.
  
  If the check box is selected, Kaspersky Mobile Devices Protection and Management warns a user attempting to visit a dangerous website.
  
  If the check box is cleared, Kaspersky Mobile Devices Protection and Management does not warn a user attempting to visit a dangerous website.
  
  This check box is cleared by default.
- Allow JavaScript
  Use of JavaScript by the Safari browser.
  
  If the check box is selected, the Safari browser uses JavaScript when opening web pages.
  
  If the check box is cleared, the Safari browser does not use JavaScript when opening web pages.
  
  This check box is selected by default.
- Block pop-up windows
  Blocking of pop-up windows in the Safari browser.
  
  If this check box is selected, Kaspersky Mobile Devices Protection and Management blocks pop-up windows in the Safari browser.
  
  If this check box is cleared, Kaspersky Mobile Devices Protection and Management does not block pop-up windows in the Safari browser.
  
  This check box is cleared by default.
- Cookie settings
  Select the condition for accepting cookies:
  - Allow cookies and website tracking. The Safari browser accepts cookies and allows tracking user activity.
  - Allow cookies and block website tracking. The Safari browser accepts cookies and blocks tracking user activity.
  - Block cookies and website tracking. The Safari browser blocks cookies and tracking user activity.
  The default value is Allow cookies and website tracking.
Restrictions in the Game Center section:
- Allow use of Game Center
  Access to the Game Center gaming service from the Game Center app on an iOS MDM device.
  
  If the check box is selected, the user can visit the Game Center gaming service from the Game Center app on the mobile device.
  
  If the check box is cleared, the user cannot visit the Game Center gaming service from the Game Center app on the mobile device. The Game Center icon is hidden on the home screen of the iOS MDM device.
  
  This check box is selected by default.
- Allow adding friends in Game Center
  An option that allows adding users in the Game Center gaming service on the iOS MDM device.
  
  If the check box is selected, the user can add other users in the Game Center gaming service on the mobile device.
  
  If the check box is cleared, the user is not allowed to add other users in the Game Center gaming service on the mobile device.
  
  This check box is selected by default.
- Allow multiplayer games in Game Center
  Use of the Game Center gaming service in multiplayer mode on the iOS MDM device.
  
  If the check box is selected, the user can participate in multiplayer games in the Game Center gaming service on the mobile device.
  
  If the check box is cleared, the user is not allowed to participate in multiplayer games in the Game Center gaming service on the mobile device.
  
  If the check box is cleared, users can still play games together via SharePlay or a third-party service.
  
  This check box is selected by default.
Restrictions in the Additional settings section:
- Allow use of iTunes Store
  Access to the iTunes Store media service from the iTunes app on an iOS MDM device.
  
  If the check box is selected, the user can view, buy, and download media content from the iTunes Store using the iTunes app on the mobile device.
  
  If the check box is cleared, the user cannot view, buy, and download media content from the iTunes Store using the iTunes app on the mobile device. The iTunes icon is hidden on the home screen of the iOS MDM device.
  
  This check box is selected by default.
- Allow use of News
  Viewing of news on the user's mobile device using the News app.
  
  If the check box is selected, the user can view news using the News app.
  
  If the check box is cleared, the News app is not available to the user.
  
  This check box is selected by default.
- Allow use of Podcasts
  Listening to podcasts on the user's mobile device using the Podcasts app.
  
  If the check box is selected, the user can search, play, and download podcasts using the Podcasts app.
  
  If the check box is cleared, podcasts cannot be downloaded to the mobile device.
  
  This check box is selected by default.
Click OK.
Click Save to save the changes you have made.

As a result, app restrictions will be configured on the user's mobile device after the policy is applied.

Configuring content restrictions

Categories used for content restrictions are determined by Apple. In some cases, when content restrictions are configured, actual results may differ from expected results.

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select iOS and go to the Restrictions section.
On the Content restrictions card, click Settings.
The Content restrictions window opens.
Enable the settings using the Content restrictions toggle switch.
Configure iOS MDM device content restrictions.
List of content restrictions
Region

Selection of the country whose rating system is automatically applied to media content on the iOS MDM device.

The default value is United States.

Settings in the Age rating section:
- Videos
  Selection of the restriction rating for access to movies on the iOS MDM device.
  
  The list of ratings depends on the region selected.
  
  If the Allow all option is selected, the user can view any movies on the mobile device.
  
  The Allow all option is selected by default.
- TV shows
  Selection of the restriction rating for access to TV shows on the iOS MDM device.
  
  The list of ratings depends on the region selected.
  
  If the Allow all option is selected, the user can view any TV shows on the mobile device.
  
  The Allow all option is selected by default.
- Apps
  Selection of the restriction rating for access to third-party apps on the iOS MDM device.
  
  The list of ratings depends on the rating system selected.
  
  If the Allow all option is selected, the user can use any third-party apps on the mobile device.
  
  The Allow all option is selected by default.
  
  App restrictions may be enforced even if the Allow all option is selected. This is due to an issue known to Apple.
- Allow downloading erotica in Apple Books
  Access to adult content in Book Store on the user's mobile device.
  
  If the check box is selected, the user can download adult content from the Apple Books app to the iOS MDM device.
  
  If the check box is cleared, the user cannot download adult content from the Apple Books app to the iOS MDM device.
  
  This check box is selected by default.
- Allow explicit content
  Access to explicit media content from the iTunes Store on the iOS MDM device. Restrictions are applied by iTunes Store providers.
  
  If the check box is selected, explicit media content purchased via iTunes Store is available to the mobile device user.
  
  If the check box is cleared, explicit media content purchased via iTunes Store is hidden from the mobile device user.
  
  This check box is selected by default.
Click OK.
Click Save to save the changes you have made.

As a result, content restrictions will be configured on the user's mobile device after the policy is applied.

Page top

Configuring user access to websites

This section contains instructions on how to configure access to websites on Android and iOS devices.

In this section

Configuring access to websites on Android devices

Configuring access to websites on iOS MDM devices

Page top

Configuring access to websites on Android devices

You can use Web Control to configure Android device users' access to websites. Web Control supports website filtering by categories defined in the Kaspersky Security Network cloud service. Filtering allows you to restrict user access to certain websites or categories of websites (for example, "Gambling, lotteries, sweepstakes" or "Internet communication"). Web Control is enabled by default.

Web Control on Android devices is supported only in Google Chrome, HUAWEI Browser, Samsung Internet, and Yandex Browser.

On corporate devices, if Kaspersky Endpoint Security for Android is not enabled as an Accessibility feature, Web Control is supported only in Google Chrome and checks only the domain of a website. To allow other browsers (Samsung Internet, Yandex Browser, and HUAWEI Browser) to support Web Control, enable Kaspersky Endpoint Security as an Accessibility feature. This will also let you use the Custom Tabs feature.

If Kaspersky Endpoint Security for Android is not enabled as an Accessibility feature and a proxy is enabled in the Google Chrome settings card, Web Control will not work.

To configure the settings for device users' access to websites:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select Android and go to the Security controls section.
On the Web Control card, click Settings.
The Web Control window opens.
Select one of the following options:
- If you want the app to restrict user access to websites depending on their content, do the following:
  1. In the Operating mode drop-down list, in the drop-down list select Prohibit websites in selected categories.
  2. In the Categories section, create a list of prohibited categories by selecting the check boxes next to the categories of websites to which the app will block access.
- If you want the app to allow or block user access only to specified websites, do the following:
  1. In the Operating mode drop-down list, select Allow only listed websites or Allow all websites except listed ones.
  2. Click Add.
  3. In the window that opens, create a list of websites to which the app will allow or block access, depending on the value selected in the drop-down list. You can add websites by link (full URL, including the protocol, for example, https://example.com).
    To make sure that the app allows or blocks access to the specified website in all supported versions of Google Chrome, HUAWEI Browser, Samsung Internet, and Yandex Browser include the same URL twice — once with the HTTP protocol (for example, http://example.com) and once with the HTTPS protocol (for example, https://example.com).
    
    For example:
    - https://example.com — The main page of the website is either allowed or blocked. This URL can only be accessed through the HTTP protocol.
    - http://example.com — The main page of the website is either allowed or blocked, but only when accessed through the HTTP protocol. Other protocols like HTTPS are not affected.
    - https://example.com/page/index.html — Only the index.html page of the website will be allowed or blocked. The rest of the website is not affected by this entry.
    The app also supports regular expressions. When entering the address of an allowed or forbidden website, use the following templates:
    - https://example\.com/.* — This template blocks or allows all child pages of the website, accessed via the HTTPS protocol (for example, https://example.com/about).
    - https?://example\.com/.* — This template blocks or allows all child pages of the website, accessed via both the HTTP and HTTPS protocols.
    - https?://.*\.example\.com — This template blocks or allows all subdomain pages of the website (for example, https://pictures.example.com).
    - https?://example\.com/[abc]/.* — This template blocks or allows all child pages of the website where the URL path begins with 'a', 'b', or 'c' as the first directory (for example, https://example.com/b/about).
    - https?://\w{3,5}.example\.com/.* — This template blocks or allows all child pages of the website where the subdomain consists of a word with 3 to 5 characters (for example, http://abde.example.com/about).
    Use the https? expression to select both the HTTP and HTTPS protocols. For more details on regular expressions, please refer to the Oracle Technical Support website.
  4. Click Add.
- If you want the app to block user access to all websites, in the Operating mode section, in the drop-down list, select Prohibit all websites.
If you want the app to check the full URL when opening a website in Custom Tabs, select the Check full URL when using Custom Tabs check box.
Custom Tabs is an in-app browser that allows the user to view web pages without having to leave the app and switch to a full web browser version. This option provides better URL recognition and checks URLs against the configured Web Control rules. If the check box is selected, Kaspersky Endpoint Security for Android opens the website in a full version of the browser and checks the whole web address of the website. If the check box is cleared, Kaspersky Endpoint Security for Android checks only the domain of the website in Custom Tabs.

The Custom Tabs feature is supported in Google Chrome, HUAWEI Browser, and Samsung Internet.
If you want to lift content-based restrictions on user access to websites, disable the settings using the Web Control toggle switch and click Disable.
Click OK.
Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Managing the website list

You can manage the list of websites with the following buttons:

Add — Click to add a website to the list by entering a URL or regular expression.
Upload — Click to add multiple websites to the list by specifying a TXT file that contains the required URLs or regular expressions. The file must be encoded in UTF-8. URLs or regular expressions in the file must be separated by semicolons or line breaks.
Edit — Click to change the address of a website.
Delete — Click to remove one or more websites from the list.

Page top

Configuring access to websites on iOS MDM devices

These settings apply to supervised devices.

Configure Web Control settings to control access to websites for iOS MDM device users. Web Control manages users' access to websites based on lists of allowed and forbidden websites. Web Control also lets you add website bookmarks on the bookmark panel in Safari.

By default, access to websites is not restricted.

If a URL is redirected to a different website, Web Control checks only the redirect target.

To configure settings for device users' access to websites:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select iOS and go to the Security controls section.
On the Web Control card, click Settings.
The Web Control window opens.
Enable the settings using the Web Control toggle switch.
In the Operating mode drop-down list do one of the following:
- If you want to create a list of allowed websites, select Allow only listed websites.
- If you want to create a list of forbidden websites, select Allow all websites except listed ones.
Do one of the following:
- If you want to add websites manually:
  1. Click Add:
  2. Add websites to which the app will allow or block access, depending on the value selected in the drop-down list.
    The website address should begin with http:// or https://. Kaspersky Mobile Devices Protection and Management allows or blocks access to all websites in the domain. For example, if you add http://www.example.com to the list of allowed websites, access is allowed http://pictures.example.com and http://example.com/movies.
    
    If you want to add an allowed website to bookmarks in Safari on mobile devices, select the Add to bookmarks on device check box below the website address.
  3. Click Add.
- If you want to upload a TXT file with a list of websites, click Upload.
  The TXT file must be saved with the UTF-8 encoding and LF or CR+RF line breaks.
Click OK.
Click Save to save the changes you have made.

As a result, once the policy is applied, Web Control will be configured on the mobile devices.

Page top

Compliance Control

This section contains instructions on how to monitor the compliance of devices with corporate requirements and configure compliance control rules.

In this section

Compliance Control of Android devices

Compliance Control of iOS MDM devices

Page top

Compliance Control of Android devices

You can control Android devices for compliance with corporate security requirements. Corporate security requirements regulate how the user can work with the device. For example, the real-time protection must be enabled on the device, the anti-malware databases must be up-to-date, and the device password must be sufficiently strong. Compliance Control is based on a list of rules. A compliance rule includes the following components:

Device check criterion (for example, absence of blocked apps on the device).
Time period allocated for the user to fix the non-compliance (for example, 24 hours).
Responses performed on the device if the user does not correct the non-compliance issue within the set time period (for example, lock the device).
If the device is in battery saver mode, Kaspersky Endpoint Security for Android may perform this task later than specified.

To create a rule for checking devices for compliance with a policy:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select Android and go to the Security controls section.
On the Compliance Control card, click Settings.
The Compliance Control window opens.
Enable the settings using the Compliance Control toggle switch.
In the When non-compliance is detected section:
- Select the Notify user check box to inform the user that the device does not comply with the policy.
  If the check box is cleared, the user is not notified of the non-compliance issue, and the response is performed on the device as soon as the time allocated for fixing the non-compliance expires.
- Select the Notify the administrator through the "Events" section check box to inform the administrator that the device does not comply with the policy.
Click Add.
The Add rule wizard starts. This wizard will help you create a set of rules for checking the device compliance with the policy. Navigate through the wizard using the Next and Back buttons.

Step 1. Criterion for non-compliance

Click Add criterion to specify the non-compliance criterion to trigger the rule.

The following criteria are available:

Real-time protection is disabled
Kaspersky Endpoint Security for Android is not installed or running on the device.
Anti-malware databases on device are out of date
Anti-malware databases were last updated 3 or more days ago.
Forbidden apps are installed
The list of apps on the device contains apps that are set as forbidden in the App Control settings of the policy.
Apps from forbidden categories are installed
The list of apps on the device contains apps from the categories that are set as forbidden in the App Control settings of the policy.
Not all required apps are installed
The list of apps on the device does not contain an app that is set as required in the App Control settings of the policy.
Operating system version is outdated
The Android version on the device is outside the allowed range.

For this criterion, specify the minimum and maximum allowed versions of Android in the Minimum version and Maximum version fields. If the maximum allowed version is set to Any, future Android versions supported by Kaspersky Endpoint Security for Android will also be allowed.
Device has not been synchronized for a long time
The last synchronization of the device with the Administration Server is checked.

For this criterion, specify the maximum period after the last synchronization in the Period without synchronization field.
Device has been rooted
The device is hacked (root access is gained on the device).
Unlock password is not compliant with security settings specified in policy
The unlock password on the device is not compliant with the settings defined in the Screen unlock settings card.
Installed version of Kaspersky Endpoint Security for Android is outdated
Kaspersky Endpoint Security for Android installed on the device is obsolete.

This criterion applies only to an app installed using a Kaspersky Endpoint Security for Android installation package and if the minimum allowed version of Kaspersky Endpoint Security for Android is specified in the App update settings of the policy.
SIM card usage is not compliant with security requirements
The device SIM card has been replaced or removed compared to the previous check state, or an additional SIM card has been inserted.

For this criterion, select the specific condition that must be monitored:
- The SIM card must not be replaced or removed
- The SIM card must not be replaced or removed; additional SIM cards must not be inserted
Device location
The device is outside the specified geofence areas.

Specifying the geofence area will result in increased device power consumption.

For this criterion, select the specific condition that must be monitored:
- The device is within a specified geofence (the geofence areas are combined using the OR logical operator).
- The device is outside specified geofences (the geofence areas are combined using the AND logical operator).
To add a geofence area:
1. Click Add geofences.
  The Add geofences window opens.
2. Specify the Geofence name.
3. Specify the geofence perimeter by entering a latitude and a longitude for each point.
  For each geofence area, you can manually enter from 3 to 100 coordinate pairs (latitude, longitude) as decimal numbers.
  
  A geofence perimeter must not contain intersecting lines.
  
  If needed, you can specify more than 3 points by clicking the Add point button.
  
  To delete a point, click the X button.
  
  You can view the specified geofence area in the Yandex.Maps program by clicking View on map.
4. Click OK to add the specified geofences.
Kaspersky Endpoint Security for Android has no access to precise or background location
Kaspersky Endpoint Security for Android is not allowed to access the precise location of the device or use the device location in the background.

Step 2. Responses for non-compliance with security requirements

Add the responses to be performed on the device if the specified non-compliance criterion is detected.

Choose one of the following options:

Add instant response. The response is applied instantly after the non-compliance criterion is detected.
Add deferred response. The response is applied after a deferral period that you can specify in the Deferral period field.
The following responses are available:
- Block all apps except system apps
  All apps on the device, except system apps, are blocked from starting.
  
  As soon as the non-compliance criterion selected for the rule is no longer detected on the device, the apps are automatically unblocked.
- Lock device
  The mobile device is locked. To obtain access to data, you must unlock the device by entering the one-time passcode or using the Unlock device command.
- Wipe corporate data
  The corporate data is wiped from the device. The list of wiped data depends on the mode in which the device operates:
  - On a personal device, Knox profile and mail certificate are wiped.
  - On a corporate device, Knox profile and the certificates installed by Kaspersky Endpoint Security for Android (mail, VPN, and SCEP profile certificates, except the mobile certificates) are wiped.
  - Additionally, on a device with corporate container, the container (its content, configurations, and restrictions) and the certificates installed in it (mail, VPN, and SCEP profile certificates, except the mobile certificates) are wiped.
- Reset to factory settings
  All data is wiped from the device and settings are rolled back to their factory values. After this response is performed, the device will no longer be managed. To connect the device to Kaspersky Security Center, you must reinstall Kaspersky Endpoint Security for Android.
  
  On devices running Android 14 or later, this response is only applicable if the device is operating in corporate device mode.
- Lock corporate container
  Corporate container on the device is locked. To obtain access to corporate container, you must unlock it.
  
  The response is only applicable to devices running Android 6 or later.
  
  After the corporate container on a device is locked, the history of the container passwords is cleared. It means that the user can specify one of the recent passwords, regardless of the corporate container password settings.
- Wipe data of all apps
  On a corporate device, data of all apps on the device is wiped.
  
  On a device with corporate container, data of all apps in the container is wiped.
  
  As a result, apps are rolled back to their default state.
  
  The response is only applicable to devices running Android 9 or later in corporate device or device with corporate container operating modes.
- Wipe data of a specified app
  For this response, you need to specify the package name for the app whose data is to be wiped. How to get the package name of an app
  To get the name of an app package:
  1. Open Google Play.
  2. Find the app and open its page.
  The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).
  
  To get the name of an app package that has been added to Kaspersky Security Center:
  1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps.
  2. Click Android apps.
    In the list of apps that opens, app identifiers are displayed in the Package name column.
  As a result, the app is rolled back to its default state.
  
  The response is only applicable to devices running Android 9 or later in corporate device or device with corporate container operating modes.
- Prohibit safe boot
  The user is not allowed to boot the device in safe mode.
  
  The response is only applicable to corporate devices running Android 6 or later.
- Prohibit use of camera
  The user is not allowed to use any cameras on the device.
- Prohibit use of Bluetooth
  The user is not allowed to turn on and configure Bluetooth settings.
  
  The response is only applicable to personal devices running Android 12 or earlier, corporate devices, or devices with corporate container.
- Prohibit use of Wi-Fi
  The user is not allowed to use and configure Wi-Fi settings.
  
  The response is only applicable to personal devices running Android 9 or earlier or corporate devices.
- Prohibit USB debugging features
  The user is not allowed to use USB debugging features and developer mode on the device.
  
  The response is only applicable to corporate devices or devices with corporate container.
- Prohibit airplane mode
  The user is not allowed to enable airplane mode on the device.
  
  The response is only applicable to corporate devices running Android 9 or later.

Click Add rule to finish the Add rule wizard. The new rule and its details appear in the list of the Compliance Control rules. To temporarily disable a rule, use the toggle switch next to the selected rule.

To enable the automatic wiping of data from devices associated with disabled accounts of Active Directory users, select the Wipe data from devices with disabled Active Directory user accounts check box and select one of the following actions:

Wipe corporate data
Reset to factory settings
On devices running Android 14 or later, this action is only applicable if the device is operating in corporate device mode.

These settings require integration with Microsoft Active Directory.

If you use policy profiles, be sure to enable the wipe data option for the entire policy. When a user account is disabled in Active Directory, it is first removed from the Active Directory user group. As a result, the policy profile is no longer applied to this user account, so the data is not wiped from the device.

Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Page top

Compliance Control of iOS MDM devices

Expand all | Collapse all

Compliance Control lets you monitor iOS MDM devices for compliance with corporate security requirements and take actions if non-compliance is found. Compliance Control is based on a list of rules. Each rule includes the following components:

Status (whether the rule is enabled or disabled).
Non-compliance criteria (for example, absence of the specified apps or the operating system version).
Responses performed on the device if the user does not correct the non-compliance issue within the set time period (for example, wipe corporate data or send an email message to the user).

To create a rule for checking devices for compliance with a policy:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select iOS and go to the Security controls section.
On the Compliance Control card, click Settings.
The Compliance Control window opens.
Enable the settings using the Compliance Control toggle switch.
Click Add.
The Add rule wizard starts. This wizard will help you create a set of rules for checking the device compliance with the policy. Navigate through the wizard using the Next and Back buttons.

Step 1. Criterion for non-compliance

Click Add criterion to specify the non-compliance criterion to trigger the rule.

The following criteria are available:

List of installed apps
The list of apps on the device contains forbidden apps or does not contain required apps.

For this criterion, select a condition (Contains or Does not contain) and specify the Bundle ID of the app. How to get the bundle ID of an app
To get the bundle ID of a built-in iPhone or iPad app,

Follow the instructions in the Apple documentation.

To get the bundle ID of any iPhone or iPad app:
1. Open the App Store.
2. Find the required app and open its page.
  The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).
3. Copy this identifier (without the letters "id").
4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.
  This downloads a text file.
5. Open the downloaded file and find the "bundleId" fragment in it.
The text that directly follows this fragment is the bundle ID of the required app.

To get the bundle ID of an app that has been added to Kaspersky Security Center:
1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps.
2. Click iOS apps.
  In the list of apps that opens, app identifiers are displayed in the Bundle ID column.
Operating system version
The version of the operating system on the device is outside the allowed range.

For this criterion, select a condition (Equal to, Not equal to, Earlier than, Earlier than or equal to, Later than, or Later than or equal to) and specify the iOS version.

Note that the Equal to and Not equal to operators check for a full match of the operating system version with the specified value. For instance, if you specify iOS 15 in the rule, but the device is running iOS 15.2, the Equal to criterion is not met. If you need to specify a range of versions, you can create two criteria and use the Earlier than and Later than operators.
Supervision status
The supervision status of the device is not the one required.

For this criterion, select the device operating mode (Supervised or Basic control).
Device type
The device type is not the one required.

For this criterion, select a device type (iPhone or iPad).
Device model
The device model is not the one required.

For this criterion, select a condition (Equal to or Not equal to) and specify models that will be checked or excluded from the check, respectively.

To specify a model, in the Model identifier field, select the required model from the list or enter a value manually. The list contains mobile device codes and their matching product names. For example, if you want to add all iPhone 14 models, type "iPhone 14". In this case, you can select any of the available models: "iPhone 14", "iPhone 14 Plus", "iPhone 14 Pro", "iPhone 14 Pro Max".

In some cases, the same product name may correspond to several mobile device codes (for example, the "iPhone 7" product name corresponds to two mobile device codes, "iPhone 9.1" and "iPhone 9.3"). Be sure that you select all of the mobile device codes that correspond to the required models.

If you enter a value that is not on the list, nothing will be found. However, you can click Add: "<value>" under the field to add the entered value to the criterion.

If you specify the criteria that contradict each other (for example, Device type is set to iPhone but the list of values of Device model, with the Equal to operator selected, contains an iPad model), an error message is displayed. You cannot save a rule with such criteria.
Roaming
The device roaming status is not the one required.

For this criterion, select a condition (Device is roaming or Device is not roaming).
Password on device
A password is not set or not compliant with the settings specified in the Screen unlock settings card.

For this criterion, select a condition (Not set, Set but not compliant, or Set and compliant).
Free storage on device
The amount of free space on the device is less than the specified threshold.

For this criterion, specify the threshold amount of free space (Less than or equal to), and then select the measurement unit (MB or GB).
Device is not encrypted
The device is not encrypted.

Data encryption is enabled by default on password-locked iOS devices (Settings > Touch ID / Face ID and Password > Enable Password). Also, the hardware encryption on a device must be set to At block and file level (you can check this setting in the device properties: go to Assets (Devices) → Mobile → Devices, and then select the required device).
Actions with SIM card
The device SIM card has been replaced or removed compared to the previous check state, or an additional SIM card has been inserted.

For this criterion, select a condition (The SIM card must not be replaced or removed or The SIM card must not be replaced or removed; additional SIM cards must not be inserted).

On eSIM compatible devices, the non-compliance detection cannot be removed by inserting the previously removed eSIM. This is because the device operating system recognizes each added eSIM as a new one. In this case, delete the compliance control rule from the policy.
Device has not been synchronized for a long time
The last synchronization of the device with iOS MDM Server is checked.

For this criterion, specify the maximum time after the last sync in the Period without synchronization field, and then select the measurement unit (Hours or Days).

We do not recommend that you specify a value less than the value of the Synchronization period (min) setting specified in the iOS MDM Server settings.

Step 2.Responses for non-compliance with security requirements

Add the responses to be performed on the device if the specified non-compliance criterion is detected.

Choose one of the following options:

Add instant response. The response is applied instantly after the non-compliance criterion is detected.
Add deferred response. The response is applied after a deferral period that you can specify in the Deferral period field.
Responses are performed during the compliance rule check, which happens every 40 minutes, and persist until the next synchronization with the iOS MDM Server. To prevent repeating responses from a single non-compliance instance, set the Synchronization period (min) value to 30 minutes in the iOS MDM Server settings.

If you specify responses that contradict each other, an error message is displayed. You cannot save such a rule.

When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the response by sending the respective command to the device.

The following responses are available:
- Send a message to the user
  The user is informed about the non-compliance by email.
  
  For this response, specify user email addresses in the Email and Alternate email address fields. If necessary, you can also edit the email subject and default text.
  
  Make sure the Email notifications are configured in the Administration Server properties. For detailed information on configuring notifications delivery, refer to the Kaspersky Security Center Help.
- Wipe corporate data
  All installed configuration profiles, provisioning profiles, the device management profile, and apps for which the Remove when device management profile is deleted check box has been selected are removed from the device. This response is performed by sending the Wipe corporate data command.
- Modify profile
  For this response, specify one of the actions:
  - Install profile. The configuration profile is installed on device. This action is performed by sending the Install configuration profile command. For this response, you also need to specify the ID of the profile to be installed.
    Before the profile is installed, it must be added to the list of configuration profiles in the Configuration profiles section of the iOS MDM Server settings.
  - Delete specified profile. The configuration profile is deleted from the device. This response is performed by sending the Delete configuration profile command. For this action, you also need to specify the ID of the profile to be deleted.
  - Delete all profiles. All previously installed configuration profiles are deleted from the device.
    When the non-compliance criteria selected for the rule are no longer detected on the device, you can install the deleted configuration profiles one by one, by sending the respective command to the device.
- Update operating system
  For this response, specify the OS version and one of the actions:
  - Download and install. The device operating system is downloaded and installed.
    If a non-existent operating system version is specified in the Operating system version criterion, the device will upgrade to the latest downloaded operating system.
  - Download only. The device operating system is downloaded.
  - Install only. The previously downloaded operating system is installed.
  This response is only applicable to supervised devices.
- Modify Bluetooth settings
  For this response, specify whether you want to enable or disable Bluetooth on the device.
  
  This response is only applicable to supervised devices.
- Reset to factory settings
  All data is deleted from the device and the settings are rolled back to their default values. After this response is performed, the device will no longer be managed. To connect the device to Kaspersky Security Center, you must reinstall the device management profile on it.
- Modify apps
  For this response, specify one of the actions:
  - Delete specified app. The specified app is removed from the device.
    You can delete only a managed app. An app is considered managed if it has been installed through Kaspersky Security Center by executing the Install app command.
    
    When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the response by sending the respective command to the device.
    
    For this action, specify the Bundle ID of the app to be deleted. How to get the bundle ID of an app
    To get the bundle ID of a built-in iPhone or iPad app,
    
    Follow the instructions in the Apple documentation.
    
    To get the bundle ID of any iPhone or iPad app:
    1. Open the App Store.
    2. Find the required app and open its page.
      The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).
    3. Copy this identifier (without the letters "id").
    4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.
      This downloads a text file.
    5. Open the downloaded file and find the "bundleId" fragment in it.
    The text that directly follows this fragment is the bundle ID of the required app.
    
    To get the bundle ID of an app that has been added to Kaspersky Security Center:
    1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps.
    2. Click iOS apps.
      In the list of apps that opens, app identifiers are displayed in the Bundle ID column.
  - Delete all apps. All managed apps are deleted from the device.
    You can delete only managed apps. An app is considered managed if it has been installed through Kaspersky Security Center by executing the Install app command.
    
    When the non-compliance criteria selected for the rule are no longer detected on the device, you can install the deleted apps one by one, by sending the respective command to the device.
    
    For this action, specify the Bundle ID of the apps to be deleted. How to get the bundle ID of an app
    To get the bundle ID of a built-in iPhone or iPad app,
    
    Follow the instructions in the Apple documentation.
    
    To get the bundle ID of any iPhone or iPad app:
    1. Open the App Store.
    2. Find the required app and open its page.
      The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).
    3. Copy this identifier (without the letters "id").
    4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.
      This downloads a text file.
    5. Open the downloaded file and find the "bundleId" fragment in it.
    The text that directly follows this fragment is the bundle ID of the required app.
    
    To get the bundle ID of an app that has been added to Kaspersky Security Center:
    1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps.
    2. Click iOS apps.
      In the list of apps that opens, app identifiers are displayed in the Bundle ID column.
- Delete profile of specified type
  For this response, specify the Profile type to be deleted from the device (for example, Web Clips or Calendar subscriptions).
  
  As soon as the non-compliance criteria selected for the rule are no longer detected on the device, the deleted profiles are automatically restored.
- Modify roaming settings
  For this response, specify whether you want to enable or disable data roaming on the device.

Click Add rule to finish the Add rule wizard. The new rule and its details appear in the list of Compliance Control rules. To temporarily disable a rule, use the toggle switch next to the selected rule.

Wipe corporate data
Reset to factory settings
These settings require integration with Microsoft Active Directory.

If you use policy profiles, be sure to enable the wipe data option for the entire policy. When a user account is disabled in Active Directory, it is first removed from the Active Directory user group. As a result, the policy profile is no longer applied to this user account, so the data is not wiped from the device.

Click Save to save the changes you have made.

Page top

App Control

This section contains instructions on how to configure user access to apps on a mobile device.

In this section

App Control on Android devices

App Control on iOS MDM devices

Page top

App Control on Android devices

Expand all | Collapse all

The App Control component lets you manage apps on Android devices and configure use of these apps to keep the devices secure.

You can restrict user activity on a device on which forbidden apps are installed or required apps are not installed (for example, by locking the device). You can impose restrictions using the Compliance Control component. To do so, in the rule settings, you must select the Forbidden apps are installed, Apps from forbidden categories are installed, or Not all required apps are installed criterion.

Kaspersky Endpoint Security for Android must be set as an Accessibility feature to ensure proper functioning of App Control. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or later disable this service in the device settings. If the user does this, App Control will not run.

On corporate devices, you have extended control over the device. App Control operates without notifying the device user:

Required apps are installed automatically in the background. To install apps silently, you need to specify a link to the APK file of the required app in the policy settings.
Forbidden apps can be deleted from the device automatically. To delete apps silently, you need to select the Remove forbidden apps automatically check box in the policy settings.

To configure app startup settings on the mobile device:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select Android and go to the Security controls section.
On the App Control card, click Settings.
The App Control window opens.
Enable the settings using the App Control toggle switch.
Configure the settings on the following tabs:
- If you want to configure general rules of app management, go to the App use tab.
  1. In the Operating mode drop-down list, select the App Control mode:
    - To allow the user to start all apps except those specified as blocked in the list of categories and apps, select Use all apps except forbidden ones. Kaspersky Endpoint Security for Android will hide icons of forbidden apps. This option is selected by default.
    - To allow the user to start only apps specified in the list of categories and apps as allowed, recommended, or required apps, select Use only allowed apps. Kaspersky Endpoint Security for Android will hide icons of all apps except those specified in the list of allowed, recommended, or required apps and system apps.
  2. If you want Kaspersky Endpoint Security for Android to send data on forbidden apps to the event log without blocking them, select the Do not block forbidden apps, only add a record to the event log check box.
  3. If you want Kaspersky Endpoint Security for Android to block startup of system apps (such as Calendar, Camera, and Settings) on the user's mobile device, select the Block system apps check box. This check box is displayed in the Use only allowed apps mode.
    We recommend that you do not block system apps because doing so could cause the device to malfunction.
    
    Before removing Kaspersky Endpoint Security for Android from the device, clear this check box or disable App Control.
  4. If you want Kaspersky Endpoint Security for Android to remove forbidden apps from the device in the background without notifying the user, select the Remove forbidden apps automatically check box. This check box is displayed in policies for managing corporate devices.
  5. Click Add to add apps and categories for which you want to set rules.
    The Add app or category window opens.
  6. In the Object field, select either App or App category and do the following:
    - If you selected App, select an installation package or specify the package name and the app name in the corresponding fields.
    - If you selected App category, select a category and enter a description in the corresponding fields.
    - Click Add.
    The app or category is added to the list.
  7. If you want to configure exceptions from listed forbidden or allowed apps, click Exceptions, specify package names in the window that opens, and click OK.
  8. If you want to receive reports on installed apps, in the Report on installed apps section, select the Send data on installed apps check box. Then you can select the following check boxes:
    - Send data on built-in apps to send data on system apps.
    - Send data on service apps to send data on service apps that have no user interface and cannot be started manually.
    If a system app or service app is configured in the App Control settings, app data is sent regardless of the state of the check boxes.
    
    Kaspersky Endpoint Security for Android sends data to the event log each time an app is installed on a device or removed from it.
- If you want to set actions to be performed for selected apps, go to the App management tab.
  1. In the Actions for apps table, click Add.
  2. In the window that opens, do the following:
    1. In the Action field select one of the following actions:
      Install. The user will be prompted to install the app.
      Remove. The app will be deleted from the user's device.
      Recommend installation. The user will receive a recommendation to install the app.
    2. Fill in the following fields:
      Package name
      App name
      Link
      Links to app packages must start with http:// or https://.
      
      Version
      This field is a string parameter specified in the format of Oracle regular expressions. For more details on regular expressions, please refer to the Oracle Technical Support website.
      
      The Link and Version fields are not displayed if you select Remove in the Action field.
    3. Click Add.
  The configured action is added to the list.
Click OK.
Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Page top

App Control on iOS MDM devices

Expand all | Collapse all

These settings apply to supervised devices.

Kaspersky Security Center lets you manage apps on iOS MDM devices to keep these devices secure. You can create a list of apps allowed to be installed on devices and a list of apps prohibited from being displayed and launched on devices.

To configure the list of apps allowed or prohibited to be installed on devices:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select iOS and go to the Security controls section.
On the App Control card, click Settings.
The App Control window opens.
Enable the settings using the App Control toggle switch.
In the Operating mode field, select one of the following options:
- Use all apps except forbidden ones
  All apps will be displayed and available to run on the device except the ones from the list.
- Use only allowed apps
  This option is selected by default. If you select this option, the user will be able to open only the following apps on the device:
  - Apps in the list
  - System apps
  All other apps will be hidden.
Click Add to add apps to the list.
In the window that opens, specify the app's bundle ID in the corresponding field. Specify the com.apple.webapp value to allow or restrict all Web Clips. How to get the bundle ID of an app
To get the bundle ID of a built-in iPhone or iPad app,

Follow the instructions in the Apple documentation.

To get the bundle ID of any iPhone or iPad app:
1. Open the App Store.
2. Find the required app and open its page.
  The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).
3. Copy this identifier (without the letters "id").
4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.
  This downloads a text file.
5. Open the downloaded file and find the "bundleId" fragment in it.
The text that directly follows this fragment is the bundle ID of the required app.

To get the bundle ID of an app that has been added to Kaspersky Security Center:
1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps.
2. Click iOS apps.
  In the list of apps that opens, app identifiers are displayed in the Bundle ID column.
If necessary, you can specify several bundle IDs by clicking the Add bundle ID button.
Click Save.
Click OK.
Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with the iOS MDM Server.

As a result, once the policy is applied, the specified settings for apps are configured on devices.

Page top

Mobile device protection levels

Mobile device protection levels defined by Kaspersky Security Center

Web Console lets you quickly assess the current protection level of managed mobile devices in the Assets (Devices) → Mobile → Devices section.

A device can have one of the following protection levels: OK, Warning, or Critical.

The protection levels are assigned and sent to Kaspersky Security Center, in accordance with the following requirements:

One reason for assigning a protection level is detected on the device — the device gets the status displayed in the list of managed devices.
Multiple reasons for assigning protection levels are detected on the device — Kaspersky Mobile Devices Protection and Management assigns the most critical status.

No reasons for assigning a protection level are detected on the device — Kaspersky Mobile Devices Protection and Management does not send a status to Kaspersky Security Center, and the status is set as OK.

Protection levels and their meanings

Protection level	Meaning
OK	An administrator's intervention is not required.
Warning	Events have been logged that are related to potential or actual threats to the security of managed devices.
Critical	Serious problems have been encountered. An administrator's intervention is required to solve them.

The administrator's goal is to ensure that the OK protection level exists on all devices.

Mobile device protection levels defined by Kaspersky Mobile Devices Protection and Management

Kaspersky Mobile Devices Protection and Management defines the protection level of mobile devices based on policy settings and then sends the protection levels to Kaspersky Security Center during synchronization. The administrator can change the protection level in the policy, depending on the severity level of the condition (see the Default values, reasons, and conditions for assigning a protection level on Android devices table). In this case, the value set by the administrator overrides the default value defined by Kaspersky Mobile Devices Protection and Management.

Default values, reasons, and conditions for assigning a protection level on Android devices

Condition	Reason for protection level	Default value
Real-time protection is not running	One of the following reasons: The Access to manage all files permission has not been granted. Kaspersky Security Network is switched off.	Critical
Web Protection and Web Control are not running	One of the following reasons: The Accessibility permission has not been granted. Web Protection was switched off by the user in Kaspersky Endpoint Security settings. The Ignore battery optimization permission has not been granted. The Web Protection Statement has not been accepted.	Warning
App Control is not running	The Accessibility permission has not been granted.	Warning
Device lock is not available	One of the following reasons: The Device administrator permission has not been granted. The Accessibility permission has not been granted. The app is not enabled to overlay other windows.	Warning
Device location is not available	One of the following reasons: The Location permission has not been granted. The device location cannot be determined (when permission is granted).	Warning
Versions of the Kaspersky Security Network Statement do not match	The version of the Kaspersky Security Network Statement that the user accepted in the policy and the version of the Kaspersky Security Network Statement on the device do not match.	Warning
Versions of the Marketing Statement do not match	The version of the Statement regarding data processing for marketing purposes that the user accepted in the policy and the version of the Statement regarding data processing for marketing purposes on the device do not match.	OK

Page top

Software inventory on Android devices

You can take an inventory of apps on Android devices connected to the Administration Server. Kaspersky Endpoint Security for Android receives information about all apps installed on mobile devices. Information obtained while taking inventory is displayed in the device properties in the Events section. In this section, you can view detailed information on each installed app.

To enable software inventory:

In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
In the policy properties window, select Application settings.
Select Android and go to the Security controls section.
On the App Control card, click Settings.
The App Control window opens.
In the Report on installed apps section, select the Send data on installed apps check box.
If you want to receive data about system apps, select the Send data on built-in apps check box.
If you want to receive data about service apps, which do not have an interface and cannot be opened by the user, select the Send data on service apps check box.
Click OK.
Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. Kaspersky Endpoint Security for Android sends data to the event log each time an app is installed or removed from the device.

Page top

Contents

Control

Configuring restrictions

Configuring restrictions for personal Android devices

Configuring iOS MDM device restrictions

Configuring user access to websites

Configuring access to websites on Android devices

Configuring access to websites on iOS MDM devices

Compliance Control

Compliance Control of Android devices

Compliance Control of iOS MDM devices

App Control

App Control on Android devices

App Control on iOS MDM devices

Mobile device protection levels

Software inventory on Android devices