4. Policies

Access: view — Admin Editor Analyst Teacher; Custom / company role*. Permission: list policies.

Reading access labels: tags identify standard roles whose definitions include the stated permission. Each action’s availability depends on the user’s effective permissions, company, groups, enabled features and policy restrictions. Custom and company roles depend on assigned permissions. If access is unavailable, ask an administrator to check Settings > Platform Users. A section’s label covers its controls unless an action has its own condition. Viewing does not authorize changes or execution; a label does not guarantee that a command will be accepted or completed.

Application: Portal Nomid MDM Document: V3.2.0 Last updated: 26/08/2026 Editorial owner: Nomid MDM Documentation Last editorial review: 26/08/2026 Editorial language: en-US

Use Policies to define applications, network settings, security, and managed Android device behavior. A policy describes the desired state; the result on a device depends on platform compatibility, permissions, connectivity, and a later synchronization.

For VR/Pico headset policies, see 4.1 Policies for VR/Pico.

Before you begin: open https://portal.nomid.tech/, confirm the active company, and work only on an authorized policy. Saving may create a revision and start distribution to linked devices. This guide shows how to review controls, but it does not instruct you to confirm destructive actions.

Quick route

• Find and open a policy
• Edit without losing control
• Apps and Home Screen
• Settings App
• Network
• Device Settings
• Security
• Remote Access
• Geofencing
• Application Schedules
• Contact Lists
• Data Collection
• History
• Troubleshoot

Find and open a policy

Access: view — Admin Editor Analyst Teacher; Custom / company role*. Permission: list policies.

Open Policies from the main menu. The page brings together the list or grid, the count, and the controls available to your role. Names, counts, and states are dynamic; confirm the current value before making a decision.

Overview of policies available in the active company.

Switch between Policies and Groups

Access: view — Admin Editor Analyst Teacher; Custom / company role*. Permission: list policies.

Use Policies to review or open policies. Use Groups to view the groups available in the workspace. Switching tabs changes only the Portal view; it does not change a policy or device association.

Switching between the Policies and Groups views.

Review groups

Access: view — Admin Editor Analyst Teacher; Custom / company role*. Permission: list policies.

On the Groups tab, use Search groups to find a group by name. The list has Group, Policies, Devices, and Actions columns. Check the name and displayed counts; values vary with the company and the context available to your profile.

Excerpt of the group list showing six example rows. The counters reflect the moment shown.

Select the group name to open its page. This link is for navigation; it is separate from the policy's group assignment selector. Description is not a column in this list: review the group's context on its dedicated page.

Group page

After opening a group, check its name in the heading and breadcrumb. The registered name in this example is Ativas. The page brings together counters, search, and a table of the group's policies.

Ativas page showing the first three example policies; the image does not show the complete table.

Read the description when one is available. In this example, no description has been entered and Add description appears. To review policies, use Search and open a policy through its name link, such as Legados in the example. This opens the policy for viewing; it does not change its group assignment. To return to the group list, use Groups in the breadcrumb.

Search, filter, and sort

Access: view — Admin Editor Analyst Teacher; Custom / company role*. Permission: list policies.

Use the visible search field and filters before browsing the list. Sorting changes the presentation, not policy configuration.

Controls that narrow and organize the list without changing policies.

Read the card and open actions

Access: view — Admin Editor Analyst Teacher; Custom / company role*. Permission: view the policy.

The card summarizes the name, state, and related counts. The actions menu offers only operations allowed in that context. A count represents the displayed moment and does not guarantee that every device has received the latest revision.

Summary and entry point for policy actions.

Review policy information and the current group

Access: view — Admin Editor Analyst Teacher; Custom / company role*. Permission: view the policy.

Open policy information to review Description and Tags. The folder selector shows the current group, such as the registered name Ativas in the image; its name varies by organization. Reviewing this information does not change the group or policy settings.

Policy information and the group currently shown by the folder selector.

Change group

Access: edit — Admin Editor; Custom / company role*. Permission: edit the policy.

In the policy summary, select the current group button to open the group list. Use the search field to find a group; the check mark identifies the current group. To inspect the list only, leave the search field empty and do not select another destination. Close it with the X and check that the same group remains in the summary.

Choosing another destination prepares a confirmation; confirming requests the group change. These actions are separate from opening and closing the dialog. Moving a policy changes its organization in Portal and depends on effective permissions; saving the other policy settings is not required to submit this change. If the summary has pending edits, resolve them before trying to move the policy.

Group list: the check mark identifies the current group; the X closes the selector.

Understand menu actions

Access: Based on permissions. Permission: each action below requires its own authorization; viewing or editing a policy does not automatically authorize commands, provisioning or deletion.

Opening the menu does not execute an action. Check the target and close the next form or modal with Cancel or X when you are only reviewing it.

Available menu actions

Restart, lock, and clear-password commands are asynchronous requests aimed at the set filtered by policy. Check status and time later in Devices; an initial Portal message does not prove delivery or success.

In the policy header, open Actions to review the available commands. All Settings opens the settings set in the same block.

Policy command menu in the block header.

View associated devices

Access: view — Admin Editor Analyst Teacher; Custom / company role*. Permission: list devices.

Use View devices to check the current policy scope. The result may be a drawer inside Policies or, depending on the current interface state, a Devices list already filtered by policy. When the list opens, continue in 3. Devices to search, select, open device details, or run commands.

Associated-device consultation without opening an individual device page; an empty central scroll area was omitted to compact the image.

Do not generalize the displayed count or assume that every policy always opens the same destination. Confirm the current title, filter, and count.

Edit without losing control

Access: edit — Admin Editor; Custom / company role*. Permission: edit the policy.

Select Edit, use the side navigation to reach the required block, and change only the intended item. The order below follows the active Portal tree.

Save or discard the edit

Access: edit — Admin Editor; Custom / company role*. Permission: edit the policy.

Save

Discard

Android policies for tablets and smartphones

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

From this point, sections follow the Android editor order through History. VR/Pico headset policies use a separate editor, described in 4.1 Policies for VR/Pico.

Apps and Home Screen

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

The Portal organizes this section into mode, availability, apps, controls, appearance, and dock. Library supplies the apps; here you define how they appear, receive permissions, and participate in the managed experience.

Editor navigation and revision actions.

Mode

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Launcher type and kiosk experience in the Tablet-20260625 policy.

Launcher type

Kiosk experience

Guidance: When blocking it, keep a support path that can restart or power off the device without that button.

Power button

Guidance: Use the least access that still supports the required journey and recovery.

System navigation

Guidance: Keep system information when the operator needs network, battery, or time details; hide the bar only in a validated kiosk journey.

Status bar

Guidance: Keep warnings when users or support need to react; mute only in a validated, monitored kiosk.

System error warnings

Guidance: If blocking access, first confirm an authorized maintenance path that does not depend on local settings.

Device settings access

Redirect app

Guidance for Eligible policy app: Use an app that has been tested and is available offline or has assured connectivity; Single-app mode requires both this app and the maintenance password.

Prevent the kiosk app from opening other apps

Guidance: Generate and store it in a secure channel. Never publish it in manuals, examples, or screenshots.

Kiosk maintenance password

App availability

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

App lists and availability in the Tablet-20260625 policy.

Launcher Play Store mode

Source filter

Apps

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Apps included in the policy

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

The Apps in this policy list contains applications already linked to the current configuration. It is the main element in this part of the editor: first find and identify the item, then select its card to open its settings. If the app is not included yet, use Add and see 5. Library. To start a new policy, see 9. New Policy.

The policy app list is the starting point for finding, identifying, and selecting the item to configure.

Search by app name or package

All / specific origin

Installation category

Name and package name

Origin

Card state

Select the card

Set default app

Add from Nomid Store / Play Store

Create Web App / Add Secure Web App / Add from Package

Firefox example:

1. Installation, permissions, or managed configuration: search for Firefox, verify org.mozilla.firefox and the Play Store origin, select the card, and use the open panel.
2. Default browser: return to the list, choose Add > Set default app, select Browser, the applicable scope, and Firefox. This path assigns the app to the role; it is not performed in the app card panel.

After distributing the policy to a pilot device, open a link and observe which browser actually handles it. The saved value and synchronization alone do not prove the effective browser. If Firefox is not included yet, see 5. Library before continuing.

Selected app settings

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Use this box to define how an application already included in the policy is installed, displayed, updated, and authorized on the device. The groups below belong to the same application card; some appear only for compatible sources, versions, or management modes.

Installation, state, update, and permission settings for an application in the policy.

Installation type

Launcher visibility

App state

Default permission

Minimum version

Auto-update

Individual grant

The individual-grant list is dynamic: it depends on permissions declared by the current application version. Do not create an exception for a permission that is not available on the card.

In this box, an agent is an authorized administrative application, not a person. Keep Unspecified unless the vendor or technical owner formally requires a scope for that application.

Delegated administrative scopes

Personal/work connection

Work-profile widgets

Always-on VPN lockdown

Nomid app environment

Testing tracks

App managed configuration

When the app schema accepts dynamic variables, use the policy tokens documented in Using Dynamic Variables in Managed Configurations. They can insert the policy name, path name, or version without repeating a fixed value. If the corresponding information is unavailable, the token resolves to empty text; validate the result on a pilot device.

Expand or collapse

Edit Secure Web App

Remove

Credentials, advanced installation constraints, certificates, and extensions may exist in specific platform flows, but they are not exposed as general controls on this card in the current Portal version.

Managed configuration uses the schema published by the app; fields and values vary by package and version.

Default app role

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy. Use compatible packages installed in the selected scope. The assignment defines role, priority, and scope; in-app settings remain in the Manage applications card.

Default app role

Guidance for Browser: For example, you can keep the installed browser as the first package and manage it in the policy, or place another compatible browser first to change the default candidate.

Guidance: Select only scopes that are actually managed in the fleet.

Default app scope

App for the role

Guidance for App compatible with the role: Use only when the app declares the role and is installed in the selected scope.

Priority among apps for a default role

Default-role and scope compatibility

• Assistant: Accepts the Fully managed scope. Use an app that declares the assistant role.
• Browser: Accepts Fully managed, Work profile, and Personal profile. Select only profiles where the browser is installed and managed.
• Call redirection or screening: Accepts Fully managed and Work profile. Requires telephony support and an app compatible with the corresponding role.
• Dialer: Accepts Fully managed, Work profile, and Personal profile. Validate calls, SIM, and permissions in each selected profile.
• Home: Accepts Fully managed and is unavailable when Nomid Launcher or Nomid Kiosk already controls Home. Do not create a second Home association that conflicts with the policy launcher.
• SMS: Accepts Fully managed and Personal profile. Use only where SMS and a compatible app are available.
• Wallet: Accepts Fully managed, Work profile, or Personal profile; work and personal cannot be combined in the same setting. Choose one profile consistent with wallet provisioning.

Type, scopes, and applications

• Type: Chooses a role currently available in the Portal. Each type can appear only once in the policy.
• Scopes: Limits the assignment to Fully managed, Work profile, or Personal profile according to role compatibility.
• Applications: Adds eligible packages from the policy or a confirmed package name. Order matters: the first package is preferred and the remaining packages are ordered candidates.
• Move up/down and remove: Reorders priority, removes a candidate, or deletes the entire role without editing the application's internal settings.

Guidance for Applications: The Portal requires at least one package and one scope to submit the setting.

Guidance for Move up/down and remove: Review the first package before saving because it represents the submitted preference.

Validate and recover: after distribution, confirm on the device and in the later state recorded by the Portal that installation, version, permissions, and availability match the expected result. The Portal confirms the saved value and the progress it can report, not the app's complete operation. If the result is unsuitable, return to the previous value or restore an earlier policy revision in the policy itself or in History, then synchronize again.

Permissions and relaunch

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

App permissions and relaunch settings in the Tablet-20260625 policy.

Portal label: Default permission policy

Launcher default permission policy

This is the same global permission policy shown under Permissions and relaunch and App & Permission Controls; these are not independent defaults. The restriction below does not apply to an application's default or to individual permission rules.

Google Play Protect verification enforced

Google Play Protect verification requirement enabled in the existing Legados policy.

The state shown belongs to the Legados policy. It does not indicate the default for a new policy or confirm that the setting has been applied on the device.

Individual permission

Guidance for Permission declared by the app: The list depends on the app manifest; do not create an individual rule when no permission is declared.

Individual permission treatment

App relauncher

Guidance: Select only a tested app installed as required; do not enable the relauncher without an app.

Relauncher app

Guidance: Use the longest interval that meets operational needs; excessive frequency can interrupt legitimate tasks.

Relauncher interval

Guidance: Use the smallest reviewed domain set; do not include paths or wildcards without confirming the accepted format.

Allowed domains

Back button

Pull to refresh

Autofill

Clear data on exit

Secure Browser status bar

Navigation bar

Prevent screenshots

Guidance: Use a period compatible with data sensitivity and actual task duration.

Session timeout

Screen orientation

Guidance: Use only when the web system depends on this marker; do not include personal identity or secrets.

User-Agent suffix

Appearance

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Launcher appearance in the Tablet-20260625 policy.

For the general variable reference, see Using Dynamic Variables in Managed Configurations.

Launcher label

Launcher label field and insertion buttons in the Legados policy. The field is empty.

Under Appearance, use Launcher label to configure the text displayed on the launcher, with up to four lines and 512 characters. The insertion buttons add references to the following data:

For the Wi-Fi MAC address, the tokens %macaddress% and %mac_address% represent the reported value and resolve to an empty value when it is unavailable. Do not rely on this value as a permanent physical identifier. Before including identifiers in visible text, consider who can read the screen.

In this example, the gray hint containing %devicename% is not saved text: the counter shows 0/512. A token is a reference in the editor; a local preview does not prove that it expands on the device. Check the final text on the device when validating the policy.

Font color

Icon size

Wallpaper

Show serial number

Preview screen type

Dock

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Layout & Dock in the Tablet-20260625 policy.

App order

Guidance: Reserve for frequent tasks. The item must be available in the policy and cannot be hidden or blocked.

Dock apps

System shortcuts

Hiding or marking a system shortcut unavailable removes only the shortcut or icon shown in the launcher area. If the corresponding app is also explicitly included in the policy, it can remain in the grid; to remove it, apply the block or exclusion to the app itself. An explicit app block takes precedence over its inclusion.

Settings App

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

This area controls the administrative password and availability of buttons shown by the Nomid Settings app. Do not record the password in the manual or screenshots.

Administrative password and button availability in the Nomid Settings app.

Password

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Administrative Settings app password in the Tablet-20260625 policy.

Guidance: Use a password managed outside the manual and screenshots. Without a valid password, protected buttons do not provide controlled maintenance.

Settings app password

Buttons

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

First eight Button Availability controls in the Tablet-20260625 policy; the tables below cover all 17 controls.

Choose the state of each button. The same three-state rule applies throughout the list:

Local

When to use: The exact function depends on the installed version; confirm it on a pilot device.

Native settings

When to use: It can provide broad system access; prefer password protection on restricted devices.

Checkup

When to use: Use the result as a diagnostic; it does not replace checking the device in the Portal.

Flashlight

When to use: It requires compatible hardware and may consume battery.

Policy

When to use: Displayed information depends on the app version and policy received.

Store

When to use: Available items depend on the company catalog and permissions.

Device

When to use: Review which information is available to the user before allowing access.

Brightness

When to use: It may conflict with operations that require fixed brightness; test it with screen restrictions.

Bluetooth

When to use: The policy may restrict Bluetooth; validate with approved peripherals.

Login

When to use: Do not expose credentials in the manual or screenshots.

Wi-Fi

When to use: A local change may interrupt the management network; keep a recovery path.

Secure Wi-Fi

When to use: It depends on the app version and company-provided configuration.

Delay relauncher

When to use: Use only in a tested maintenance process and confirm when the launcher takes control again.

Device Portal QR

When to use: The QR may reveal an address or identifier; do not expose it in public screenshots.

IMEI barcode

When to use: The IMEI identifies the device and must be treated as restricted data.

Serial barcode

When to use: The serial identifies the device and must be treated as restricted data.

Exit kiosk

When to use: Keep it password protected and validate the return-to-kiosk procedure beforehand.

Validate and recover: on a pilot device, open only the expected buttons and confirm when the password is requested. The Portal confirms the saved value and available synchronization progress, not the full behavior of every button. If the result differs from expectations, return to the previous value or restore the previous revision and check the next synchronization in 3. Devices.

Network

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Configure Wi-Fi profiles, connection autonomy, APN, VPN, proxy, and radio restrictions. An incompatible choice can remove connectivity; preserve a recovery path before restricting the network used for management.

The Network area starts with Wi-Fi networks and connection settings.

Wi-Fi networks

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Representative privacy-safe view of the Wi-Fi Networks box; the tables below cover its settings and options without exposing network identifiers.

Profile name/GUID

SSID

Wi-Fi network security

Password/key

Connect automatically

Wi-Fi profile type

Wi-Fi settings

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Wi-Fi settings and mobile sharing.

Configure WiFi Settings

WiFi Direct Settings

Defines whether this policy leaves Wi-Fi without a specific instruction, lets the user choose, or keeps the radio always on or off.

The WiFi State selector inside Wi-Fi settings.

WiFi State

Validate and recover: after distribution and synchronization, check on the device whether Wi-Fi can be changed and whether it keeps the selected state. The value saved in the Portal does not prove connectivity. If access is lost, restore the previous policy value or revision and validate again on a pilot device before wider distribution.

Minimum WiFi Security Level

Mobile sharing

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Representative upper segment of the Mobile & Sharing box in the Tablet-20260625 policy; the tables below also cover ultra wideband and cellular 2G.

Configure hotspot (tethering) settings

USB Data Access

Airplane Mode State

Ultra Wideband State

2G Cellular State

APN

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

The APN box contains the replacement control and the settings that appear when the feature is enabled.

An APN is the profile a device uses to access a carrier's mobile-data services. This box should replace carrier profiles only when every official parameter is known; an incorrect configuration can prevent mobile data, MMS, or auxiliary services.

APN replacement enabled locally and the templates available in the carrier selector.

Override APNs

APN carrier

The static templates are Claro, Vivo, TIM, Oi, Algar Telecom (CTBC), Sercomtel, Nextel (Claro NXT), Correios Celular (MVNO), Fluke, and Salvy. For a manual APN, leave the carrier selector empty and use Add Custom APN.

A custom APN form with visible fields and sample entries.

Example text shown inside empty fields is not submitted as a value. Enter only official parameters supplied by the carrier.

Display name

APN

Username

Password

Select only types supplied by the carrier; the combination determines which services can use the profile.

APN types

The searchable labels in this group are APN authentication, APN protocol, and Roaming protocol.

APN authentication

APN protocol

Roaming protocol

The searchable groups in this part are Always-on APN, MVNO type, and APN network types.

Do not choose these parameters by trial and error. Use only official carrier values and test the profile on a pilot device before wider distribution.

Carrier ID

Numeric Operator ID

MCC

MNC

MMSC

MMS proxy address

MMS proxy port

Proxy address

Proxy port

IPv4 MTU

IPv6 MTU

Always-on APN

MVNO type

APN network types

APN options configure the profile sent by the policy; availability and the device result depend on Android, the modem, the carrier, and management mode. Confirm connectivity after distribution without exposing credentials.

Validate and recover: validate mobile data and required services on a pilot device first. The Portal confirms the saved configuration and the state it can report, but not that the carrier accepted every parameter. If connectivity fails, restore the previous configuration or revision in the policy itself or in History and confirm recovery before distributing again.

VPN

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Complete VPN box in the Tablet-20260625 policy. Always-on VPN is not shown in the current state and remains documented in the table as a conditional setting.

Always-on VPN lockdown

Always-on VPN app source

VPN package name

Remove VPN app

Global proxy

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Complete Global Proxy box in the Tablet-20260625 policy, with the toggle turned off. Host, URL, credential, and exception fields appear only when the setting is enabled and remain documented in the tables.

Global proxy

Proxy bypass hosts

Guidance for One or more hostnames: Use for internal services or services incompatible with the proxy. Do not include protocol, password, or path when the field expects only a host.

Global proxy host

Global proxy port

PAC URL

Advanced restrictions

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Complete Advanced Restrictions box in the Tablet-20260625 policy. Seven controls are on; network escape hatch is off.

Bluetooth configuration

Cell-broadcast configuration

Tethering configuration

Mobile-network configuration

VPN configuration

Credential configuration

Network escape hatch

Network reset

Device Settings

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

The blocks follow the Portal screen: device controls, display and lock, permissions, update, users, and hardware. Confirm compatibility before restricting local maintenance, access, or recovery.

Device controls in the editor.

Device controls

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Device Controls in the Tablet-20260625 policy. The six toggles and media volume mode are shown in the policy's current state.

Enable camera

Enable screen capture

Enable fun features

Enable volume adjustment

Enable Bluetooth

Enable SMS

Skip first-use hints

Display and lock

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Display and Lock in the Tablet-20260625 policy. In this observed state, Brightness Level is 255 and Timeout Duration is 1800; effects, supported limits, and configuration decisions remain explained by the tables.

Stay awake while plugged in

Brightness mode

Screen timeout

App permission controls

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Default permission policy, window creation, and lock-screen controls in the Tablet-20260625 policy.

Portal label: Default permission policy

Device default permission policy

This is the same global permission policy shown under Permissions and relaunch and App & Permission Controls; these are not independent defaults. The restriction below does not apply to an application's default or to individual permission rules.

Guidance: Use only for the feature that must be unavailable before unlock; All Features has the broadest impact.

Disabled keyguard features

Prevent window creation

Disable keyguard

System update

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

System update preferences and periods.

System update preference

Guidance: Use for critical periods. Overlapping periods or dates outside Android rules may be rejected.

Freeze periods

Guidance: Use a value compatible with risk and task length; shorter values improve security but may interrupt work.

Maximum time to lock

User controls

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Controls to add and remove users, set the user icon, and set the wallpaper in the Tablet-20260625 policy.

Prevent adding users

Prevent removing users

Prevent changing user icon

Prevent changing wallpaper

Hardware Controls

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Hardware Controls in the Tablet-20260625 policy; the image shows all six controls materialized in the Portal.

Prevent factory reset

Prevent safe boot

Prevent physical media

Allow debugging features

Prevent account changes

Prevent unmuting microphone

Validate and recover: apply first to a pilot device and observe the expected screen, permission, update, and hardware behavior. The Portal confirms configuration and available synchronization, not every physical effect. If access is lost or behavior is unexpected, return to the previous value or restore the previous revision and monitor the device in 3. Devices.

Security

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Review access, restrictions, installation, automatic responses, passwords, keys, and allowed services in the displayed order. Quarantine, wipe, and blocking require impact assessment and a recovery path.

Device restrictions.

Access and recovery

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Access, credentials, and recovery.

Factory-reset protection emails

Guidance for Authorized Google account: Use recoverable organization admin accounts; do not publish real addresses in examples or screenshots.

Device login method

Login requirement

Set this after choosing PIN or SSO. With None, the Portal keeps the requirement at Not required and does not allow it to be changed.

Authentication Method set to None and Login requirement set to Not required.

SSO access scope

Guidance: Do not enter a value or claim expiration is applied while the field remains disabled.

SSO session expiration — coming soon

Lock-screen message

Guidance for Lock-screen message: Use this message for identification, return contact, or a short instruction; do not include secrets or unnecessary personal data.

Device Restrictions

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Five controls materialized in the Device Restrictions box of the Tablet-20260625 policy. Location sharing remains documented in the table because it is not shown in the current state.

Bluetooth contact sharing

Data roaming

Outgoing NFC beam

Outgoing calls

Location sharing

USB file transfer

App, Location & Install Policies

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Five rows materialized in the App, Location & Install Policies box of the Tablet-20260625 policy.

Automatic app updates

Encryption policy

Location mode

Untrusted app installation

Workflow actions

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

High-impact action confirmation.

Compromised-OS action

Unknown-OS action

Hardware-backed evaluation failure action

Enforcement rules

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Automatic security rules.

Guidance: Choose the smallest scope that meets the requirement; Device may also affect personal use.

Enforcement-rule scope

Monitored setting

Affected packages

Guidance for Android package name: Use the app's exact package name; an empty list must not be assumed to mean a global rule.

Password requirements

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Empty state materialized in the Password requirements box of the Tablet-20260625 policy. Configurable requirements remain detailed in the tables because they are not shown in this image.

Guidance: Use Profile to isolate business requirements when supported; use Device when the whole device needs the same protection.

Password scope

Guidance: Choose the lowest quality that meets the security policy and test accessibility, input method, and recovery.

Password quality

Strong unlock

Choose private key rule

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Natural state of the Choose private key rule box in the Tablet-20260625 policy: selection disabled, no configured rules, and the add action visible.

Private-key selection

Permitted accessibility services

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Natural state of the Permitted accessibility services box in the Tablet-20260625 policy: two configured internal apps and four visible add actions.

Guidance: Include only approved, necessary services; an incorrect list can block legitimate assistive technology.

Permitted accessibility services

Permitted input methods

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Natural state of the Permitted input methods box in the Tablet-20260625 policy: no configured apps and four visible add actions.

Guidance: Keep at least one tested, functional input method; a wrong list can prevent typing and recovery.

Permitted input methods

Validate and recover: for reversible actions, such as restrictions and a quarantine request, use a pilot device and check the effective state in 3. Devices before broadening the scope. Saving or distributing the policy does not prove effective blocking or quarantine. Do not trigger Wipe/Clear device only for testing. Restoring the previous value or revision prevents new requests, but it cannot recover data that has already been erased. If a wipe was executed, route the device through the applicable authorized reprovisioning or recovery procedure.

Remote Access

Access: edit — Admin Editor; Custom / company role*. Permission: edit the policy configuration; operating a device session requires separate command, screenshot or remote access permissions.

These controls prepare the policy for Nomid Remote; they do not start a session. To connect, obtain consent, and operate the session, see Nomid Remote.

Policy remote-access settings.

Remote access

Start on boot

Auto-confirm screen capture

Keep screen awake during session

Allow access while locked

Verification method

Guidance: Never expose it in manuals or screenshots; follow Portal validation requirements and organizational rotation.

Permanent password

Auto-sync password

Lock advanced settings

Validate and recover: on a pilot device, confirm availability, consent, verification, and session closure. The Portal confirms the saved configuration and available synchronization, not session success. If the result is unsuitable, return to the previous value or revision; to start and operate a session, see Nomid Remote.

Geofencing

Access: view — Admin Editor Teacher; edit — Admin Editor; Custom / company role*. Permission: view geofencing; edit geofencing.

Define the event and area the Portal should evaluate. The map teaches the general area; precise addresses and personal data do not belong in screenshots.

Geofencing area and conditions.

Location

Access: view — Admin Editor Teacher; edit — Admin Editor; Custom / company role*. Permission: view geofencing; edit geofencing.

Natural state of the Location box in the Tablet-20260625 policy: empty name and no notification event selected.

Geofence notification type

Geofence name

Geofence description

Latitude

Longitude

Radius

Coordinates and map

Access: view — Admin Editor Teacher; edit — Admin Editor; Custom / company role*. Permission: view geofencing; edit geofencing.

Geofence latitude, longitude, and radius fields in the Tablet-20260625 policy; the empty map without a marker was omitted.

Guidance: Adding or removing persists only after saving; review name, coordinates, radius, and event.

Add

Remove

Application Schedules

Access: view — Admin Editor Teacher; edit — Admin Editor; Custom / company role*. Permission: view app schedules; edit app schedules.

Use days and windows to limit when covered apps are available. Confirm time behavior in the actual environment before distributing an operational schedule.

Application schedule windows.

Time windows

Guidance for Days and start/end interval: Use clear operating hours; confirm time zone and behavior for intervals that cross midnight.

Schedule name

Default rule

Schedule apps

Day

Start

End

Monday through Sunday

Day with no window

Add window

Copy to all

Remove all windows for the day

Workdays

Study hours

Evenings

Clear all

Contact Lists

Access: view — Admin Editor; edit — Admin Editor; Custom / company role*. Permission: view contact lists in the policy; change the lists used by the policy.

Assign only lists that are already managed. To create, import, or maintain contacts, see 5. Library; this policy only defines the assignment.

The Contact Lists area shows the lists distributed by the policy.

To open the modal shown next, select Add contact lists. In the modal, review the available lists, select the ones to assign, and only then select Apply. Until that confirmation, no list is added to the policy edit.

The modal shows the lists available for selection before the assignment is applied and added to the policy edit.

Add contact lists

Remove

Available contact lists

Guidance for Contact list from the Library: Use lists authorized for the covered audience. Removing the association does not delete the original list.

Guidance: Maintain the list in the Library and use only authorized data; removing the association does not delete the original list.

Contact list

Data Collection

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Choose only the data needed for support, inventory, or auditing. More collection increases exposure and retention; align each item with an authorized purpose.

Data collection controls.

Status reporting

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Apps report level in the Tablet-20260625 policy; the Included device data and Usage statistics boxes are outside this image.

Guidance: Use the lowest level required for inventory and auditing, respecting privacy and retention.

Application report level

Device reporting

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Device-data categories included in reporting for the Tablet-20260625 policy; the details and effects of each setting appear in the tables that follow.

Device settings

Display information

Hardware status

Memory information

Network information

Power-management events

Software information

System properties

Usage data

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Usage Statistics: three periodic collectors followed by their interval, then event-driven Bluetooth and Wi-Fi connections.

Enable only the categories needed for your analysis, taking privacy and retention into account. The first three use the collection interval; the two connection controls follow events, not that interval.

Apps usage

Mobile data usage

Wi-Fi data usage

Collection Interval (Minutes)

Choose a frequency that serves the analysis you need; shorter intervals may increase traffic, battery use and stored data.

Bluetooth connections

Wi-Fi connections

The Real time badge distinguishes event-driven collection from periodic collection; it does not guarantee instant delivery to the Portal. Saving the configuration does not prove collection or receipt: check reported records in 3. Devices, taking the agent, connectivity and synchronization into account.

Geolocation data

Access: view — Admin Editor Analyst Teacher; edit — Admin Editor; Custom / company role*. Permission: view the policy; edit the policy.

Location Collection: target interval, displacement and the combination of criteria, in that order. This image has no enablement control.

These criteria set targets for location reports, not a guaranteed schedule. Results depend on Android, location availability, power state and connectivity; background updates may be batched or delayed.

Target reporting interval

Collection by displacement (Meters)

Logical Operator for Collection Criteria

For example, with Or, a stationary device can still meet the time criterion; with And, time alone does not satisfy both criteria. Validate reports on a pilot device before relying on them operationally; saving the policy does not confirm the time or position actually reported.

History

Access: view — Admin Editor Analyst Teacher; restore — Admin Editor; Custom / company role*. Permission: view revisions; restore a revision.

Compare revisions before restoring. Comparison is read-only; restore replaces current values after confirmation and may start a new distribution.

History lists versions and their compare and restore actions.

Comparison between policy revisions.

Restore confirmation not executed.

Compare

Restore

Explain with AI

Troubleshoot

Troubleshoot

• Policy is missing: Active company, search, filters, and permission. Clear filters and ask an administrator to confirm access.
• Device does not receive a change: Saved revision, association, connectivity, agent, and synchronization. Check 3. Devices; do not repeat high-impact actions.
• App does not install: Library source, compatibility, version, and network. Confirm the item in 5. Library.
• Network stops working: APN, VPN, proxy, certificate, and credentials. Revert in a controlled environment or use the authorized recovery procedure.
• Option is missing: Platform, Android version, permission, or enabled feature. Treat it as conditional and confirm with an administrator.
• Remote does not start: Policy, app, local permissions, and connectivity. See Nomid Remote; enabling the policy does not start a session.

Continue

• To create a policy with the assistant, see 9. New policy.
• To investigate state, synchronization, and an individual device, see 3. Devices.
• To manage apps and contact lists, see 5. Library.
• For Android Enterprise binding and external services, see 6. Integrations.
• To start and control a session, see Nomid Remote.

Glossary

Glossary

• Android Enterprise: Android capabilities for managing corporate devices, work profiles, apps, and policies.
• APN: Name and settings a device uses to access the carrier's mobile data network.
• ENTERPRISE / DEFAULT_DATA_TRAFFIC / EMERGENCY: APN usage types for enterprise traffic, default mobile data, or emergency services.
• BIP / CBS / DUN: APN types for SIM communication, cell-broadcast messages, and mobile connection sharing.
• FOTA / HIPRI / IA: APN types for firmware updates over mobile data, high-priority data, and the device's initial network attachment.
• IMS / MCX: APN types for carrier multimedia services, such as voice over LTE, and mission-critical communications.
• MMS / RCS / CBS: Multimedia messaging, rich communication, and alerts broadcast over the cellular network.
• SMS: Cellular text-messaging service, separate from MMS and internet-based messaging.
• SUPL / GPS: SUPL provides assistance data over the network to speed up or improve GPS positioning.
• VSIM / XCAP: VSIM identifies virtual-SIM service; XCAP accesses or changes carrier-service settings.
• PAP / CHAP / PPP: Methods and protocol used to authenticate a data connection; CHAP uses a challenge, while PAP sends credentials with less protection.
• MCC / MNC: Numeric codes that identify the mobile network country and carrier.
• MVNO / SPN / GID: Identifiers used to distinguish a mobile virtual operator, the provider name on the SIM, or a specific SIM-card group.
• SIM / ICCID / IMSI / IMEI: SIM is the mobile subscription module; ICCID identifies the card, IMSI the network subscription, and IMEI the cellular device.
• IP / IPv4 / IPv6: IP is the network addressing protocol; IPv4 and IPv6 are its two versions in current use.
• MTU: Largest packet size the connection attempts to transmit without fragmentation.
• MMSC: Address of the carrier service that sends and receives MMS messages.
• VPN: Protected network tunnel that routes device or app traffic through organization-defined infrastructure.
• Proxy / PAC: A proxy intermediates network connections; a PAC file contains rules that choose when and which proxy to use.
• SSID: Public or administrative name that identifies a Wi-Fi network.
• WEP / WPA / WPA2 / WPA3: Wi-Fi security families; WEP is legacy, while newer WPA versions provide stronger protection when supported.
• PSK / WEP-PSK / WPA-PSK: PSK is a pre-shared key; WEP-PSK and WPA-PSK identify which security family uses that credential.
• Hotspot / tethering: Sharing a device's mobile connection over Wi-Fi, USB, or Bluetooth.
• GSM / GPRS / EDGE / UMTS: Cellular generations and technologies that predate LTE and remain compatibility or restriction references.
• HSPA / HSDPA / HSUPA: 3G mobile-data technologies for faster access, download, and upload.
• LTE / NR / TD-SCDMA (TD_SCDMA) / IWLAN: Mobile access technologies: LTE is 4G, NR is 5G, TD-SCDMA is a 3G variant, and IWLAN is integrated mobile access over Wi-Fi.
• APK: Android application installation file.
• Package name: Unique Android app identifier, usually in reverse-domain form, such as com.example.app.
• Version code (versionCode): Integer Android uses to compare releases of the same app; it is not necessarily the release's display name.
• SHA / SHA-256: Cryptographic digest used to verify a file's identity and integrity; it does not reveal file contents.
• URL / HTTPS: A URL is a resource address; HTTPS is the protected way to access it over the web.
• Launcher / dock: A launcher is the home screen that organizes apps and shortcuts; the dock is its fixed area for frequently used items.
• Kiosk: Operating mode restricted to one app or an approved set, with controlled exit and maintenance.
• Managed configuration: Values a policy sends to an app according to the schema published by that app.
• Scope / work profile: Scope defines where a setting applies; a work profile separates corporate apps and data on Android.
• MDM / DPC: MDM is centralized device management; DPC is the Android component that applies management policies locally.
• FRP: Factory Reset Protection, which may require an authorized account after a device wipe.
• Firmware / OTA: Firmware is the device's low-level software; OTA is its delivery or update over the network.
• GUID: Long identifier created to distinguish an object, such as a network profile, without relying on its display name.
• PIN: Numeric code used to unlock a function, authorize maintenance, or protect a feature.
• QR code: Visual code read by a camera to carry an address or provisioning data.
• SSO: Single sign-on that reuses an authenticated identity across compatible services.
• SIEM: Platform that centralizes security events and alerts for analysis and auditing.
• NFC / UWB: Short-range wireless technologies; NFC supports tap interactions, while UWB enables precise proximity and positioning.
• USB: Physical connection standard used for power, accessories, and data transfer.
• AC: Alternating current, used in the manual for power supplied by a mains-connected charger.
• Geofencing: Rule that uses entry into or exit from a configured geographic area as an action condition.

Sources and limits

This guide describes current Nomid MDM Portal controls and uses official Android management concepts to explain compatibility and asynchronous application. Provider documentation does not define Portal-specific labels, calculations, or availability. Always confirm visible controls, device version, and the reported result before a high-impact change.