4. Tablet and smartphone policies — Policy 2.0

Application: Portal Nomid MDM Document: V1.0.0 Last updated: 27/10/2026 Editorial owner: Nomid MDM Documentation Last editorial review: 27/10/2026 Editorial language: en-US

Configure Android 2.0 policies in the Nomid Portal. A policy groups rules distributed to linked devices; editing a rule does not immediately execute the physical device action it governs, such as factory reset or screen capture.

1. Sign in to the Nomid Portal, open Policies and select the Android policy to configure.
2. Check scope and linked devices before editing. Availability depends on company/group permissions, management mode, Android version and required apps.
3. Edit controls, use Save, review differences and confirm. Check success, then validate the outcome on devices. Saving does not guarantee immediate physical application.

After saving, use Devices to check device information and synchronization.

Saving configuration, copying, deleting, restoring or editing policy information requires Edit policy, within the permitted scope. History requires View policy or Edit policy. Assigning a group also requires permission for its destination. Profiles may combine different permissions; do not assume access from a profile name.

In this manual, you are the administrator editing in the Portal; people are those using the device. Configuration shares changes being edited but not yet saved, called a draft. They are saved only after successfully completing Save, review and confirmation; switching tabs keeps the edit open. Discard restores the saved configuration. Do not rely on automatic recovery after reloading or leaving. Description, tags and group save separately, and commands such as Restore save after their own confirmation. Closing a pane does not discard edits; list fields may accept text on blur or close. Uploads can also create resources separately. Check the outcome before repeating a write.

Before deploying network, access, password or wipe restrictions, validate on a representative pilot device and preserve recovery access. Changing a rule later does not recover erased data. Figure values are configuration examples, not universal defaults.

Summary

Devices

Check which devices receive this policy. If the list is empty, use the enrollment entry to start linking devices; they receive the configuration after successful enrollment.

Figure 1. Devices.

About this policy

Use description, tags and group to identify and organize the policy. These details save separately: leaving an edited description can save it; adding or removing a tag in the readout saves immediately. Resolve pending configuration changes before moving groups and confirm you can assign the destination group. On a conflict, reload and review before trying again.

Copy requires Edit policy. A new name creates another policy; copying over an existing policy updates the destination while preserving its organizational details. Check the destination before confirming. Delete also requires Edit policy, revokes associated enrollment and public links, and does not wipe devices. Do not rely on automatic recovery of a deleted policy.

Figure 2. About this policy.

Configuration

Open the area you want to configure and edit its controls. Tabs share the unsaved edit: switching tabs neither saves nor discards changes. Use Save, review the differences and confirm after checking their scope. Discard replaces edits with the saved configuration; closing a pane after typing does not guarantee cancellation. After saving succeeds, distribution and device application still depend on communication and compatibility.

Figure 3. Configuration.

Device locations

View the latest positions received from linked devices. An empty list does not establish a GPS failure: first check enrollment and location reporting settings. A previously reported position is not a guarantee of real-time location.

Figure 4. Device locations.

Recent changes

Check version, author and time of changes before continuing an edit. Open Activity to filter changes, compare versions or consider a restore. Comparing does not restore.

Figure 5. Recent changes.

Apps & experience

Home screen

Open each entry to configure mode, apps, appearance and layout. Appearance and dock apply to Nomid Launcher or Nomid Kiosk, not the system home screen. For single-app kiosk, choose the app and a secure maintenance password before deploying. Maintenance access depends on navigation controls; preserve the navigation needed to reach it.

In app details, configure installation, permissions and updates for the intended task. Environments, tracks and managed settings depend on app source and schema. Delegate sensitive capabilities only to apps that need them; network and security logs have delegation restrictions indicated by the editor.

Figure 6. Home screen.

Launcher mode

Opens launcher mode pane; selecting a mode changes the unsaved edit.

Mode

Kiosk experience

Kiosk app

Choose the app for single-app kiosk. Selecting it can add it to the policy and make installation required in the unsaved edit. Setting the maintenance password is a separate step.

Maintenance password

Sets single-app kiosk exit password subject to the displayed minimum length; protect the password.

Opening other apps

In Nomid Kiosk, controls whether people may open apps outside the configured kiosk experience.

Apps in this policy

Opens policy app list and app settings; changes remain unsaved until Save.

Installation

App enabled

Launcher access

Default permission

The rules below concern Android runtime permissions. Policy grants or denials enforce the state and prevent people from reversing it in Settings while the rule applies; prompting leaves the decision to them. An individual rule takes precedence over the app default, which overrides the general default. On Android 12 or later, automatically granting SMS and sensor permissions such as camera, microphone and location requires a fully managed device. Do not treat this choice as universal authorization for every permission or special access.

Minimum version

Enter the minimum Android integer version code (versionCode) required for this app, not its displayed version name such as 2.1. Obtain the code from the app or distribution catalog owner. Versions with lower codes are noncompliant.

Auto update

For Google Play apps, per-app Postponed or High priority overrides the general rule under Security → Encryption & apps → App updates. Thus, High priority is not constrained by Never or On Wi-Fi only in the general rule; it may use mobile data and incur charges. Default follows normal Google Play conditions and the applicable general rule. Review both controls before distribution; the choice does not guarantee immediate installation. Other app sources have their own distribution flow.

Credential manager

On Android 14 or later, a provider stores and supplies passwords or passkeys for app sign-in through Android Credential Manager. This control authorizes that role for the selected app; it does not configure Nomid Remote passwords.

Connect work and personal data

Controls communication between instances of the same app in the work and personal profiles. Allowing authorizes this communication only after the person consents; it does not release all data between profiles or create a work profile.

Work profile widgets

Authorizes widgets from an app installed in the work profile on the personal profile’s home screen when the launcher supports widgets. Allowing lets people add these widgets, which may display work information; it does not add them automatically. Without a work profile, this cross-profile authorization does not apply.

Always On VPN

Delegated scopes

You grant the capability to the selected app; that app, rather than the person using the device, can call the authorized operations. It must implement those functions. Selecting a scope does not automatically install certificates, change other apps or start collection, and does not make the app a Portal administrator. Operations respect the managed user or profile and Android conditions.

Each logging scope can be delegated to at most one app. Network logs: fully managed devices on Android 10 or later, or work profiles on Android 12 or later; work-profile collection stays in that profile. Security logs: Android 12 or later on fully managed or company-owned work-profile devices. Retrieving batches depends on Android requirements and log availability; it does not guarantee complete history.

Environment

Selects the set of published Nomid app versions considered for distribution. The environment filters the catalog; its name does not universally mean a server, testing or production. Confirm its purpose and available versions with the catalog owner before changing it.

Tracks

Adds channels whose published versions can be distributed in the selected environment. Production remains included; the service chooses the highest version code among eligible versions. Adding a channel can change the offered version without creating or publishing one. Ask the catalog owner what the channels contain.

Managed configurations

Here you fill in the Portal configuration intended for the selected app itself. For example, an email server or allowed URLs, only if the app provides those fields. The app must read and apply the configuration it receives. This editor does not grant the app a scope to configure other apps; that capability is a separate delegation.

Website

Opens the Secure Web App editor when editing is enabled. Applying replaces the app’s managed configuration in the policy and can update its icon; changes remain unsaved until Save.

Individual grants

Granted and Denied enforce the permission state and prevent people from reversing it in Settings while the rule applies. Ask every time leaves the decision to the person. The Android, management and permission-type limits described under Default permission apply.

Appearance

Opens wallpaper, text color and home label; available for Nomid Launcher/Kiosk.

Wallpaper

Text Color

Launcher label

Sets text/template displayed on launcher.

Layout & dock

Opens app order, icon size and dock controls; available for Nomid Launcher/Kiosk.

App order

Icon size

Sets app icon size on the Nomid Launcher or Nomid Kiosk home screen.

Screen orientation

Dock

• Add, remove or reorder policy apps in the dock, within the limit shown by the editor.

Device

Configure app availability, permissions, relaunch, Nomid Settings, Remote, files and contacts through their entries. Hiding an app in the launcher, blocking installation and disabling its use are different decisions.

Remote access requires Nomid Remote to be installed and configured. These settings govern a future session; they neither start a connection nor guarantee immediate reachability. Sharing without confirmation expands access to the screen. Protect passwords and review that scope before saving.

If Nomid Remote is already present but required managed settings are missing, opening the pane can initialize fields in the local form. Closing the pane does not automatically undo this initialization. Check the unsaved edit before saving; use discard to abandon configuration changes.

Figure 7. Device.

App availability

Opens Play Store and outside-app visibility choices.

Play Store apps mode

Apps outside this policy

Google Play Protect

Permissions and relaunch

Opens default permission and app relaunch controls.

Credential manager default

Defines which apps without an individual override may provide passwords or passkeys for sign-in through Android Credential Manager on Android 14 or later. The per-app control under Home screen can grant specific authorization.

Target app

Choose the app that Nomid Settings should open again. The routine asks Android to open that app’s launch screen; it may open it or bring it to the foreground. This is not a force-stop command: reusing the screen and session depends on the app and Android. Do not rely on it to save work or clear memory.

The app must be installed and have a launchable screen. The routine respects the restriction on apps reserved for the launcher’s administrative area. Android may refuse a background launch; in that case it retries in the next cycle. The first launch may occur when the routine starts or is reconfigured, before a full interval elapses.

Frequency

Sets the interval in minutes that Nomid Settings uses to schedule the next launch attempt, with a minimum of 1 minute. The next cycle is scheduled after the previous attempt; Android may delay it. It does not guarantee execution at exact times.

Nomid Settings app

Opens configuration of buttons offered in Nomid Settings, such as Wi-Fi, Bluetooth and brightness. Sets which are available, unavailable or protected by the policy password. The password reveals buttons marked as protected in Nomid Settings; it does not replace the Android unlock password.

Remote access

Opens Nomid Remote access and authentication settings; it does not start a remote session.

Nomid Remote starts

Settings on the device

Screen sharing

Verification

Chooses which password is accepted to authenticate remote access to the device through Nomid Remote.

During a session

While the device is locked

Controls whether Nomid Remote access is allowed while the device is locked. This choice does not unlock the device or start a connection.

Password sync

Synchronization sends the device’s Nomid Remote password to the Nomid service; the Portal can retrieve it to authenticate the remote session without the operator typing it. This requires the company feature, the device’s effective policy, the app sending its password and the operator’s authorization to retrieve it. Enabling the option does not prove that transmission has occurred.

Files

Opens file association in this policy; file creation belongs to Library.

Files

Select the Library files that Nomid Settings should download to the device’s shared storage. This requires a Settings version implementing this synchronization, connectivity, free space and destination access. Without another destination, the reviewed implementation uses Download/nomid; with a configured destination, it uses that folder. If storage restrictions prevent the requested path, it may use a subfolder under Documents/Nomid. Confirm the actual destination before guiding the person.

People open the file with a file manager that can access that folder and an app supporting its format, such as a PDF reader. Associating a file does not install that reader or open the document automatically. Content, name and destination changes are re-evaluated during synchronization.

Removing the association makes synchronization attempt to delete the copy it recorded on the device; connectivity or access may delay completion. This neither deletes the Library original nor wipes every copy made by the person or other apps.

Contacts

Opens contact-list association in this policy; list creation belongs to Library.

Contacts

Associate the Library contact lists that Nomid Settings should synchronize with Android contacts. This requires a Settings version implementing the feature and read/write contacts permissions. The reviewed implementation imports entries into the local Nomid Contacts account in the user or profile where Settings runs. In the Contacts app, people should include that account in the display filter; menu names vary by app and manufacturer. This does not synchronize those entries with a personal Google account.

On successful synchronization, Settings adds or updates imported contacts and removes managed records no longer in the set delivered by policy. Editing a Library list or removing its association takes effect only after the updated policy is received and synchronization completes. Removal acts on records identified as Nomid-managed; it does not wipe the entire address book or delete the original Library list.

Device preview

Use Previous and Next to browse simulated screens. The preview helps check icons, layout and dock; it does not run apps or verify behavior on a particular device model.

Figure 8. Device preview.

Previous

Moves preview to previous simulated screen.

Next

Moves preview to next simulated screen.

Connectivity

Wi-Fi networks

Add the network, enter its SSID and select security before saving. Adding a network already creates an unsaved entry. For enterprise Wi-Fi, select EAP and complete its applicable fields. PAP is offered with EAP-TTLS; 192-bit enterprise security requires EAP-TLS. Use certificates and the RADIUS domain supplied by the network administrator.

Certificate buttons upload a file or replace an existing certificate. Selecting a valid file changes configuration. Distinguish the server CA from the client PKCS#12 certificate. The hardware MAC option is specific to Android 13 or later.

Figure 9. Wi-Fi networks.

Add Wi-Fi network

Adds a network to the unsaved edit, initially with automatic connection and no authentication. Configure security before saving.

Name (SSID)

Enter the exact name (SSID) of the Wi-Fi network the device should recognize.

Security

Password

Sets network passphrase; keep the passphrase secret.

Connect automatically

• When enabled: Requests automatic connection to this configured network when available; it does not itself turn on the Wi-Fi radio or lock people’s settings.

• When disabled: Does not request automatic connection to this network; it does not prohibit using it.

Hidden network

• When enabled: Tells Android that this network does not broadcast its SSID, so it searches for a hidden network; this option does not hide the network from user lists.

• When disabled: Treats SSID as broadcast.

MAC address

EAP method

Inner authentication

Identity (user name)

Sets EAP identity.

Password

Sets tunneled EAP secret; keep the value secret.

Anonymous identity

Sets the optional outer identity presented during tunneled EAP Wi-Fi authentication.

RADIUS server domain

Sets trusted server domain suffix list.

Server CA certificate

Client certificate

Client PKCS#12 file

Key pair alias

Uses key pair alias instead of uploaded client certificate.

Wi-Fi rules

Set radio control, user network configuration and accepted security separately. The network escape hatch can help at startup when the server cannot be reached; it does not replace managed network planning. An offered unset option leaves the effective default in force; it does not automatically block the feature.

Figure 10. Wi-Fi rules.

Wi-Fi radio

Use this to leave switching to people or enforce the radio state. On company-owned devices running Android 13 or later, these states control turning Wi-Fi on and off; they do not select a network or its credentials.

User Wi-Fi configuration

Use this to limit the networks people can add or change. Networks supplied by the administrator under Wi-Fi networks are a separate decision; blocking configuration neither supplies a network nor guarantees connectivity.

Wi-Fi Direct

Allows or blocks direct connections between devices without requiring an access point. This control requires a company-owned device running Android 13 or later; allowing it does not start a connection.

Minimum Wi-Fi security

Use this to prevent connections to networks below the selected level, including when people can choose a network. Requires Android 13 or later on fully managed or company-owned work-profile devices; it supplies no password or certificate.

Network escape hatch

Traffic routing

For always-on VPN, choose its provider before deciding to block other traffic. An unavailable VPN with lockdown can interrupt communication. The proxy is recommended: apps may ignore it. Switching between manual and PAC clears fields exclusive to the other mode; check the new result before saving.

Figure 11. Traffic routing.

Always-on VPN

Opens always-on VPN settings pane; selected app and lockdown affect traffic.

VPN app

Choose the always-on VPN provider app. Confirm it is installed and configured before blocking other connections.

Block connections without the VPN

• When enabled: Blocks connections outside selected VPN.

• When disabled: Allows connections when selected VPN is unavailable.

Recommended proxy

Opens recommended proxy settings pane; address/port affect network routing.

Proxy

Host

Sets manual proxy host.

Port

Sets manual proxy port.

Don’t use the proxy for

Lists hosts to access without the recommended proxy. Enter, comma, leaving the field and closing the pane accept valid typed entries.

Auto-config file URL

Enter the PAC file URL, which determines the proxy to use for each connection.

Mobile data

Use carrier-supplied parameters and confirm device support before overriding APNs. Choosing a carrier template or adding a custom APN changes the unsaved edit. APN types and radio technologies allow multiple selections.

Check virtual operator type carefully: the Portuguese and Spanish lists can repeat IMSI for two different criteria, IMSI and SPN. The English labels distinguish them. IMSI identifies the subscriber; SPN identifies the service provider name. Do not choose SPN solely by the duplicated label or list position. If SPN is required and you cannot confirm the type, stop the change and request unambiguous identification before saving.

Expand APN details shows fields; Collapse APN details hides them. Delete APN configuration removes the APN configuration from the unsaved edit. While editing the name, Escape is associated with canceling that edit; it is not a button and does not discard other policy changes.

Figure 12. Mobile data.

APN overrides

Configure carrier-supplied APNs before overriding the others. Enabling overrides requires a fully managed device running Android 10 or later. Enterprise APNs in a work profile require Android 13 or later and use their own preferential-network rules; do not enable this selector for that case. The managed list is separate from ordinary APNs and cannot be edited by the person in Android Settings. Disabling this selector does not delete the configured list.

APN overrides

APN

Enter the carrier-supplied APN identifier for the mobile-data access point.

Enter APN display name

Sets the name displayed for this APN. Confirming the name changes the unsaved edit.

Username

Sets APN authentication username.

Password

Sets APN authentication password; keep the password secret.

Carrier ID

Enter the carrier’s integer ID from Android carrier identification, obtained from the carrier or APN provider. It is not the MCC+MNC combination used in the next field. Zero means unset; negative values are invalid.

Numeric Operator ID

Enter the carrier-supplied MCC+MNC numeric code: mobile country code followed by mobile network code, normally 5 or 6 digits. Preserve leading zeros; do not use the integer carrier ID from the previous field.

MMSC URL

Enter the multimedia messaging service center (MMSC) URL used by this APN for MMS.

MMS Proxy Address

Sets MMS proxy host.

MMS Proxy Port

Sets MMS proxy port.

Proxy Address

Sets APN proxy address.

Proxy Port

Sets APN proxy port.

MTU IPv4

Sets the maximum IPv4 transmission unit size for this APN. Use the carrier-supplied value.

MTU IPv6

Sets the maximum IPv6 transmission unit size for this APN. Use the carrier-supplied value.

Authentication

Chooses how this APN’s data connection authenticates with the carrier; the username and password belong to the APN being edited.

Protocol

Selects the data transport protocol used by this APN.

Roaming Protocol

Selects this APN’s data transport protocol while the device is roaming.

Always On

Controls whether the policy requests an always-on connection for this APN.

MVNO Type

APN Types

Network Types

Manage APN configurations

Mobile & sharing

Configure each feature for the device task. Allowing a connection and allowing changes to its settings are different controls. USB, airplane mode, mobile radio or tethering restrictions can affect support and connectivity; validate on a compatible pilot device before the whole group.

Figure 13. Mobile & sharing.

Bluetooth

SMS

Tethering

USB data access

USB data restrictions apply to company-owned devices and do not change charging. Blocking all data requires Android 12 or later and compatible device USB support; without it, Android applies file-transfer blocking instead and reports the incompatibility. Check a representative model.

Airplane mode

Requires Android 9 or later on fully managed or company-owned work-profile devices. User choice preserves the ability to turn it on or off; Disabled enforces the off state.

Ultra-wideband

Requires compatible UWB hardware and Android 14 or later on fully managed or company-owned work-profile devices. User choice allows adjusting the state; Disabled enforces the off state.

Cellular 2G

Requires Android 14 or later on fully managed or company-owned work-profile devices, with cellular-network support. User choice allows adjusting 2G use; Disabled enforces the off state.

Bluetooth configuration

Network settings

These controls limit changes people can make in Android Settings. They do not themselves reset the network or install certificates. Preserve a support route before restricting VPN, certificates or network changes.

Figure 14. Network settings.

Cell broadcast settings

Hotspot and tethering settings

This is the legacy control referenced under Mobile & sharing → Tethering → Not configured. When Tethering has an explicit choice, that choice takes precedence and Android ignores this control. Review both choices together; do not assume Blocked here limits explicitly Allowed tethering.

Mobile network settings

VPN settings

Security credentials

Reset network settings

This control applies only to fully managed devices. In other modes, Android reports management-mode noncompliance; do not rely on this restriction in a work profile.

Security

Recovery & tamper

Allowing factory reset makes that action available on the device; it does not execute it now. Safe mode, debugging and external storage restrictions can limit maintenance. On Android 12 or later, consider the USB data access control in Connectivity as indicated by the Portal.

Figure 15. Recovery & tamper.

Factory reset

Safe boot

Developer settings

External storage

Lock screen

Choose which features remain available while locked. Restrictions support multiple selections. The all-features option includes future features and implies individual restrictions; review its impact on unlocking and notifications.

Figure 16. Lock screen.

Lock screen restrictions

Lock screen & support messages

Edit the message for its intended location: lock screen, blocked setting or administrator screen. Respect each field limit and avoid secrets. Closing after typing is not a general way to cancel edits.

Figure 17. Lock screen & support messages.

Lock screen message

Opens editor for message displayed on lock screen; the typed value remains unsaved.

Lock screen message

Sets up to 200 characters on managed device lock screen.

Short support message

Opens short support message editor; the typed value remains unsaved.

Short support message

Sets up to 200 characters shown where a setting is blocked.

Long support message

Opens long support message editor; the typed value remains unsaved.

Long support message

Sets up to 4096 characters displayed in device administrator screen.

Android version

Set the minimum accepted Android version. Before raising it, check associated devices: older versions can become noncompliant.

Figure 18. Android version.

Minimum Android version

Sets the minimum accepted Android version; devices running older versions may become noncompliant.

Sign-in & accounts

Choose sign-in method before requirement and expiry. Disabling sign-in clears expiry. Work-account binding is separate from adding/removing accounts and controls whether an email is required. The email must belong to the company managed Google domain; changing it does not alter an account already set up on a device. In kiosk mode, follow the Portal limitation on blocking apps before sign-in.

Figure 19. Sign-in & accounts.

Account changes

Sign-in method

Configures device-use sign-in managed by Nomid Settings, using a PIN or SSO. This session is separate from Android screen unlocking and binding a Google work account.

Login requirement

Account binding (one time only)

With Google account linking enabled, Android management must use an authenticated Google work account. Android handles adding and authenticating the account; saving the policy neither creates a Google account nor authenticates the person automatically. This is separate from Nomid Settings PIN or SSO login.

The “one time only” limit concerns choosing the required account: after an authenticated Google account has been added, changing Require a specific account does not replace the configured account. Choose the correct address before that step; this field is neither an account-switching mechanism nor a session timeout.

Session expiry

Sets the device sign-in session duration in whole minutes, until Nomid Settings signs the person out. Disabling the sign-in method clears this expiry.

Require a specific account

Sets required Google work account; disabling binding clears email.

Passwords & recovery

Add a rule for each required scope and select quality before character minimums. Fields vary with quality. A failed-password threshold can wipe data; confirm recovery before enabling it.

Recovery accounts can be required after factory reset. Confirm the company controls those accounts. A valid typed email can enter the list on Enter, blur or pane close; check the list before saving.

Figure 20. Passwords & recovery.

Password rules

Opens rules requiring a password for device or work-profile access, according to each rule’s scope.

Add and remove password rules

Password scope

Password quality

Quality defines the minimum unlock requirement for the rule’s scope. For device-scoped rules on personally owned work-profile devices running Android 12 or later, Android interprets these qualities as complexity bands; effective restrictions can differ from individual minimums. Check the applied requirement before deploying the rule.

Minimum password length

Sets minimum password length; visibility depends on password quality.

Minimum letters

Sets minimum letters; visibility depends on password quality.

Minimum lower cases

Sets minimum lower cases; visibility depends on password quality.

Minimum upper case letters

Sets minimum upper case letters; visibility depends on password quality.

Minimum numerical digits

Sets minimum numerical digits; visibility depends on password quality.

Minimum symbols

Sets minimum symbols; visibility depends on password quality.

Minimum non-letter

Sets minimum non-letter; visibility depends on password quality.

Maximum attempts

Configures the failed-password limit for this rule’s scope as a destructive-wipe trigger. This field does not establish the wipe’s scope or execution.

Password history

Sets previous passwords disallowed for reuse.

Password expires after

Set password expiry using days or hours; existing minute/second values are preserved.

Password unlock

Sets the interval after unlocking with a password, PIN or pattern, the strong authentication forms for this control, before one of those forms is required again. During the interval other permitted methods, such as biometrics or trust agents, may be used; afterward they are insufficient until strong authentication is performed again on the covered device or profile.

Factory reset recovery addresses

Opens recovery address editor; configured accounts affect recovery after reset.

Recovery email addresses

Adds recovery accounts authorized for setup after a factory reset; empty and duplicate addresses are discarded. Enter, leaving the field or closing the pane can accept a valid typed address.

Encryption & apps

Configure encryption and app sources for the management mode. Private-key selection and app/address rules are separate decisions. When limiting accessibility or keyboards to a list, include necessary packages so people can keep using the device; do not assume omitted apps are allowed.

Figure 21. Encryption & apps.

Encryption

Untrusted apps

App updates

For Google Play apps, this general control does not override Postponed or High priority selected in the app details under Apps & experience → Home screen → Auto update. Check that individual choice too; new rules do not interrupt updates already in progress.

Private key selection

Private key rules

Opens rules granting an app access to the private key identified by its alias when its package and requested address match the rule. If several rules match, the last applies. Without a match, Private key selection determines whether the person may choose a key. That control has no effect when certificate selection is delegated to an app.

Accessibility services

Choose which apps people may enable as Android accessibility services, for example to assist reading or navigation if they implement those features. Allowing does not automatically install or enable the service. System accessibility services remain available; the list restricts other apps.

Input methods

Choose which keyboards people may enable for typing on the device. Allowing does not automatically install or select a keyboard. System input methods remain allowed; the package list restricts non-system keyboards.

Restrictions & responses

These options configure responses to three distinct conditions: an operating system that cannot be recognized, signs of OS tampering, and a failed hardware-backed security check. Once distributed, the policy defines the response for the recognized condition; selecting an option or saving is not a wipe-now command.

This control does not set an evaluation interval. Confirm check frequency and the exact wipe scope for the version and management mode in use before enabling the response. Wiping can remove data and management; do not configure it assuming personal data will be preserved. Wipe is destructive and may require reprovisioning; later policy changes do not recover erased data.

For enforcement, choose requirement, scope and delay. Device-wide blocking includes personal apps. If both block and wipe apply, wipe must follow block. Edit and save a rule to change a future restriction; this does not undo an executed wipe.

Figure 22. Restrictions & responses.

Bluetooth contact sharing

NFC sharing

Outgoing calls

Data roaming

Enforcement rules

Opens noncompliance enforcement rules editor.

Unknown OS

Compromised OS

Hardware evaluation failed

Requirement

Block scope

The scope determines which apps are blocked for noncompliance; these choices apply to company-owned devices. Confirm management mode and the presence of a work profile before deployment.

Block after (days)

Sets the nonnegative whole-day delay for blocking due to noncompliance with the selected requirement. A configured scope without a delay can cause immediate blocking.

Wipe after (days)

Sets the wipe-action delay for noncompliance with the selected requirement. If blocking is also configured, wiping must follow the block delay; this is not a wipe-now command.

Keep factory reset protection

• When enabled: Requests preservation of factory reset protection in this enforcement wipe configuration. This does not guarantee that protection is preserved after execution.

• When disabled: Does not request preserving factory reset protection for this enforcement wipe.

Rules

Geofences

Open the geofence, name it and set center and radius. The geofence tag helps find devices outside all areas in the device list; it does not itself order a wipe or lock. Map changes also change the unsaved policy settings. Check area and radius before saving.

Figure 23. Geofences.

Add geofence

When the first geofence is not yet configured, opens its empty fields to define the new area. To change an existing geofence, use its edit control. Editing the name, map, radius or tagging changes the shared unsaved edit.

Name

Sets required geofence name.

Latitude

Sets center latitude between -90 and 90.

Longitude

Sets center longitude between -180 and 180.

Radius

Sets required radius of at least 1 meter.

Add the tag “geofence”

• When enabled: Tag devices outside every geofence so they can be found in the device list.

• When disabled: Stop requesting this outside-area tag.

App schedules

Add the schedule, select its apps and configure day groups and non-overlapping time windows. Start is included; end marks when availability stops. Selected apps are blocked outside windows. Removing the only rule restricting an app can make it available at any time; review before confirming.

Figure 24. App schedules.

Add app schedule

Creates an unsaved schedule with weekdays and 09:00–18:00 initially. Closing removes it if it still has no name, no apps and unchanged initial days and hours. Complete and review the name, apps, days and hours before saving.

Schedule name

Sets schedule name up to 20 characters.

Add apps

Add the apps whose use this schedule will restrict. The picker lists eligible policy apps and may vary.

Days

Start time, window (window number)

The Portal stores this schedule’s days and times, but the execution clock/time-zone reference was not established by the reviewed sources. Before deploying across time zones, confirm the reference with support for the Nomid Settings version in use and validate a representative device.

Sets the HH:MM start of the window when this schedule’s apps may be used; the start instant is included.

End time, window (window number)

Sets the HH:MM end of this schedule’s app-use window; that window no longer allows use from this instant.

Manage windows and schedules

System

Updates

Choose update installation timing and annual freeze dates separately. Postponing up to 30 days does not postpone security patches; a freeze blocks all updates, including those patches. Check periods so necessary fixes are not blocked.

Figure 25. Updates.

System updates

Start hours

The daily update window uses each device’s local time, not the editing computer’s clock. Devices in different time zones use the same local start and end times at different absolute instants.

Sets the start of the daily window for installing Android system updates.

End hours

Sets the end of the daily window for installing Android system updates.

Days to postpone updates

Sets how many days to postpone Android system updates and computes the corresponding period. This choice does not postpone security patches.

Freeze Periods

Freeze periods — Opens annual freeze-period editor; freezes block all system updates including security patches on those dates.

Start date

Sets the annual start date for suspending all system updates, including security patches.

End date

Sets the annual end date for suspending all system updates, including security patches.

Add and remove periods

Screen & power

Set inactivity timeout, lock limit, charging sources and brightness consistently. Charging sources allow multiple selections. Enforced screen timeout and automatic or fixed brightness remove people’s adjustment choice; they require Android 9 or later on fully managed devices, or Android 15 or later on company-owned work-profile devices. Check units before saving.

Figure 26. Screen & power.

Screen timeout

Turn off after

Sets enforced screen inactivity timeout in seconds.

Maximum time to lock

Sets maximum inactivity before lock; empty means no limit.

Stay awake while charging

Brightness

Level

The Portal accepts input from 0 to 255, but in the Android contract only 1 to 255 represent brightness levels: 1 is lowest and 255 highest. Zero means no level is set, not minimum brightness or a fixed zero level. In Fixed mode, enter 1 to 255; in Automatic mode, a defined level guides adjustment.

Sound

Choose free volume, starting level, fixed level or mute. Configure notification sound, screen wake and vibration separately. Test a representative device for audibility and battery impact.

Figure 27. Sound.

Media volume

Level

Enter the media-volume level: 0–100 for starting volume or 1–100 for fixed volume.

Notification alerts

Opens media sound/screen wake alert controls; changes remain unsaved until Save.

Play notification sounds through media volume

• When enabled: Play notification sound/vibration through the media stream.

• When disabled: Turn off this notification sound/vibration while preserving other notification settings.

Wake the screen for new notifications

• When enabled: Request screen wake for new notifications.

• When disabled: Turn off this screen-wake request.

Vibration and haptics

This control sends the vibration and haptics restriction to Nomid Settings; On removes that restriction and Off requests it. The consulted sources do not establish whether people can change the state afterward or how the app reapplies the restriction. Before relying on continuous blocking or freedom to adjust it, confirm behavior with support for the installed Nomid Settings version and validate a representative device.

Volume adjustment

Date & time

Choose automatic or person-controlled date, time and zone. This affects device time interpretation; check the result before using scheduled routines.

Figure 28. Date & time.

Automatic date & time

App behavior

Set responses to permission requests and what people may do with apps. Allowing uninstall does not uninstall an app now. The managed-installation readout is informational, not an installation-blocking selector.

Figure 29. App behavior.

App permission requests

Uninstalling apps

The general permission does not authorize removing an app that the policy requires to be installed. To release a required Google Play app for removal, also review its Installation choice in the app details.

Windows outside apps

Skip first-use hints

People can install apps

Managed app installation remains allowed. This readout cannot block installation.

Kiosk controls

To change kiosk status bar, navigation, power and Settings access, use Launcher mode in Apps & experience. Confirm Nomid Kiosk mode and preserve usable maintenance access before restricting navigation.

Figure 30. Kiosk controls.

Users & personalization

Choose whether people may manage users and personalize Android. These permissions enable or restrict device actions; they do not immediately create or remove users through the Portal.

Figure 31. Users & personalization.

Add users

Remove users

User icon

Wallpaper

Android Easter egg

This is the hidden recreational experience in Android Settings, with an animation or game that varies by version. This control allows or blocks access to it; it is not a general list of installed games.

Privacy & data

Capture

Treat camera, microphone and screen capture as independent permissions. Allowing the microphone lets people unmute it; it does not start audio recording. Allowing capture does not start a remote session.

Figure 32. Capture.

Camera

Microphone

Screen capture

Location

Separate Android location, person-controlled sharing and Nomid Settings reporting. Set time, distance or both, then choose whether either or both targets must be met. Presets fill targets; mile alternatives follow imperial preference. These are reporting targets, not timing guarantees: sleep, connectivity and missing location fixes can delay reports.

Figure 33. Location.

Location mode

Use this to leave switching to people or require a state. On company-owned work-profile devices running Android 11 or later, an enforced state depends on the person making the requested adjustment; noncompliance may be reported until then. Do not rely on a forced change in that case.

Location sharing

Controls whether people may enable Android location sharing with apps; within a work profile, it can prevent those apps from accessing location. It does not choose human recipients or configure Nomid Settings reports, which have separate controls below.

Location reports

Opens time/distance criteria for position reports; settings depend on Nomid Settings.

Report location

• When enabled: Enables Nomid Settings location reports, restoring previous time and distance targets or the standard interval.

• When disabled: Clears the time and distance targets and disables Nomid Settings location reports.

Report every

Sets minutes between Nomid Settings location reports, with a 15-minute minimum in the Portal. Empty allows location reporting by distance alone.

Time target presets

Each preset fills the time target between location reports sent by Nomid Settings.

Distance

Sets the positive displacement target for Nomid Settings location reports. The displayed unit follows the metric or imperial preference.

Metric distance presets

Each preset fills the displacement target for a new Nomid Settings location report.

Mile alternatives

These presets fill the same location-report displacement target in miles, converted to meters in the configuration.

With both set

When both time and distance are configured for Nomid Settings location reports, choose how to combine the two targets.

Device reports

Choose the app inventory level and enable only the status categories needed. Each category is independent; disabling it excludes that data from future reports. These selectors decide what is reported to the administrator; they do not let people change hardware or erase data already received.

Figure 34. Device reports.

App reports

Device data

Opens selectors for independent device-data categories to include in reports. Each category has its own state; opening the pane does not enable all categories.

Device settings

• When enabled: Includes device settings, encryption, screen lock, USB debugging and unknown sources in device reporting.

• When disabled: Leaves device settings, encryption, screen lock, USB debugging and unknown sources out of device reporting.

Display info

• When enabled: Includes display size, density and refresh rate in device reporting.

• When disabled: Leaves display size, density and refresh rate out of device reporting.

Hardware status

• When enabled: Includes temperatures, fan speeds and CPU usage in device reporting.

• When disabled: Leaves temperatures, fan speeds and CPU usage out of device reporting.

Memory info

• When enabled: Includes RAM, storage size and low-storage events in device reporting.

• When disabled: Leaves RAM, storage size and low-storage events out of device reporting.

Network info

• When enabled: Includes IMEI, Wi-Fi MAC address and mobile carrier in device reporting.

• When disabled: Leaves IMEI, Wi-Fi MAC address and mobile carrier out of device reporting.

Power management events

• When enabled: Includes battery, charging, startup and shutdown events in device reporting.

• When disabled: Leaves battery, charging, startup and shutdown events out of device reporting.

Software info

• When enabled: Includes Android version, security patch level and build identification in device software reports.

• When disabled: Excludes this software category from future reports.

System properties

• When enabled: Includes technical names and values of system properties selected by Android, depending on device and manufacturer. The source does not define a universal list of reported properties; inspect the set reported by a representative model before deploying this collection.

• When disabled: Excludes this category of system-property names and values from future reports.

Usage statistics

Select what Nomid Settings collects and the periodic reporting interval. App, mobile-data and Wi-Fi usage follow that interval. Wi-Fi and Bluetooth connections are events and do not wait for it. Notifications require notification access and at least daily reporting. These controls authorize collection and reporting to the administrator; they do not allow or block using apps or connections. Disabling collection limits future reports and does not automatically erase history.

Figure 35. Usage statistics.

Usage statistics

Opens usage reporting controls; Nomid Settings dependency and interval floor apply.

Collected data

For data consumption, the reviewed Nomid Settings implementation records received and sent volumes in bytes, separately for mobile and Wi-Fi, with totals and detail by app package. It does not measure connection duration or accessed content. It uses UTC daily windows and updates a partial reading for today; this differs from the reporting interval. It requires Android 10 or later and the statistics access Android allows Settings. Apps sharing a system identifier may repeat values in the detail; adding app rows may not reproduce the total.

Mobile data usage and Wi-Fi data usage select per-app detail for each network. When at least one collector besides notification statistics is selected, the periodic routine also calculates totals for both networks even if one of those selectors is off. Thus, turning off a selector does not guarantee excluding its total. These selectors also do not block on-demand statistics requests from the service. Data availability and presentation depend on the installed version and granted access; missing or zero values alone do not establish absence of traffic.

For notifications, the sources establish collection of counts but do not detail the handling events sent by each Nomid Settings version. Before requiring, for example, a report of opened or dismissed notifications, confirm with support whether the installed version supplies that detail.

Send every

Sets minutes between periodic usage-statistics reports sent by Nomid Settings. Empty uses 24 hours. The Portal raises new values below 15 minutes; Settings ignores older shorter values and uses 24 hours.

Reporting interval presets

Each preset fills the periodic reporting interval for usage statistics collected by Nomid Settings; Wi-Fi and Bluetooth connection events do not follow this interval.

Insights

Consult the indicators available for this policy. Data availability depends on devices and received reports; this tab has no universal indicator to fill in manually.

Activity

Policy activity

Use the filter to narrow the list and Show more for older entries. Compare shows differences without changing the policy. History requires View policy or Edit policy, together with company and policy-scope access.

Restore requires Edit policy, an available policy and no pending configuration or information edits. Review the chosen revision and confirm only to save its configuration immediately. Restore preserves current description, tags and group; it does not need a later Save. Closing the pane does not cancel an ongoing restore. If an AI explanation is offered, it starts its own conversation.

Figure 36. Policy activity.

Show

Opens local history filter; selecting a category changes list view only.

Actions for version

To return to an earlier revision’s configuration, open its actions and choose Restore. Review and confirm to save that configuration; the operation preserves the current description, tags and group, and opening the menu does not erase history.

After saving, check the Portal response and follow the result on devices. If a network change prevents communication, use the deployment recovery procedure; do not assume another save will reach an offline device.