Skip to main content

Creating Policies

This guide walks you through creating a new policy from start to finish, tab by tab, matching the configuration tabs in the policy editor. For a full reference on every tab and setting, see the Policy Overview.

Before You Begin​

Consider these questions:

  • Who will use these devices? Employees, contractors, customers?
  • What is the primary use case? General work, kiosk, field work?
  • What enrollment type fits? Fully Managed, Dedicated, BYOD, or COPE - see Device Modes Explained
  • What apps are required? Email, CRM, custom apps, or a locked-down kiosk experience?

Creating a New Policy​

Step 1: Start Policy Creation​

  1. Navigate to Policies in the top navigation bar
  2. Click Create New Policy (orange button in top right)
  3. The policy editor opens where you can configure all settings

Step 2: Basic Information​

Enter policy details in the Policy Header:

FieldExample
Policy NameSales Team Standard
Device ModePersonally Owned (BYOD), Fully Managed, Dedicated, or COPE
DescriptionStandard policy for sales department devices

The version number is automatically managed and increments each time you save changes.

Naming Convention

Use a consistent naming pattern: [Department/Group] - [Purpose] - [Security Level]

Examples:

  • "Engineering - Development - Standard"
  • "Retail - Kiosk - POS Terminal"
  • "Executive - Mobile - High Security"

Step 3: System Settings​

The System Settings tab covers device security, lock screen behavior, developer access, Play Protect, account authentication, and system updates. Each setting is a toggle (or dropdown) with an info icon for additional context - see the System Settings reference for the complete list. At a minimum, review:

Lock Screen Security - Require Device Lock, Disable Camera on Lock Screen, Disable Biometric on Lock Screen

Data Protection - Require Encryption, Allow Screenshots, Block Camera, Block Microphone, Disable USB Data Transfer

Developer & Advanced - Allow Developer Settings, Block Factory Reset, Credential Manager Policy (Android 14+)

Google Play Protect - Enforce Play Protect Verification

Account Authentication - Require Managed Google Account

System Updates - Set the System Update Policy (Automatic, Windowed, or Postpone), and optionally define System Update Freeze Periods (annual recurring windows, up to 90 days each, separated by at least 60 days, during which updates are postponed).

Step 4: Applications​

The Applications tab controls the device's experience mode, app catalog, and installation restrictions - see the Applications Settings reference for full detail.

Device Experience​

Choose how locked-down the device should be:

ModeBest For
StandardGeneral work devices - apps install and run normally, no lock-down (default)
Single-app kioskSingle-purpose kiosks locked to exactly one app
Basic Multi-appShared devices that need Android's standard home screen, showing only chosen apps
Custom launcherFully branded kiosk experiences that need a custom-built home screen

If you choose Custom launcher, you'll be taken to a dedicated launcher designer to build the layout, colors, background, quick settings, and applications shown on the device's home screen. Once built, the launcher appears in the policy's Launcher Library as a Draft until you save the policy, at which point it publishes and rolls out to the policy's devices automatically. A launcher can also be saved as a Template for reuse across other policies.

App Catalog and Restrictions​

  1. Click Add apps in the App Catalog section to browse Google Play or upload a private APK
  2. Use Blocked Applications to disable specific apps (including preloaded system apps) by pasting package names, then click Add to Blocklist
  3. If your organization uses the AndroidNexus Companion App (a device-resident helper for wallpaper, private-APK install, and on-device quick settings), toggle Enable Companion App to turn it on
  4. Configure App Installation Settings:
    • Allow Play Store browsing - off restricts users to policy-specific apps only; on lets users install from the Google Play Store directly
    • Allow sideloading APKs - dropdown to control APK sideloading (e.g., Blocked on entire device)

Step 5: Network Configuration​

The Network tab configures Wi-Fi and VPN settings for the device. Settings in this tab are still being fully documented - refer to the in-app controls and info icons for the current set of options rather than assuming specific fields here.

Step 6: Display​

The Display tab configures screen and display behavior for the device (this is separate from the device detail page's read-only Display Information shown for enrolled devices). As with Network, refer to the in-app controls for the current set of options.

Step 7: Work Profile Settings (BYOD / COPE only)​

If the policy's Device Mode is BYOD, a BYOD Work Profile tab appears with work-profile-specific settings. If the Device Mode is COPE, a COPE Work Profile tab appears instead. Both are only shown for their respective device modes.

Step 8: Review and Save​

  1. Review all settings in each configuration tab
  2. Click Save Policy (orange button in top right) to save your changes and increment the policy version
  3. If you're editing an existing policy, you also have History (view version history), Clone (copy the policy), Delete, and Deploy (push this policy to a device or devices directly) available in the header

Testing Your Policy​

Before deploying widely:

  1. Create a test group with 1-2 devices
  2. Assign the policy to the test group
  3. Verify settings are applied correctly
  4. Test user experience - is it usable?
  5. Iterate based on findings

Policy Templates Reference​

These are starting points built from the real settings available in the policy editor - adjust them to fit your organization's needs.

Basic Template​

Minimal restrictions for trusted users:

System Settings: Require Device Lock only; encryption, camera, and USB transfer allowed
Applications: Standard device experience, Play Store browsing allowed

Standard Enterprise Template​

Balanced security for most organizations:

System Settings: Require Device Lock, Require Encryption, Block Factory Reset
Applications: Standard device experience, required apps force-installed, sideloading blocked

High Security Template​

Maximum protection for sensitive environments:

System Settings: Require Device Lock, Require Encryption, Block Camera, Block Microphone, Disable USB Data Transfer, Block Factory Reset, Allow Developer Settings off
Applications: Approved apps only, Play Store browsing off, sideloading blocked

Kiosk Template​

Single-purpose device configuration:

System Settings: Require Device Lock off (device is locked to app, not user), Block Factory Reset
Applications: Single-app kiosk or Custom launcher device experience, only kiosk app(s) in the App Catalog

Next Steps​