Device policies 编辑

You can configure how Endpoint Management interacts with your devices by creating policies. Although many policies are common to all devices, each device has a set of policies specific to its operating system. As a result, you might find differences between platforms, and even between different manufacturers of Android devices.

To view the policies that are available per platform:

1. In the Endpoint Management console, go to Configure > Device Policies.
2. Click Add.
3. Each device platform appears in a list in the Policy Platform pane. If that pane isn’t open, click Show filter.
4. To see a list of all policies available for a platform, select that platform. To see a list of the policies that are available for multiple platforms, select each of those platforms. A policy appears in the list only if it applies to each platform selected.

For a summary description of each device policy, see Device policy summaries in this article.

Note:

If your environment is configured with Group Policy Objects (GPOs):

When you configure Endpoint Management device policies for Windows 10 and Windows 11, keep the following rule in mind. If a policy on one or more enrolled devices conflicts, the policy aligned with the GPO takes precedence.

To see which policies the Android Enterprise container supports, see Android Enterprise.

Prerequisites

• Create any delivery groups you plan to use.
• Install any necessary CA certificates.

Add a device policy

The basic steps to create a device policy are as follows:

1. Name and describe the policy.

   Important:

   Do not use a forward slash (/) in a policy name. If you do, an error might occur when you edit the policy later.

2. Configure the policy for one or more platforms.
3. Create deployment rules (optional).
4. Assign the policy to delivery groups.
5. Configure the deployment schedule (optional).

To create and manage device policies, go to Configure > Device Policies.

To add a policy:

1. On the Device Policies page, click Add. The Add a New Policy page appears.

   

2. Click one or more platforms to view a list of the device policies for the selected platforms. Click a policy name to continue with adding the policy.

   

   You can also type the name of the policy in the search box. As you type, potential matches appear. If your policy is in the list, click it. Only your selected policy remains in the results. Click it to open the Policy Information page for that policy.

3. Select the platforms you want to include in the policy. Configuration pages for the selected platforms appear in Step 5.

4. Complete the Policy Information page and then click Next. The Policy Information page collects information, such as the policy name, to help you identify and track your policies. This page is similar for all policies.

5. Complete the platform pages. Platform pages appear for each platform you selected in Step 3. These pages are different for each policy. A policy might differ among platforms. Not all policies apply to all platforms.

   Some pages include tables of items. To delete an existing item, hover over the line containing the listing and click the trash can icon on the right side. In the confirmation dialog, click Delete.

   To edit an existing item, hover over the line containing the listing and click the pen icon on the right side.

To configure deployment rules, assignments, and schedule

For more information about configuring deployment rules, see Deploy resources.

1. On a platform page, expand Deployment Rules and then configure the following settings. The Base tab appears by default.

   • In the lists, click options to specify the deployment conditions. You can choose to deploy the policy when all conditions are met or when any conditions are met. The default option is All.
   • Click New Rule to define the conditions.
   • In the lists, click the conditions, such as Device ownership and BYOD.
   • Click New Rule again if you want to add more conditions. You can add as many conditions as you would like.

2. Click the Advanced tab to combine the rules with Boolean options. The conditions you chose on the Base tab appear.

3. You can use more advanced Boolean logic to combine, edit, or add rules.

   • Click AND, OR, or NOT.

   • In the lists, choose the conditions that you want to add to the rule. Then, click the Plus sign (+) on the right side to add the condition to the rule.

     At any time, you can click to select a condition and then click EDIT or Delete.

   • Click New Rule to add another condition.

4. Click Next to move to the next platform page or, when all the platform pages are complete, to the Assignments page.

5. On the Assignments page, select the delivery groups to which you want to apply the policy. If you click a delivery group, the group appears in the Delivery groups to receive app assignment box.

   Delivery groups to receive app assignment doesn’t appear until you select a delivery group.

   

6. On the Assignments page, expand Deployment Schedule and then configure the following settings:

   • Next to Deploy, click On to schedule deployment or click Off to prevent deployment. The default option is On.
   • Next to Deployment schedule, click Now or Later. The default option is Now.
   • If you click Later, click the calendar icon and then select the date and time for deployment.
   • Next to Deployment condition, click On every connection or click Only when previous deployment has failed. The default option is On every connection.

   • Next to Deploy for always-on connection, click On or Off. The default option is Off.

     Note:

     This option applies when you have configured the scheduling background deployment key in Settings > Server Properties.

     The always-on option:

     • Is not available for iOS devices
     • Is not available for Android, Android Enterprise, and Chrome OS to customers who began using Endpoint Management with version 10.18.19 or later
     • Is not recommended for Android, Android Enterprise, and Chrome OS to customers who began using Endpoint Management with before version 10.18.19

     The deployment schedule you configure is the same for all platforms. Any changes you make apply to all platforms, except for Deploy for always-on connection.

   

7. Click Save.

   The policy appears in the Device Policies table.

Remove a device policy from a device

The steps to remove a device policy from a device depends on the platform.

• Android

  To remove a device policy from an Android device, use the Endpoint Management Uninstall device policy. For information, see Endpoint Management uninstall device policy.

• iOS and macOS

  To remove a device policy from an iOS or macOS device, use the Profile Removal device policy. On iOS and macOS devices, all policies are part of the MDM profile. Thus, you can create a Profile Removal device policy for just the policy that you want to remove. The rest of the policies and the profile remain on the device. For information, see Profile Removal device policy.

• Windows 10 and Windows 11

  You can’t directly remove a device policy from a Windows Desktop or Tablet device. However, you can use either of the following methods:

  • Unenroll the device and then push a new set of policies to the device. Users then re-enroll to continue.

  • Push a security action to selectively wipe the specific device. That action removes all corporate apps and data from the device. You then remove the device policy from a delivery group that contains just that device and push the delivery group to the device. Users then re-enroll to continue.

• Chrome OS

  To remove a device policy from a Chrome OS device, you can remove the device policy from a delivery group that contains just that device. You then push the delivery group to the device.

Edit a device policy

To edit a policy, select the check box next to a policy. The options menu appears above the policy list. Or, click a policy in the list to show more controls.

To view policy details, click Show more.

To edit all settings for a device policy, click Edit.

If you click Delete, a confirmation dialog box appears. Click Delete again to delete the policy.

Check policy deployment status

Click a policy row on the Configure > Device Policies page to check its deployment status.

When a policy deployment is pending, users can refresh the policy from Secure Hub by tapping Preferences > Device Information > Refresh policy.

Filter the list of added device policies

You can filter the list of added policies by policy types, platforms, and associated delivery groups. On the Configure > Device Policies page, click Show filter. In the list, select the check boxes for the items you want to see.

Click SAVE THIS VIEW to save a filter. The name of the filter then appears in a button below the SAVE THIS VIEW button.

Device policy summaries

Device policies by platform