---
title: Lockdown policy fields for Samsung Knox devices in Device Admin mode
slug: epmm/getting-started-guide/lockdown-policy-fields-for-samsung-knox-devices-in-device-admin-mode
createdAt: 2026-10-06T07:50:25.439Z
---
These lockdown options are applied to Samsung Knox devices in Device Admin mode.
Table: Lockdown policy fields: Samsung(Device Admin mode)
| Item | Description | Default Policy Setting |
| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- |
| Android Browser | Enable or disable access to the Android browser. | Enable |
| Email Account Creation | Enable or disable the device user’s ability to configure an email account on the device. | Enable |
| Cellular Data | Enable or disable the ability for users to use cellular data.
If you disable both cellular data and Wi-Fi on a device, Ivanti EPMM can no longer communicate with the device. The device may need a factory reset to restore functionality. | Enable |
| Factory Reset | Enable or disable the ability for users to reset the device to factory defaults. | Enable |
| Google Backup | Enable or disable backup to Google servers. | Enable |
| Google Play | Enable or disable access to Google Play. | Enable |
| Incoming MMS | Enable or disable incoming MMS messages.
The user is not informed if MMS is blocked. | Enable |
| Incoming SMS | Enable or disable incoming SMS messages.
The user is not informed if SMS is blocked. | Enable |
| Make Passwords Visible | Select Enable to allow users to change the “Make Passwords Visible” setting on their device. Select Disable to prevent users from changing this setting and make password characters not visible. | Enable |
| Developer options | Enable or disable this option to make USB debugging available to developers on Samsung Knox devices. | Enable |
| Management Removal | Enable or disable the device user’s ability to remove the Samsung DM Agent from Android devices. | Enable |
| OTA Upgrade | Enable or disable over-the-air upgrades of the device firmware.
Over-the-air upgrades require the device to be in recovery mode. Therefore, for devices to perform an over-the-air upgrade, enable both Recovery Mode and OTA Upgrade in the lockdown policy.
WARNING: Do not disable Setting Changes in the lockdown policy if OTA Upgrade is enabled. Disabling Setting Changes when OTA Upgrade is enabled can result in a non-functional device because setting changes are required for upgrade. | Enable |
| Outgoing MMS | Enable or disable outgoing MMS messages. | Enable |
| Outgoing SMS | Enable or disable outgoing SMS messages. | Enable |
| Recovery Mode | Enable or disable the device from entering Recovery Mode. Caution: use Disable with care. Disabling recovery mode on a device may make the device unrecoverable if there is an issue with the device’s operating system. | Enable |
| Roaming Voice Calls | Enable or disable voice calls while roaming. | Enable |
| Safe Mode | Enable or disable the user’s ability to reboot a Samsung Knox device into Safe Mode.
A device running in Safe mode is not protected by Ivanti EPMM, because only system apps run in Safe mode. | Enable |
| Setting Changes | Enable or disable the device user access to the settings app.
WARNING: Do not disable Setting Changes if OTA Upgrade is enabled. Disabling Setting Changes when OTA Upgrade is enabled can result in a non-functional device because setting changes are required for upgrade. | Enable |
| Tethering - Bluetooth | Enable or disable Bluetooth tethering.
Refer to “Bluetooth lockdown for Samsung Knox devices” in the Ivanti EPMM Device Management Guide for Android and Android Enterprise devices | Enable |
| Tethering - USB | Enable or disable USB tethering. | Enable |
| Tethering - Wi-Fi | Enable or disable Wi-Fi tethering. | Enable |
| Unknown Sources | Enable or disable installation of apps from sources other than Google Play. | Enable |
| USB Media Player | Enable or disable the USB media player. | Enable |
| YouTube App | Enable or disable access to YouTube App. | Enable |
| Manual Date Time Change | Enable or disable the ability to manually change the date and time. | Enable |
| Certificate Revocation Status (CRL) Check | Enable or disable the Certificate Revocation List (CRL) check for revocation of the server-certificate chain during the SSL mutual authentication process. | Disable |
| Google Crash
Report | An administrator can use this API to enable or disable sending a crash report to Google. If disabled, all possible Google crash reports are blocked. | Enable |
| Google Accounts Auto-sync | Enable or disable Google accounts auto-sync. | Enable |
| Multi-user mode | Enable or disable the Multi-user mode | Enable |
| New admin installation | Enable or disable new administrator installation | Enable |
| Allow USB HID Protocol | Enable or disable the USB Human Interface Device (HID) protocol. | Enable |
| Restricted Apps | List apps that you want to prevent from being installed or run on Samsung Knox devices.
Click + to add an application identifier (app ID) for the app. The app ID is case-sensitive. You can use the wild card character \* to cover a set of apps, such as all apps from a particular vendor.
For example, com.abcdef.\* restricts all application IDs beginning with com.abcdef.
However, to ensure that pre-existing apps get restricted, provide the complete app ID. Do not use a wild card character. | (empty) |
| Allowed Apps | List the apps that you that are exceptions to the apps covered by a wild card character in the Restricted Apps section.
Click + to add an application identifier (app ID) for the app. The app ID is case-sensitive. | (empty) |
| Turn Off Wi-Fi for these SSIDs | Prevent Samsung Knox devices from accessing the Wi-Fi SSIDs listed in this section.
Click + to add an SSID. The SSID is case-sensitive.
Do not restrict Wi-Fi SSIDs that are configured for the device.
In Ivanti Mobile\@Work 9.0.0.0 for Android, connection to SSIDs listed in this section can occur if the SSID is managed and Always Connect Device to Managed Wi-Fi is enabled. | (empty) |
**Related topics **
[Lockdown policies](docId\:hTu83m17kGxs-_LTZsIEX)