Key Takeaways
- Secure Android Enterprise devices with Device Restrictions policies.
- Protect corporate data by controlling device features and settings.
- Restrict data sharing between work and personal profiles.
- Manage work profile behavior to improve security.
Let’s learn Configure Password Policies for Android Enterprise Work Profile using Intune. Android for Work Device Restriction Policies Deployment is the Security Policy for Android Devices. Security policies are important to secure the corporate data and applications on those devices. Microsoft Intune provides Device Restrictions policies to help organizations secure Android Enterprise devices by controlling device features and restricting user actions.
Table of Contents
Table of Contents
Configure Password Policies for Android Enterprise Work Profile using Intune
In this guide, you’ll learn how to create and deploy an Android Enterprise Device Restrictions policy using the Microsoft Intune admin center. We’ll walk through the policy creation process, configure the available restriction settings, and assign the policy to Microsoft Entra ID groups.
By implementing Device Restrictions policies, administrators can control work profile behavior, limit data sharing, manage hardware features, and enhance the overall security of Android Enterprise devices. Following these best practices helps organizations maintain a secure and compliant mobile environment.
- Intune Create Device Restriction Policy Profiles Deploy Security Policies to Windows 10 Devices
- New Device Restriction Settings Available in Apple Settings Catalog
- Additional App Configuration Permissions for Android Apps
- Microsoft Intune Extends Support to Android 10 and Later from October 2024
Get Start the Profile Creation
To begin, sign in to the Microsoft Intune admin center with an account that has the required administrative permissions. From the left navigation pane, select Devices, and then click Configuration to access the list of device configuration policies.
- On the Configuration page, click + Create, and then select + New policy.
When you select + New policy, the Create a profile window opens. Here, choose Android Enterprise as the Platform, Templates as the Profile type, and then select Device restrictions from the list of available templates. Templates provide a preconfigured collection of settings organized by functionality, making it easier to create policies without manually selecting individual settings.
They help administrators quickly configure common device management and security settings for managed devices. After selecting Device restrictions, click Create to begin configuring the policy.
| Platform | Profile Type |
|---|---|
| Android Enterprise | Device Restrictions |
Basic Tab
On the Basics page, provide a meaningful Name and an optional Description for the Device Restrictions policy. Using a descriptive policy name makes it easier to identify and manage the policy in the Microsoft Intune admin center, especially when multiple configuration profiles are deployed.
For this example, enter Android Enterprise Device Restrictions as the policy name and Configures device restriction settings for Android Enterprise devices as the description. Verify that the Platform is set to Android Enterprise and the Profile type is Device restrictions, then click Next to continue.
Configuration Settings
On the Configuration settings page, you’ll find several categories of device restriction settings, including General, System security, Device experience, Device password, Power Settings, Users and Accounts, Applications, Connectivity, Work profile password, and Personal profile. These categories allow you to configure security and device management settings based on your organization’s requirements.
| Category | Purpose |
|---|---|
| General | Controls core device behaviors such as screen capture, camera access, date or time changes, and roaming data |
| System security | Defines encryption, certificate, and security patch requirements. Strengthens device integrity and compliance. |
| Device experience | Manages user interface and experience settings like status bar visibility, notifications, and accessibility features. Ideal for kiosk or frontline devices. |
| Power Settings | Controls power menu access, sleep behavior, and battery optimization. Prevents unauthorized shutdowns or tampering. |
| Users and Accounts | Restricts account additions, sync settings, and user management. |
| Applications | Manages app installation permissions, updates, and restrictions. Supports app whitelisting or blacklisting for compliance. |
| Connectivity | Controls Bluetooth, Wi‑Fi, USB, and hotspot access. Prevents data leakage and enforces secure network usage. |
| Work profile password | Enforces password rules specifically for corporate‑owned work profiles, expiry, and wipe thresholds. Protects enterprise data within work containers. |
| Personal profile | Control camera, screen capture, and app installation from unknown sources. Balances privacy and control. |
| Custom support information | Displays IT helpdesk contact or support portal details on the device. Improves user self‑service and compliance. |
Configure Work Profile Device Restriction Settings
Expand the required category to configure its available settings. In this example, the Work profile password section is used to define password requirements for corporate-owned work profile devices, including the required password type, minimum password length, password expiration period, password history, sign-in failure threshold, and unlock frequency.
- Expand each category and configure the appropriate settings for your Android Enterprise devices.
- Review the configured options carefully before proceeding. After completing the required configurations, click Next to continue to the next step.
| Setting | Info |
|---|---|
| Required password type | Numeric complex |
| Minimum password length | 6 |
| Number of days until password expires | 90 |
| Number of passwords required before reuse | 22 |
| Number of sign‑in failures before wiping device | 10 |
| Required unlock frequency | Device default |
Scope Tags Settings
Scope tags help limit which administrators can view and manage this Device Restrictions policy based on their assigned roles. Click Select scope tags to choose one or more scope tags, or leave the default configuration if your organization doesn’t use RBAC. After completing this step, click Next to continue.
Importance of Assignments
The Assignments page determines which users or devices receive the Android Enterprise Device Restrictions policy. Under Included groups, click Add groups and select the Microsoft Entra ID user or device groups that should receive the policy. If necessary, you can also configure Excluded groups to prevent the policy from applying to specific users or devices.
- After selecting the appropriate groups, review the assignment configuration and click Next.
Review + Create Options
The Review + create page displays a summary of the policy configuration, including the platform, profile template, configured device restriction settings, scope tags, and assignments. Carefully review all settings to ensure they match your organization’s security requirements before creating the policy.
If you need to make any changes, click Previous to return to the relevant step. When you’re satisfied with the configuration, click Create to deploy the Android Enterprise Device Restrictions policy.
Monitor Device Restrictions Policy Deployment Status
After creating the Android Enterprise Device Restrictions policy, you can monitor its deployment status from the Microsoft Intune admin center. Navigate to Devices > Configuration, and then select the Android Enterprise Device Restrictions policy you created.
Open the Device and user check-in status or Overview page to review the deployment results. Here, you can verify whether the policy was successfully applied to the targeted devices and identify any devices with Pending, Error, Conflict, or Not applicable statuses. This information helps troubleshoot deployment issues and confirm that the policy is being enforced correctly.
Delete the Device Restrictions Policy
If the Device Restrictions policy is no longer required, you can permanently delete it from Microsoft Intune. Go to Devices > Configuration, locate the Android Enterprise Device Restrictions policy, and select it.
Click the 3-dot (More) menu or Delete option from the command bar, and then confirm the deletion when prompted. Once deleted, the policy is permanently removed from Intune and will no longer be applied to managed Android Enterprise devices.
For detailed information, you can refer to our previous post – Learn How to Delete or Remove App Assignment from Intune using by Step-by-Step Guide.
Remove Assigned Groups from the Device Restrictions Policy
If you no longer want the Device Restrictions policy to apply to specific users or devices, you can remove the assigned groups from the policy. Open the policy, select Properties, and click Edit next to Assignments.
Under Included groups, remove the Microsoft Entra ID groups that are currently assigned to the policy. Review the updated assignments and click Review + save, After the policy is updated, it will no longer be deployed to the removed groups.
For detailed information, you can refer to our previous post – How to Delete Allow Clipboard History Policy in Intune Step by Step Guide.
User Experience of Security Policy for Android Devices
The user experience of Android for Work devices can vary depending on the manufacturer of the devices. As mentioned in the previous post, Samsung and Nexus are the best-experienced devices I have tested.
But I would admit the user experience of Android for Work is far better than that of an Android device! As Android devices have different variants, it’s better to ensure that all the security policies for the Android device experience are excellent for all manufacturers.
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community and WhatsApp Channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
Anoop C Nair has been Microsoft MVP from 2015 onwards for 10 consecutive years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is also a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc.