New Android Enterprise settings in the Intune settings catalog
The settings catalog lists all the settings you can configure in a device policy, and all in one place. The following new Android Enterprise settings are available in the Microsoft Intune settings catalog (Devices > Manage devices > Configuration > Create > New policy > Android Enterprise for platform > Settings catalog for profile type).
Applications
| Setting | Description | Applies to |
|---|---|---|
| Block apps from exposing app functions | This setting controls whether managed apps can expose app functions — programmatic actions that other apps and on-device assistants or AI agents can invoke inside the app. If True, apps on fully managed devices and apps in the work profile on corporate-owned devices are blocked from exposing app functions. If False (default OS behavior), apps are allowed to expose app functions. | COBO, COSU, COPE |
| Block widgets from work profile apps | If True, allows users to access widgets exposed by apps in the work profile on the device's home screen. If False, prevents access to these widgets. By default, the OS might allow widget access. | COPE |
Connectivity
| Setting | Description | Applies to |
|---|---|---|
| Allow selection of a preferential network service | If True, the device gives priority to the specified network service over other available options, such as an enterprise slice on 5G networks. If False, the device connects using its default network selection process. | COBO, COSU, COPE |
| Block airplane mode | If True, the device is prevented from enabling airplane mode. If False, the device follows the default airplane mode behavior of the OS. | COBO, COSU, COPE |
| Block cellular 2G | If True, the device prevents cellular 2G functionality, restricting user access to the setting. If False (default), the device follows the default cellular 2G behavior of the OS. Supported on Android 14 and later. | COBO, COSU, COPE |
| Block configuring cell broadcasts | If True, the device is prevented from receiving cell broadcast messages, such as emergency alerts. If False (default), Intune doesn't change or update this setting, and the OS might allow the reception of cell broadcast messages. | COBO, COSU, COPE |
| Block configuring mobile networks | True prevents users from configuring or modifying mobile network settings on the device. If False (default), Intune doesn't change or update this setting and the OS might allow users to adjust mobile network settings. | COBO, COSU, COPE |
| Block configuring VPN | If True, users can't add, edit, or remove VPN configurations on the device. If False or not configured, the device follows the default VPN configuration behavior of the OS. | COBO, COSU, COPE |
| Block network reset | If True, the device won't reset network settings even if a reset is attempted. If False (default), the device follows the default network reset behavior of the OS. | COBO, COSU, COPE |
| Block outgoing calls | If True, users are prevented from making outgoing calls on the device. If False (default), Intune doesn't change or update this setting, and the OS might allow outgoing calls. | COBO, COSU, COPE |
| Block SMS | If True, the device is prevented from sending or receiving SMS messages, restricting text communication. If False (default), the device follows the default SMS behavior of the OS. | COBO, COSU, COPE |
| Block ultra wideband | If True, the device prevents ultra wideband functionality, restricting user access to the setting. If False (default), the device follows the default ultra wideband behavior of the OS. Supported on Android 14 and later. | COBO, COSU, COPE |
| Select minimum Wi-Fi security level | Select the minimum Wi-Fi security level required for the device to connect to Wi-Fi networks. Options are Open network security, Personal network security, Enterprise network security, and Enterprise 192-bit network security. The default is Open network security, which allows the device to connect to all types of Wi-Fi networks. Supported on Android 13 and later. | COBO, COSU, COPE |
General
| Setting | Description | Applies to |
|---|---|---|
| Block printing | If True, the device is prevented from printing documents. If False (default), the device follows the default printing behavior of the OS. | COBO, COSU, COPE |
| Block setting user icon | If True, users are prevented from changing their user icon or profile image on the device. If False (default), Intune doesn't change or update this setting, and the OS might allow users to modify their user icon. | COBO, COSU, COPE |
| Block setting wallpaper | If True, users are prevented from changing the wallpaper on the device. If False (default), Intune doesn't change or update this setting, and the OS might allow users to change the wallpaper. | COBO, COSU, COPE |
| Block users from adding eSIM profiles | If True, users can't add eSIM profiles to the device. If False (default), users can add eSIM profiles based on the default behavior of the OS. | COBO, COSU, COPE |
Platform key:
- COBO — Android Enterprise corporate-owned fully managed
- COSU — Android Enterprise corporate-owned dedicated devices
- COPE — Android Enterprise corporate-owned devices with a work profile (at work profile level)
For a list of all settings you can currently configure, see Android Enterprise device settings list in the Intune settings catalog.
Applies to
- Android Enterprise
Terms in this update
This is in the weekly digest for week 39 · What changed this week? →
More Intune updates
Disable MAC address randomization on macOS Wi-Fi profiles
Enforce Routes capability in iOS/iPadOS and macOS VPN profiles
New Apple settings in the Settings Catalog for iOS/iPadOS and macOS
Configure screen timeout for corporate Android devices
Keep Android device screens on while charging
Limit how long an Android work profile can stay off
Text by Microsoft, from Microsoft's documentation. Features and dates may change. Terms and the timeline are added by 365Fanatic.
