# Android Configurations

> Define the policies and restrictions applied to enrolled Android devices, and set which configuration wins by priority.

Source: https://docs.capaone.com/capaone/mobile-manager/android/android-configurations/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

Android configurations define the policies and restrictions that apply to enrolled Android
devices. Priority controls which configuration wins when a device matches more than one.

:::note[Enrollment mode is set at enrollment, not in configurations]
Whether a device is fully managed or has a work profile is determined when the device is
enrolled — not by the configuration applied to it afterward. Configurations control policies on
already-enrolled devices. See [Android Enrollment](/capaone/enrollment/android-enrollment/) for
how enrollment mode is chosen.
:::

## Configuration types

### Standard

Standard configurations apply general management policies — password requirements, app
permissions, network settings, and similar controls. Most Android devices in an organization use
a Standard configuration as their baseline.

### Kiosk

Kiosk configurations lock the device to a specific set of applications, turning it into a
single-purpose device. Use Kiosk mode for shared devices, point-of-sale terminals, data
collection devices, or any scenario where end users should not have access to the full Android
interface.

When Kiosk mode is active, the device home screen is replaced by a launcher that only shows the
applications you have approved.

Kiosk mode requires the device to be enrolled as **fully managed** (Personal usage disallowed).

### Max Days With Work Off

This configuration sets the maximum number of days the work profile can remain turned off before
the device is forced to turn it back on. It applies to devices that have a work profile — where
the user can toggle the work side on and off.

Use this to ensure employees do not indefinitely disable their work profile to avoid receiving
work apps and notifications.

## Enrollment mode and its effect on configurations

The management mode of a device is fixed at enrollment and determines what configurations can do:

**Personal usage disallowed (fully managed)** — the entire device is managed by CapaOne. There
is no separation between work and personal. This mode always requires the device to be either
fresh out of the box or factory reset before enrollment — you cannot enroll an already set-up
device in this mode. Kiosk configurations apply here.

**Personal usage allowed (work profile on company-owned device)** — the device has a separate
work profile alongside a personal profile. The work side is managed by CapaOne; the personal
side is not. This also requires the device to be fresh out of the box or factory reset before
enrollment.

**BYOD (personally-owned device)** — if a device is already set up when the user scans the
enrollment QR code, it enrolls as a BYOD device. A work profile is created on the device, but
CapaOne's ability to manage it is limited compared to company-owned enrollment. The device does
not need to be reset.

:::caution
Once a device is enrolled in a given mode, the mode cannot be changed without wiping and
re-enrolling the device.
:::

## Priority

When multiple configurations are assigned to the same device — for example, through overlapping
group memberships — CapaOne uses the **priority** value (0–100) to resolve conflicts. The
configuration with the **higher** priority number takes effect.

Set priority deliberately:

- A catch-all Standard configuration at a lower priority provides baseline settings for all
  devices.
- A Kiosk configuration at a higher priority overrides the baseline for devices in a specific
  group, such as shared warehouse scanners.

You can reorder priorities across all configurations at once using the **Change priority for
configurations** button.

## Assign configurations to endpoints or groups

Configurations are assigned to individual endpoints or to groups. Group assignment is the
recommended approach — it means any new device that joins the group automatically receives the
correct configuration without additional steps.

Click on a configuration name to open its detail page and manage group and endpoint assignments
from there.

## Good to know

- **One configuration wins per device** — when conflicts exist, the highest-priority
  configuration applies. Review priority settings if a device is not behaving as expected.
- **Configuration changes apply on the next device check-in** — there is no immediate push.
  Devices poll for configuration updates periodically.
- **Company-owned devices always need to be fresh or reset** — both fully managed and
  company-owned work profile enrollment require the device to start from factory settings.
  Personally-owned BYOD devices do not.