Android Configurations

Android configurations define the policies and restrictions that apply to enrolled Android devices. Priority controls which configuration wins when a device matches more than one.

Enrollment mode is set at enrollment, not in configurations

Whether a device is fully managed or has a work profile is determined when the device is enrolled — not by the configuration applied to it afterward. Configurations control policies on already-enrolled devices. See Android Enrollment for how enrollment mode is chosen.

Configuration types

Standard

Standard configurations apply general management policies — password requirements, app permissions, network settings, and similar controls. Most Android devices in an organization use a Standard configuration as their baseline.

Kiosk

Kiosk configurations lock the device to a specific set of applications, turning it into a single-purpose device. Use Kiosk mode for shared devices, point-of-sale terminals, data collection devices, or any scenario where end users should not have access to the full Android interface.

When Kiosk mode is active, the device home screen is replaced by a launcher that only shows the applications you have approved.

Kiosk mode requires the device to be enrolled as fully managed (Personal usage disallowed).

Max Days With Work Off

This configuration sets the maximum number of days the work profile can remain turned off before the device is forced to turn it back on. It applies to devices that have a work profile — where the user can toggle the work side on and off.

Use this to ensure employees do not indefinitely disable their work profile to avoid receiving work apps and notifications.

Enrollment mode and its effect on configurations

The management mode of a device is fixed at enrollment and determines what configurations can do:

Personal usage disallowed (fully managed) — the entire device is managed by CapaOne. There is no separation between work and personal. This mode always requires the device to be either fresh out of the box or factory reset before enrollment — you cannot enroll an already set-up device in this mode. Kiosk configurations apply here.

Personal usage allowed (work profile on company-owned device) — the device has a separate work profile alongside a personal profile. The work side is managed by CapaOne; the personal side is not. This also requires the device to be fresh out of the box or factory reset before enrollment.

BYOD (personally-owned device) — if a device is already set up when the user scans the enrollment QR code, it enrolls as a BYOD device. A work profile is created on the device, but CapaOne’s ability to manage it is limited compared to company-owned enrollment. The device does not need to be reset.

Caution

Once a device is enrolled in a given mode, the mode cannot be changed without wiping and re-enrolling the device.

Priority

When multiple configurations are assigned to the same device — for example, through overlapping group memberships — CapaOne uses the priority value (0–100) to resolve conflicts. The configuration with the higher priority number takes effect.

Set priority deliberately:

• A catch-all Standard configuration at a lower priority provides baseline settings for all devices.
• A Kiosk configuration at a higher priority overrides the baseline for devices in a specific group, such as shared warehouse scanners.

You can reorder priorities across all configurations at once using the Change priority for configurations button.

Assign configurations to endpoints or groups

Configurations are assigned to individual endpoints or to groups. Group assignment is the recommended approach — it means any new device that joins the group automatically receives the correct configuration without additional steps.

Click on a configuration name to open its detail page and manage group and endpoint assignments from there.

Good to know

• One configuration wins per device — when conflicts exist, the highest-priority configuration applies. Review priority settings if a device is not behaving as expected.
• Configuration changes apply on the next device check-in — there is no immediate push. Devices poll for configuration updates periodically.
• Company-owned devices always need to be fresh or reset — both fully managed and company-owned work profile enrollment require the device to start from factory settings. Personally-owned BYOD devices do not.