Kaspersky Secure Mobility Management

App Control on Android devices

Expand all | Collapse all

The App Control component lets you manage apps on Android devices and configure use of these apps to keep the devices secure.

You can restrict user activity on a device on which forbidden apps are installed or required apps are not installed (for example, by locking the device). You can impose restrictions using the Compliance Control component. To do so, in the rule settings, you must select the Forbidden apps are installed, Apps from forbidden categories are installed, or Not all required apps are installed criterion.

Kaspersky Endpoint Security for Android must be set as an Accessibility feature to ensure proper functioning of App Control. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or later disable this service in the device settings. If the user does this, App Control will not run.

On corporate devices, you have extended control over the device. App Control operates without notifying the device user:

• Required apps are installed automatically in the background. To install apps silently, you need to specify a link to the APK file of the required app in the policy settings.
• Forbidden apps can be deleted from the device automatically. To delete apps silently, you need to select the Remove forbidden apps automatically check box in the policy settings.

To configure app startup settings on the mobile device:

1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
2. In the policy properties window, select Application settings.
3. Select Android and go to the Security controls section.
4. On the App Control card, click Settings.

   The App Control window opens.

5. Enable the settings using the App Control toggle switch.
6. Configure the settings on the following tabs:
   • If you want to configure general rules of app management, go to the App use tab.
     1. In the Operating mode drop-down list, select the App Control mode:
        • To allow the user to start all apps except those specified as blocked in the list of categories and apps, select Use all apps except forbidden ones. Kaspersky Endpoint Security for Android will hide icons of forbidden apps. This option is selected by default.
        • To allow the user to start only apps specified in the list of categories and apps as allowed, recommended, or required apps, select Use only allowed apps. Kaspersky Endpoint Security for Android will hide icons of all apps except those specified in the list of allowed, recommended, or required apps and system apps.
     2. If you want Kaspersky Endpoint Security for Android to send data on forbidden apps to the event log without blocking them, select the Do not block forbidden apps, only add a record to the event log check box.
     3. If you want Kaspersky Endpoint Security for Android to block startup of system apps (such as Calendar, Camera, and Settings) on the user's mobile device, select the Block system apps check box. This check box is displayed in the Use only allowed apps mode.

        We recommend that you do not block system apps because doing so could cause the device to malfunction.

     4. If you want Kaspersky Endpoint Security for Android to remove forbidden apps from the device in the background without notifying the user, select the Remove forbidden apps automatically check box. This check box is displayed in policies for managing corporate devices.
     5. Click Add to add apps and categories for which you want to set rules.

        The Add app or category window opens.

     6. In the Object field, select either App or App category and do the following:
        • If you selected App, select an installation package or specify the package name and the app name in the corresponding fields.
        • If you selected App category, select a category and enter a description in the corresponding fields.
        • Click Add.

        The app or category is added to the list.

     7. If you want to configure exceptions from listed forbidden or allowed apps, click Exceptions, specify package names in the window that opens, and click OK.
     8. If you want to receive reports on installed apps, in the Report on installed apps section, select the Send data on installed apps check box. Then you can select the following check boxes:
        • Send data on built-in apps to send data on system apps.
        • Send data on service apps to send data on service apps that have no user interface and cannot be started manually.

        If a system app or service app is configured in the App Control settings, app data is sent regardless of the state of the check boxes.

        Kaspersky Endpoint Security for Android sends data to the event log each time an app is installed on a device or removed from it.

   • If you want to set actions to be performed for selected apps, go to the App management tab.
     1. In the Actions for apps table, click Add.
     2. In the window that opens, do the following:
        1. In the Action field select one of the following actions:
           • Install. The user will be prompted to install the app.
           • Remove. The app will be deleted from the user's device.
           • Recommend installation. The user will receive a recommendation to install the app.
        2. Fill in the following fields:
           • Package name
           • App name
           • Link

             Links to app packages must start with http:// or https://.

           • Version

             This field is a string parameter specified in the format of Oracle regular expressions. For more details on regular expressions, please refer to the Oracle Technical Support website.

             The Link and Version fields are not displayed if you select Remove in the Action field.

        3. Click Add.

     The configured action is added to the list.

7. Click OK.
8. Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.