In the Cortado administration portal, you will find a variety of policies for the lock screen. These help you to control access to locked devices and thus increase device and data security. Especially for company-owned devices (COBO, COPE), there are a number of options available to you, which we would like to present to you in this article.
Aim
In this How-To, we will show you how to configure lock screen policies to increase device and data security.
Implementation
- In the Cortado administration portal, select Administration→ Policies.
- Add a new policy by clicking on the plus icon.
- Then select Android and as the setup method Fully managed device, Work profile or Work profile on company-owned device (example in illus.).
- Under Lock screen, you will find the options that are explained in more detail below. The image shows the available policies for fully managed devices. All settings are allowed here by default.
Note! Only some of the guidelines described below are available on devices with a work profile or work profile on company-owned devices.
Allow lock screen features
- Remove the tick from the Allow lock screen features checkbox if you want to deactivate all of the following settings.
Allow display of notification content
Allow unlocking with trusted devices (Smart Lock)
Allow fingerprint authentication
Allow use of camera
On most Android models, the camera can be started by pressing the on/off switch twice, even if the device is locked. If you want to prevent users from opening the camera app on the lock screen, remove the tick from the checkbox and assign the policy to the users/groups/devices.
This policy only affects the lock screen. When the device is unlocked, the camera can still be opened using the on/off switch, unless configured otherwise in the device settings.
Allow showing notifications
If you want to prevent notifications from being displayed on the lock screen, remove the tick from the checkbox and then assign the policy to the users/groups/devices.
Notifications are now no longer displayed on the lock screen (left illus.). No more changes can be made to the Lock screen notifications option under Settings→ Notifications (right illus.).
Allow display of notification content
You can use this policy to prevent sensitive message content from being displayed on the lock screen. Remove the tick from the checkbox and assign the policy to the users/groups/devices. Users are notified of incoming emails, chat messages (etc.) (left illus.), but their content is not displayed as long as the device is locked (right illus.). In the device settings under Notifications, no changes can be made to the Lock screen notifications option (top right image).
Allow unlocking with trusted devices (Smart Lock)
Android Smart Lock is a feature on Android devices that allows users to automatically keep their device unlocked in certain trusted situations. Devices then remain unlocked in trusted locations, near trusted devices or through wearer recognition. Smart Lock can therefore become a security risk under certain circumstances. If you want to prevent the use of Smart Lock, remove the tick from the checkbox and assign the policy to the users/groups/devices. Smart Lock is then blocked under Settings→ Security & privacy→ More security settings (left and right image).
Allow fingerprint authentication
You can use this policy to prevent users from unlocking their Android device with a fingerprint. To do this, remove the tick from the checkbox and assign the policies to the users/groups/devices. Unlocking the device with a fingerprint is then no longer possible. Under Settings→ Security & privacy→ Device lock→ Pixel Imprint (arrow in left illus.), users will find the corresponding note (middle illus.).
