Manage Android devices

This article is for Google Apps for Business, Education, and Government administrators. Not an administrator? See Device Policy for Android: Overview for Users.

As a Google Apps administrator, you can do the following to manage users' Android devices on which the Google Apps Device Policy app is installed:

  • Enforce security policies: Use the "Mobile settings" page in your Admin console to require a password on users' devices and set password requirements. Learn more about Google Apps Mobile Management

  • Remotely wipe devices: If a user's device is lost or stolen, you can remotely erase data on the device and reset it. Learn more
What your users can do with Google Apps Device Policy

Users can use the Google Apps Device Policy app on their mobile Android devices to:

  • View security policies that you set on their phone.

  • Manage their devices: Users can access the "My Devices" page to reset their device's PIN, and ring, lock, and locate their device. Additionally, enabling Allow user to remote wipe device in your Admin console gives users the ability to remotely wipe their own devices from their My Devices page. Learn more.

  • Multiple account support: If a user's device is set up to use Device Policy with multiple Google Apps accounts with different policies, the most restrictive policy will be enforced on the device. For example, if one domain requires the device PIN to be 4 characters long and another requires it to be 6 characters long, the device will enforce the 6 character limit.
Requirements for Google Apps Device Policy
  • Android 2.2 and higher
  • Google Apps for Business, Education, or Government

See below for special installation steps for Android 2.2 users.

Deploy Google Apps Device Policy for your organization
  1. Sign in to the Google Admin console.
  2. Go to your Mobile settings page.

  3. (optional) Create Organizational units to put your users in to enforce specific device policies.

  4. Before checking Enforce policies on Android devices or Enable device activation, email your Android users instructing them to download the Google Apps Device Policy app from Google Play.

  5. Have your users install the Device Policy app before you enable Device Policy in your Google Admin console. Otherwise, these Android 2.2 users will need to follow the special download instructions.

    If you have many Android 2.2 users, we recommend you plan a deployment day on which you install the Device Policy app on their phones. Learn more about installing the Device Policy app for Users.

  6. (optional) If you've enabled device activation, see the Activation article for steps you need to take to approve your users' devices.

Device Policy is now being enforced on your users devices. You can block devices or change your policies at any time.

Special Device Policy setup instructions for Android 2.2 users

Android 2.2 users can't use Google Play until they install the Device Policy app. We recommend you organize a mobile deployment day where you download the app on your users' phones.

Once you check Enforce policies on Android devices or Enable device activation on your Mobile settings page in your Admin console, Android users already syncing to Google Apps before you enabled these settings will continue to sync until their existing authentication cookies expire. It may take several days for their cookies to expire and for the new settings you've enabled to be enforced on these devices.

Users first setting up their Android to sync with their Google Apps account after you've enabled these settings will need to download Google Apps Device Policy before they can sync.

These new Android users have 2 options to install the Device Policy app, depending on whether or not their Android phone can install applications from "Unknown sources".

  • Option 1: If the user's Android 2.2 phone allows apps from "Unknown Sources", see:
    Install Device Policy on Android 2.2 phones.
    1. On their phone, go to Settings > Applications > and check Unknown sources: Allow installation of non-Google Play applications.
    2. Install the Device Policy app on their phone from this download link: http://dl.google.com/adm/dmagent.apk
      With the app installed, you can now access Google Play on the device.
    3. Go to Google Play and install the latest version of "Google Apps Device Policy" (so that the user will continue to receive updated versions of the app).
    4. Go to Settings > Applications > and uncheck Unknown sources.

    Alternatively, if you think your users can complete these steps on their own, send them an email message with the instructions. We've included these instructions in our sample email.

  • Option 2: If the user's Android 2.2 phone does not allow apps from "Unknown Sources" (for example, it uses AT&T or a carrier that blocks the installation of non-Google Play apps), see:
    Install Device Policy on Android 2.2 phones with AT&T.

    If you tried the directions above and aren't able to check Unknown sources: Allow installation of non-Market applications, your user may be using an AT&T phone or a device from a provider that doesn't allow you to download non-Google Play apps.

    Install the Device Policy app from Google Play from their consumer Gmail account by doing the following on their device:

    1. Go to Settings > Accounts and Sync.
    2. Touch Add Account.
    3. Sign in using a consumer Gmail account (not the Google Apps account). If your user doesn't have one, touch Create and add an account.
    4. Open Google Play and search for "Google Apps Device Policy".
    5. Follow the installation steps to activate Google Apps Device Policy and add your user's Google Apps account (not their consumer Gmail account).

    Alternatively, if you think your users can complete these steps on their own, send them an email message with the instructions. We've included these instructions in our sample email.

Frequently Asked Questions for Device Policy for Android

How do my users uninstall Device Policy?

See Uninstall Google Apps Device Policy.

How do I remotely wipe a device?

See Remote Wipe a Mobile Device.

How do I find out what version of Android my user has on their phone?

On their device, go to Settings > About phone > Software information. Android version should be 2.2 or higher to work with Device Policy.

How do my users upgrade to the latest version of Android?

Upgrades are usually dependent on the carrier. Contact your user's carrier for more information on their software update cycle.

I don't see Google Play on the device. How do I get it?

Android Market was rebranded as Google Play on March 6, 2012. Older devices may still refer to the app as "Android Market" or "Market".

I only want Device Policy for a certain group in my domain. Can I enforce Device Policy on an individual or group-level basis?

Yes. You can create organizational units and enforce specific device policies for members of each organizational unit. For more information, see Org Settings.

In what countries is Google Apps Device Policy available?

Google Apps Device Policy should be available in all countries where Google Apps is available. Please contact Google Apps support if you're unable to set up Google Apps Device Policy for your organization.

Error messages with Device Policy

"Authentication failed. Please enter the password correctly and try again" appears after my users have installed Device Policy and are trying to set it up with their Google Apps account.

Have them repeat step 2 in Set up Device Policy on your phone or tablet a couple times, selecting their Google Apps account. They may need to re-enter your password if you see this error message.

If they keep getting the error, and they've enabled 2-step verification for their account, they'll need to enter an application-specific password instead of their Google Apps password in the device.

"Sign-in error for [user's email address]" appears in my user's Android status bar at the top of the screen when setting up Device Policy.

When your user presses this error message on their device, they're taken to a screen that says "You entered the wrong password or your account has changed. Please re-enter your password." Have your user re-enter their password.

If your user has 2-step verification enabled, he will need to enter an application-specific password instead of his password the first time he signs in to his Android.

Error message: "Your domain requires mobile device management. Please install the Google Apps Device Policy application to enforce security policies required by the (your email address) account."

Your user's getting this error because you've enabled device activation and your user hasn't yet installed Google Apps Device Policy on their Android. Have your user press the download button on their Android to download the Device Policy app.