diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index a23f8895512ea..82460f90c45ad 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -18359,9 +18359,9 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
     public StringParceledListSlice getOwnerInstalledCaCerts(@NonNull UserHandle user) {
         final int userId = user.getIdentifier();
         final CallerIdentity caller = getCallerIdentity();
-        Preconditions.checkCallAuthorization((userId == caller.getUserId())
-                || isProfileOwner(caller) || isDefaultDeviceOwner(caller)
-                || hasFullCrossUsersPermission(caller, userId));
+        Preconditions.checkCallAuthorization(
+                (isProfileOwner(caller) || isDefaultDeviceOwner(caller) || canQueryAdminPolicy(
+                        caller)) && hasFullCrossUsersPermission(caller, userId));
 
         synchronized (getLockObject()) {
             return new StringParceledListSlice(