From bf1087d8f664c66ac0e1e4bc0194ec48ae5ba46e Mon Sep 17 00:00:00 2001 From: Andrew Solovay Date: Mon, 7 Mar 2016 14:08:41 -0800 Subject: [PATCH] docs: New "Android for Work Changes" preview doc Moving the AfW changes out of the preview overview and into its own doc. See first comment for doc stage location. bug: 27514757 Change-Id: Ibe280096ab5ba45a99e3178b2f2b4a480a2ba84d --- docs/html/preview/features/afw.jd | 543 ++++++++++++++++++++++++++++++ docs/html/preview/preview_toc.cs | 3 +- 2 files changed, 545 insertions(+), 1 deletion(-) create mode 100644 docs/html/preview/features/afw.jd diff --git a/docs/html/preview/features/afw.jd b/docs/html/preview/features/afw.jd new file mode 100644 index 0000000000000..a67a1c88e33b4 --- /dev/null +++ b/docs/html/preview/features/afw.jd @@ -0,0 +1,543 @@ +page.title=Android for Work Updates +page.metaDescription=New Android for Work APIs and features in the N Developer Preview. +page.keywords="android for work", "android N", "enterprise", "QR code" + +@jd:body + +
+ +
+ +

This document describes the new Android for Work features provided in the +N Developer Preview.

+ +

QR Code Provisioning

+ +

+ Android for Work now supports using QR codes to provision corporate-liable + devices. The setup wizard now allows you to scan a QR code to provision + the device. +

+ +

Work Profile Security Challenge

+ +

+ Profile owners can require users to specify a security challenge for apps + running in the work profile. The system shows the security challenge when the + user attempts to open any work apps. If the user successfully completes the + security challenge, the system unlocks the work profile and decrypts it if + necessary. +

+ +

+ If a profile owner sends an {@link + android.app.admin.DevicePolicyManager#ACTION_SET_NEW_PASSWORD} intent, the + system prompts a user to set up a security challenge. The profile owner can + also send an ACTION_SET_NEW_PARENT_PROFILE_PASSWORD intent to + prompt the user to set a device lock. +

+ +

+ Profile owners can choose to set the password policies for the work challenge + differently from the policies for other device passwords. For example, the + minimum length for the device challenge response can be different from the + length required for other passwords. Profile owners set the challenge + policies using the usual {@link android.app.admin.DevicePolicyManager} + methods, such as {@link + android.app.admin.DevicePolicyManager#setPasswordQuality + setPasswordQuality()} and {@link + android.app.admin.DevicePolicyManager#setPasswordMinimumLength + setPasswordMinimumLength()}. The profile owner can also set the device lock, + by using the {@link android.app.admin.DevicePolicyManager} instance returned + by the new DevicePolicyManager.getParentProfileInstance() + method. Additionally, profile owners can customize the credentials screen for + the work challenge by using the {@link android.app.admin.DevicePolicyManager} + class's new setOrganizationColor() and + setOrganizationName() methods. +

+ +

+ For details on the new methods and constants, see the + DevicePolicyManager reference page in the N Preview SDK Reference. +

+ +

Disable Access to Apps

+ +

+ Device owners and profile owners can temporarily suspend access to packages + by calling the new DevicePolicyManager.getPackagesSuspended() + method.Owners can use the same method to re-enable those packages. +

+ +

+ While a package is suspended, it cannot start activities, and notifications + to the package are suppressed. Suspended packages do not show in the overview screen, and they + cannot show dialogs (including toasts and snackbars). They also cannot play + audio or vibrate the device. +

+ +

+ Launchers should apply a distinctive UI to suspended apps to show that the + apps aren't currently available; for example, they might render the app icon + in gray. Launchers can find out which apps are suspended by calling the new + DevicePolicyManager.getPackagesSuspended() method. +

+ +

Toggle Work Mode

+ +

On dual-profile devices, users can toggle work mode on and off. While work + mode is turned off, the managed profile is temporarily shut down. Work profile apps, background sync, and notifications are all disabled, including the profile + owner app. While the work profile is disabled, the system displays a persistent status icon to remind users that they can't launch work apps. The system launcher + indicates that work apps and widgets are not accessible. +

+ + +

Always-On VPN

+ +

+ Device owners and profile owners can require that work apps always connect to + the network through a specified VPN. If owners set this requirement, the + device automatically starts that VPN at boot time. +

+ +

+ Owners can require use of a VPN by calling the new + DevicePolicyManager.setAlwaysOnVpnPackage() method. To find out + if the owner has set a VPN requirement, call the new + DevicePolicyManager.GetAlwaysOnVpnPackage() method. +

+ +

+ Because the system can directly bind VPN services without app interaction, + VPN clients need to handle new entry points for always-on VPN. As before, you + can find active services by using an intent filter that matches the action + {@link android.net.VpnService android.net.VpnService}. +

+ +

+ Users can manually set an always-on VPN client that implement {@link + android.net.VpnService} by using the Settings > More > + VPN screen. +

+ +

Contacts Integration with Work Profile

+ +

+ Profile owners can allow local search and directory lookup of work contacts + from the primary user. For example, a user can access both personal and work + directory contacts from their personal dialer or contacts application (if + permitted by their profile administrator). +

+ +

+ Developers that leverage the Contact Provider can use the Enterprise Contacts + API to access work profile directory entries from the primary user if allowed + by policy: +

+ + + +

+ Profile owners can control the visibility of work contacts in the primary + user using the following new methods: +

+ + + +

Remote Reboot

+ +

+ Device owners can remotely reboot devices. In some cases, devices deployed in + public places inside enclosures can prevent access to the power button. If a + device needs to be rebooted, administrators can do so using the new + DevicePolicyManager.reboot() method. +

+ +

Disable Data Roaming

+ +

+ Device owners can disable data roaming using the new {@link + android.os.UserManager} user restriction DISALLOW_DATA_ROAMING. +

+ +

Enterprise Process Logging

+ +

+ Device owners can identify suspicious activity by remotely tracking device + activity, including app launches, adb activity, and screen unlocks. Process + logs don’t require user consent. To retrieve logs, device owners enable + device logging using setDeviceLoggingEnabled(). +

+ +

+ The new android.auditing.SecurityLog class includes these + methods: +

+ + + +

Remote Bug Reports

+ +

+ Device owners can remotely trigger and retrieve a bug report that contains a + device state dump file, which allows forensic investigation of a known + incident or compromised device. Due to the detailed nature of the bug report, + user consent is required. +

+ +

+ The Preview includes the following API additions to support this feature. For + details, see the N Preview SDK + Reference. +

+ + + +

Remove a Client Certificate

+ +

+ Profile owners and device owners can now remove client certificates that were + installed through {@link android.app.admin.DevicePolicyManager#installKeyPair + installKeyPair()} by calling the new method + DevicePolicyManager.removeKeyPair(). +

+ +

Grant Access to Client Certificate on + Installation

+ +

+ If a profile owner or device owner grants a third-party app the ability to + manage certificates, the app can grant itself access to certificates it + installs without any intervention by the owner. +

+ +

+ The existing API for managing certificates is extended to include: +

+ + + +

System UI Policy Transparency

+ +

+ Policies that affect the user experience or restrict user Settings are fully + disclosed to the user, and profile owners and device owners can attribute the + policy to their company’s IT department. In addition to a consistent “Action + not allowed” message in Settings, IT administrators can set an + organization-specific support message in device settings with the following + new {@link android.app.admin.DevicePolicyManager} methods: +

+ + + +

App Restrictions Management Enhancements

+ +

+ The device or profile owner can enable another application to manage app + restrictions via the new + DevicePolicyManager.setApplicationRestrictionsManagingPackage() + method. The nominated application can check whether this permission has been + granted by calling + DevicePolicyManager.isCallerApplicationRestrictionsManagingPackage(). +

+ +

+ An application nominated to manage app restrictions can call {@link + android.app.admin.DevicePolicyManager#setApplicationRestrictions + setApplicationRestrictions()} and {@link + android.app.admin.DevicePolicyManager#getApplicationRestrictions + getApplicationRestrictions()} for any packages within that user or profile. +

+ +

Location Off Switch

+ +

+ Users can disable location permissions for work apps while continuing to + access location information in their personal apps. A separate location + access switch in Location Settings allows users to deny location updates or + last-location queries for apps running in the work profile. +

+ +

+ The top level location off switch disables location access for both the + primary profile and the managed profile. +

+ +

Customized Provisioning

+ +

+ An application can customize the profile owner and device owner provisioning + flows with corporate colors and logos. +

+ +
+
+ DevicePolicyManager.EXTRA_PROVISIONING_MAIN_COLOR +
+ +
+ Customizes flow color. +
+ +
+ DevicePolicyManager.EXTRA_PROVISIONING_LOGO_URI +
+ +
+ Customizes the flow with a corporate logo. +
+
+ +

Multiple Wi-Fi CA Certificates

+ +

+ Profile owners and device owners can set multiple CA certificates for a given + Wi-Fi configuration. When corporate Wi-Fi networks have separate CAs for + separate access points with the same SSID, IT administrators can include all + relevant CAs in the Wi-Fi configuration using the new method + setCaCertificates(). +

+ +

+ APIs added are: +

+ + + +

Customized Lockscreen Message

+ +

+ Device owners can provide owner information to be shownon the lockscreen. + This information takes precedence the user lock screen message (if one is + set). New {@link android.app.admin.DevicePolicyManager} methods are: +

+ + + +

Work Profile ConnectionService

+ +

+ Profile owners can specify a work dialer application that uses a + work-specific {@link android.telecom.ConnectionService} for the calling + backend (calling accounts). The work dialer maintains a work-only call log + and relies on work contacts only. Users have a consistent in-call UI + experience regardless of dialing application. Incoming work calls to the work + calling accounts are distinguished from personal incoming calls to the + personal calling accounts. +

+ +

+ The dialer should check for the new flag + android.telecom.Call.PROPERTY_WORK_CALL to determine if a call + is a work call. If a call is a work call, the dialer should indicate this, + such as by adding a work badge. +

+ +

Lock Down Wallpaper

+ +

+ A new user restriction (DISALLOW_SET_WALLPAPER) prevents the + user from changing their wallpaper. The device owner or profile owner can + still change the wallpaper, but they can only change the wallpaper for the + user or profile they control. For example, a profile owner can’t change the + wallpaper of the parent user, but a profile owner in the primary profile or + device owner can. A profile owner or device owner that wants to change the + wallpaper should check whether the the user or profile they manage has a + wallpaper ({@link android.app.WallpaperManager#isWallpaperSupported + isWallpaperSupported()}) and whether they are allowed to change it (with the + new method WallpaperManager.isWallpaperSettingAllowed()) +

+ +

Lock Down User Icon

+ +

+ A new user restriction (DISALLOW_SET_USER_ICON) prevents the + user from changing their user icon. The user’s device owner or profile owner + can still change the icon. However, a profile owner can only change the user + icon for the profile it controls. +

+ +

Device Health Monitoring

+ +

+ A device owner or profile owner can use the new + HardwarePropertiesManager interface to retrieve information + about device health, such as CPU or GPU temperatures and CPU usage. The new + monitoring interface is especially useful for monitoring unattended devices + running in a remote location. +

diff --git a/docs/html/preview/preview_toc.cs b/docs/html/preview/preview_toc.cs index 406774fbec849..1f06f933ac72a 100644 --- a/docs/html/preview/preview_toc.cs +++ b/docs/html/preview/preview_toc.cs @@ -50,7 +50,8 @@ >Notifications
  • Language and Locale
    • - +
  • Android for Work