diff --git a/api/current.txt b/api/current.txt
index 163e9d0d29052..09bb39e09ff04 100644
--- a/api/current.txt
+++ b/api/current.txt
@@ -5543,6 +5543,7 @@ package android.app.admin {
     method public int setStorageEncryption(android.content.ComponentName, boolean);
     method public void setUninstallBlocked(android.content.ComponentName, java.lang.String, boolean);
     method public boolean setUserEnabled(android.content.ComponentName);
+    method public void setUserIcon(android.content.ComponentName, android.graphics.Bitmap);
     method public boolean switchUser(android.content.ComponentName, android.os.UserHandle);
     method public void uninstallAllUserCaCerts(android.content.ComponentName);
     method public void uninstallCaCert(android.content.ComponentName, byte[]);
diff --git a/api/system-current.txt b/api/system-current.txt
index 8a9259ff1f49a..15cd47fc9c3f7 100644
--- a/api/system-current.txt
+++ b/api/system-current.txt
@@ -5645,6 +5645,7 @@ package android.app.admin {
     method public int setStorageEncryption(android.content.ComponentName, boolean);
     method public void setUninstallBlocked(android.content.ComponentName, java.lang.String, boolean);
     method public boolean setUserEnabled(android.content.ComponentName);
+    method public void setUserIcon(android.content.ComponentName, android.graphics.Bitmap);
     method public boolean switchUser(android.content.ComponentName, android.os.UserHandle);
     method public void uninstallAllUserCaCerts(android.content.ComponentName);
     method public void uninstallCaCert(android.content.ComponentName, byte[]);
@@ -30906,8 +30907,8 @@ package android.telecom {
     method public void unregisterPhoneAccount(android.telecom.PhoneAccountHandle);
     field public static final java.lang.String ACTION_CHANGE_PHONE_ACCOUNTS = "android.telecom.action.CHANGE_PHONE_ACCOUNTS";
     field public static final java.lang.String ACTION_CONNECTION_SERVICE_CONFIGURE = "android.telecom.action.CONNECTION_SERVICE_CONFIGURE";
-    field public static final java.lang.String ACTION_SHOW_CALL_ACCESSIBILITY_SETTINGS = "android.telecom.action.SHOW_CALL_ACCESSIBILITY_SETTINGS";
     field public static final java.lang.String ACTION_PHONE_ACCOUNT_REGISTERED = "android.telecom.action.PHONE_ACCOUNT_REGISTERED";
+    field public static final java.lang.String ACTION_SHOW_CALL_ACCESSIBILITY_SETTINGS = "android.telecom.action.SHOW_CALL_ACCESSIBILITY_SETTINGS";
     field public static final java.lang.String ACTION_SHOW_CALL_SETTINGS = "android.telecom.action.SHOW_CALL_SETTINGS";
     field public static final java.lang.String ACTION_SHOW_RESPOND_VIA_SMS_SETTINGS = "android.telecom.action.SHOW_RESPOND_VIA_SMS_SETTINGS";
     field public static final char DTMF_CHARACTER_PAUSE = 44; // 0x002c ','
diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java
index cee8e8d2654ac..a820a3968da2d 100644
--- a/core/java/android/app/admin/DevicePolicyManager.java
+++ b/core/java/android/app/admin/DevicePolicyManager.java
@@ -28,6 +28,7 @@ import android.content.IntentFilter;
 import android.content.pm.ActivityInfo;
 import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
+import android.graphics.Bitmap;
 import android.net.ProxyInfo;
 import android.os.Bundle;
 import android.os.Handler;
@@ -3740,4 +3741,18 @@ public class DevicePolicyManager {
         }
         return Collections.emptyList();
     }
+
+    /**
+     * Called by profile or device owners to set the current user's photo.
+     *
+     * @param admin Which {@link DeviceAdminReceiver} this request is associated with.
+     * @param icon the bitmap to set as the photo.
+     */
+    public void setUserIcon(ComponentName admin, Bitmap icon) {
+        try {
+            mService.setUserIcon(admin, icon);
+        } catch (RemoteException re) {
+            Log.w(TAG, "Could not set the user icon ", re);
+        }
+    }
 }
diff --git a/core/java/android/app/admin/IDevicePolicyManager.aidl b/core/java/android/app/admin/IDevicePolicyManager.aidl
index 5e58fe00c7c3d..310436ee4c368 100644
--- a/core/java/android/app/admin/IDevicePolicyManager.aidl
+++ b/core/java/android/app/admin/IDevicePolicyManager.aidl
@@ -20,6 +20,7 @@ package android.app.admin;
 import android.content.ComponentName;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.graphics.Bitmap;
 import android.net.ProxyInfo;
 import android.os.Bundle;
 import android.os.PersistableBundle;
@@ -205,4 +206,6 @@ interface IDevicePolicyManager {
     void clearDeviceInitializer(String packageName);
     boolean setDeviceInitializer(in ComponentName who, in ComponentName initializer, String initializerName);
     String getDeviceInitializer();
+
+    void setUserIcon(in ComponentName admin, in Bitmap icon);
 }
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 6270212a7ecb2..f53e6b74a9eea 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -51,6 +51,7 @@ import android.content.pm.ResolveInfo;
 import android.content.pm.ServiceInfo;
 import android.content.pm.UserInfo;
 import android.database.ContentObserver;
+import android.graphics.Bitmap;
 import android.hardware.usb.UsbManager;
 import android.media.AudioManager;
 import android.media.IAudioService;
@@ -5497,6 +5498,22 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         }
     }
 
+    @Override
+    public void setUserIcon(ComponentName who, Bitmap icon) {
+        synchronized (this) {
+            Preconditions.checkNotNull(who, "ComponentName is null");
+            getActiveAdminForCallerLocked(who, DeviceAdminInfo.USES_POLICY_PROFILE_OWNER);
+
+            int userId = UserHandle.getCallingUserId();
+            long id = Binder.clearCallingIdentity();
+            try {
+                mUserManager.setUserIcon(userId, icon);
+            } finally {
+                restoreCallingIdentity(id);
+            }
+        }
+    }
+
     /**
      * We need to update the internal state of whether a user has completed setup once. After
      * that, we ignore any changes that reset the Settings.Secure.USER_SETUP_COMPLETE changes