Summary of changes needed to make your Android app compatible w/ Android for Work (Google's Mobile Device Management APIs). Given at a recent Raizlabs Lightning Talk.

1. KenYee
Android ForWork

2. Overview
• What is Android forWork?
• App Changes to Support Android forWork
• Testing Apps for Android forWork

3. TL;DR forAndroid forWork
• Encrypted Devices w/ Security Updates Commitment
• IT Mobile Device Configuration Management via EMM
• Work-Only App/Data Sandbox via SELinux
• Private App Store
• COSU aka Kiosk Mode

4. Device Policy Configurables
• Remote Lock/Wipe
• PIN Complexity/Rotation
• VPN/Wireless Setup
• Apps Allowed in Sandbox
• Lock Out USB/SD/Widgets/Root/GPS/Clipboard/Share
• https://support.google.com/a/answer/1408902

5. USER
EXPERIENCE

6. Modifying Apps for
Android forWork

7. Sandbox’isms
• IT can preventIntents crossing or lock out System Apps
always callIntent.resolveActivity()
• Separate storage area so URIs aren’t the same
use Content URI from FileProvider instead of File URI

8. Configurable Restrictions
• Runtime parameters that show up inIT/EMM Admin UI for
your App
• Defined via Manifest to point to an XML file:
<application ... >
<meta-data android:name="android.content.APP_RESTRICTIONS"
android:resource="@xml/app_restrictions" />
...
</application>

9. <?xml version="1.0" encoding="utf-8"?>
<restrictions xmlns:android="http://schemas.android.com/apk/res/android" >
<restriction
android:key="downloadOnCellular"
android:title="App is allowed to download data via cellular"
android:restrictionType="bool"
android:description="If 'false', app can only download data via Wi-Fi"
android:defaultValue="true" />
</restrictions>
Restrictions XML File

10. RestrictionsManager restrictionsMgr =
(RestrictionsManager) getActivity()
.getSystemService(Context.RESTRICTIONS_SERVICE);
Bundle appRestrictions = restrictionsMgr.getApplicationRestrictions();
Check Restrictions
if ((appRestrictions.containsKey(UserManager.KEY_RESTRICTIONS_PENDING)
&& appRestrictions.getBoolean(UserManager.KEY_RESTRICTIONS_PENDING)) {
Toast.makeText(getActivity(), “Not Configured”, LENGTH_LONG).show();
getActivity().finish();
}
boolean appCanUseCellular;
if (appRestrictions.containsKey(“downloadOnCellular") {
appCanUseCellular = appRestrictions.getBoolean("downloadOnCellular");
} else {
// here, cellularDefault is a boolean set with the restriction's
// default value
appCanUseCellular = cellularDefault;
}

11. IntentFilter restrictionsFilter =
new IntentFilter(Intent.ACTION_APPLICATION_RESTRICTIONS_CHANGED);
Listen forRestriction Changes
BroadcastReceiver restrictionsReceiver = new BroadcastReceiver() {
@Override public void onReceive(Context context, Intent intent) {
// Get the current restrictions bundle
Bundle appRestrictions =
restrictionsMgr.getApplicationRestrictions();
// Check current restrictions settings, change your app's UI and
// functionality as necessary.
}
};
registerReceiver(restrictionsReceiver, restrictionsFilter);

12. COSU/Kiosk Mode

13. Android 5.xvs. 6.x+
• Home/Overview buttons
visible but disabled
• User can exit app by
hitting Home/Overview
simultaneously
• Lockscreen happens
• Home/Overview buttons
hidden on Android 6.x
• Exit by app calling
stopLockTask
• Lockscreen never kicks in
• Can’t be modified in Safe
Mode

14. <activity
android:name=".KioskModeActivity"
android:label="@string/kiosk_mode"
android:launchMode="singleInstance"
android:lockTaskMode="if_whitelisted"
android:enabled="false">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.HOME"/>
<category android:name="android.intent.category.DEFAULT"/>
</intent-filter>
</activity>
Enabling Kiosk in Android 6.0

15. Testing yourApp

16. Resources
• “BasicManagedProfile” forIntent testing in aWork sandbox
• “Test DPC” app for Restrictions sandbox testing
• “NFCProvisioning” app for kiosk mode testing
• Contact EMM Provider for Testing Console for end to end
testing

17. Decision Oriented Messaging
ThankYou.
ken.yee@raizlabs.com
github: kenkyee