Apply universal settings for mobile devices & endpoints

Supported editions for this feature: Frontline Starter, Frontline Standard, and Frontline Plus; Business Plus; Enterprise Standard and Enterprise Plus; Education Standard, Education Plus, and Endpoint Education Upgrade; Enterprise Essentials and Enterprise Essentials Plus; G Suite Basic and G Suite Business; Cloud Identity Premium. Compare your edition

As an administrator, you can set the type of mobile management and password requirements for mobile devices in your organization. You can also enforce security policies, such as data access methods, encryption, device approval, and strong passwords.

Turn universal settings on or off

Before you begin: If you need to set up a department or team for this setting, go to Add an organizational unit.

  1. In the Google Admin console, go to Menu and then Devices and then Mobile & endpoints and then Settings and then Universal.

    Requires having the Mobile Device Management administrator privilege.

  2. Click a settings category and then a setting (for example, Security and then Device approvals). Learn about the settings later on this page.
  3. (Optional) To apply the setting to a department or team, at the side, select an organizational unit.
  4. Check or uncheck the appropriate box to turn the setting on or off. Some settings have more than one option that you can turn on or off.
  5. Click Save. Or, you might click Override for an organizational unit.

    To later restore the inherited value, click Inherit.

Changes can take up to 24 hours but typically happen more quickly. Learn more

Universal settings index

General

These settings let you specify device management preferences and password requirements for mobile devices.

Mobile management

Set the mobile management type for devices in your organization. You can set different management types for specific device platforms and for specific organizational units.

Basic mobile management is on by default.

Password requirements

Supported for mobile devices only

Require passwords on managed mobile devices.

For details, see Set password requirements for managed mobile devices.

Data Access

These settings let you specify preferences for Chrome signals sharing, endpoint verification, turning on Google Assistant, and syncing users' work or school data on mobile devices.

Chrome signals sharing

Gathers device signals from Chrome browser, either directly from the browser, through the Endpoint Verification extension, or both. When the Collect device signals from Chrome browser box is checked, you can get device information like OS details, encryption status, and screen lock status.

When Chrome signals sharing is on, Chrome profile sync reports device security signals, which are listed as Fundamental devices in the Admin console. For details, go to Turn Chrome signals sharing on or off.

Endpoint verification

When the Collect Device signals using endpoint verification box is checked, you can get details about those devices, such as the operating system and user. Endpoint verification is also required to use Context-Aware Access rules.

If you turn off endpoint verification but have Context-Aware Access rules, users might not be able to access their managed account on their device.

Learn more about endpoint verification

Android Sync

Allows users' work or school data to sync to managed Android devices.

To block access to work or school data on Android devices, uncheck the Allow work data to sync on Android devices box. Users won't be able to use their work or school data in Google apps such as Gmail, Calendar, or Drive. Users can still access their work or school data through web apps in a browser on their device.

iOS Sync

Allows users' work or school data to sync to managed iPhones and iPads.

To block access to work or school data on iPhones and iPads, uncheck the Allow work data to sync on iOS devices box. Users won't be able to use their work or school data in Google apps such as Gmail, Calendar, or Drive. Users can still access their work or school data in the following ways:

  • Through web apps in a browser on their device
  • If you enable IMAP, through third-party apps such as built-in Apple iOS apps or Microsoft Outlook

Google Assistant

Supported for iPhones, iPads, and Android 4.1 Jelly Bean and later devices.

Allows users to use Discover with their managed account on their device. Learn more about Discover.

Note: Admins for Google Workspace for Education organizations must get parental consent for users under the age of 18 to enable Voice Match and Face Match. For more details, go to Manage Face Match and Voice Match.

Security

These settings let you specify preferences for device approvals and device security measures. To apply these settings to mobile devices, go to Set up advanced mobile management.

Device approvals

Supported for mobile devices under advanced mobile management and endpoints under endpoint verification

Require an admin to approve a device before a user can access their work or school data.

For details, see Require admin approval for device access.

Camera

Supported for iPhones and iPads, Android 4.0 Ice Cream Sandwich and later devices, and Microsoft Windows Phone

Allows users to use the camera on their device.

To block all camera use, uncheck the Allow camera box. However, for Android devices with work profiles, users can still use the camera with personal apps.

Encryption

Supported for Android 3.0 Honeycomb and later devices using Android Sync, and iOS devices using iOS Sync. For other devices and third-party apps, contact the device manufacturer or app developer.

Requires data encryption on devices so that the data can only be read when a device is unlocked. Encryption adds protection if a device is lost or stolen. Unlocking the device decrypts the data.

Inactive company owned devices (Android only)

Supported for company-owned Android devices

When checked, sends a monthly report of company-owned Android devices that haven't synchronized any work data in the last 30 days. Reports are automatically sent to all super administrators in your organization. To send reports to others, enter their emails in the text box.

For details, see Get a report of inactive company owned devices.

Compromised devices

Supported for Android devices and iPhones and iPads that sync data with iOS Sync

Blocks an Android or iOS device from syncing work or school data when there are indications that the device is compromised or jailbroken.

  • Check the Block compromised Android devices box to block an Android device if there are indications that it might be compromised. For example, a device is compromised if it's rooted—a process that removes restrictions on the device.
  • Check the Block jailbroken iOS devices box to block an iOS device if there are indications that it's jailbroken—a process that removes restrictions on the device. When you check this box, iOS users are prompted to install the Google Device Policy app if it's not already installed on the device.


Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.