Managing app permissions

Expand all | Collapse all

The App permission management section lets you configure rules for granting runtime permissions to apps installed on devices managed via the Kaspersky Endpoint Security for Android app in device owner mode or to apps installed in an Android work profile.

You can configure rules for granting runtime permissions by creating or editing configuration files for specific apps.

Permission granting rules configured for specific apps have precedence over the general policy for granting permissions to apps installed on devices or in the Android work profile. For example, if you first select the Deny permissions automatically option in an Android work profile section, and then select the Grant permissions automatically option for a specific app in the App permission management section, the permission for this app will be granted automatically.

To add app permissions:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the App permission management section.
5. Click the Add button.

   The Add permission granting rules window opens.

6. Select how to add a configuration with permission granting rules:
   • Manually

     When adding a configuration manually, you need to click the Add permission button to select a permission and an action to be performed for it from the drop-down lists.

   • Using an installation package from Kaspersky Security Center

     When adding a configuration using an installation package added to Kaspersky Security Center, you need to select the app from the list of mobile app packages.

     After that, you can view a list of runtime permissions and select the action to be performed for each permission.

   • Using an APK file from your computer

     When adding an app configuration using an APK file from your computer, you need to select a file saved on your computer.

     After that, you can view a list of runtime permissions and select an action to be performed for each permission.

7. Specify the following parameters:
   • App name (cannot be left blank)

     Name of the app for which permissions are to be configured.

     When importing a configuration from an APK file or an installation package, the value is inserted automatically.

   • Package name (cannot be left blank)

     Name of the package for which permissions are to be configured.

     How to get the package name of an app

     To get the package name of an app:

     1. Open Google Play.
     2. Find the required app and open its page.

     The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).

     To get the package name of an app that has been added to Kaspersky Security Center:

     1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
     2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

     In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

     If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

     When importing a configuration from an APK file or an installation package, the value is inserted automatically.

   • Comment

     An optional comment.

8. Click the Add permission button to open the block of the app permission configuration. You can add several permissions.

   Select one of the following permissions.

   • Permission for call handover
   • Location permissions
   • Permission to use saved geographic locations
   • Permission for activity recognition
   • Permission for answerphone voice mails
   • Permission to answer phone calls
   • Permissions for Bluetooth
   • Permissions to access body sensors data
   • Permission for phone calls
   • Permissions for camera
   • Permission to access account list
   • Permissions to access nearby devices via Wi-Fi
   • Permission to send notifications
   • Permission to manage outgoing calls
   • Permission to read calendar data
   • Permission to read call log
   • Permission to read contact list
   • Permissions to read external storage
   • Permission to read device's phone numbers
   • Permission to read phone state
   • Permissions to monitor SMS and MMS incoming messages
   • Permission to receive WAP push messages
   • Permission to record audio
   • Permission to send SMS
   • Permission to use SIP telephony
   • Permission to access devices that use UWB
   • Permission to write data to calendar
   • Permission to write and read data of call log
   • Permission to write contacts
   • Permission to write data to external storage

   To configure granting rules for app runtime permissions, you need to select one of the following actions for each permission:

   • Prompt the user for permissions

     When a permission is requested, the user decides whether to grant the specified permission to the app.

     This option is selected by default.

   • Grant permissions automatically

     An app is granted a permission without user interaction.

   • Deny permissions automatically

     An app is denied a permission without user interaction.

   You can save only one granting rule for each app permission.

9. Click OK to apply the configuration.

   The configuration appears in the List of app permissions.

10. Click the Apply button to save your changes.

The configuration with permission granting rules is applied. Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

To edit app permissions:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the App permission management section.
5. Select the app in the List of app permissions block, and then click the Edit button.

   The Edit permission granting rules window opens.

6. Edit the selected permission granting rule as follows:
   • To add a new permission to the configuration, click the Add permission button below all the settings, and then select a permission and an action to be performed for this permission.

     You can add several permissions.

   • To edit an action for an existing permission, select another action in the list.
   • To delete a permission that was added manually, click the X button in the upper right corner of the permission's field.
7. Click OK to close the Edit permission granting rules window.
8. Click the Apply button to save your changes.

The edited configuration with permission granting rules is applied. Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

To delete app permissions:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the App permission management section.
5. Select the app from the List of app permissions block, and then click the Delete button.
6. Click the Apply button to save your changes.

The configured permissions for the selected app are deleted. Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.