IntuneDeviceConfigurationPolicyAndroidDeviceAdministrator

Parameters

Parameter Attribute DataType Description Allowed Values
Id Write String Id of the Intune policy.
DisplayName Key String Display name of the Intune policy.
Description Write String Description of the Intune policy.
AppsBlockClipboardSharing Write Boolean Block clipboard sharing between apps (Samsung KNOX Standard 4.0+).
AppsBlockCopyPaste Write Boolean Block copy and paste functionality.
AppsBlockYouTube Write Boolean Block YouTube (Samsung KNOX Standard 4.0+).
AppsHideList Write MSFT_MicrosoftGraphapplistitem[] Specify the apps that will be hidden on the device. Users cannot discover or run these apps.
AppsInstallAllowList Write MSFT_MicrosoftGraphapplistitem[] Specify the apps that users can install. Users will not be able to install apps that are not on the list.
AppsLaunchBlockList Write MSFT_MicrosoftGraphapplistitem[] Specify the apps that users cannot run on their device.
BluetoothBlocked Write Boolean Block Bluetooth (Samsung KNOX Standard 4.0+).
CameraBlocked Write Boolean Block use of camera
CellularBlockDataRoaming Write Boolean Block data roaming over the cellular network (Samsung KNOX Standard 4.0+).
CellularBlockMessaging Write Boolean Block SMS/MMS messaging functionality (Samsung KNOX Standard 4.0+).
CellularBlockVoiceRoaming Write Boolean Block voice roaming over the cellular network (Samsung KNOX Standard 4.0+).
CellularBlockWiFiTethering Write Boolean Block Wi-Fi tethering (Samsung KNOX Standard 4.0+).
CompliantAppListType Write String Device compliance can be viewed in the Restricted Apps Compliance report. none, appsInListCompliant, appsNotInListCompliant
CompliantAppsList Write MSFT_MicrosoftGraphapplistitem[] Enter the Google Play Store URL of the app you want. For example, to specify the Microsoft Remote Desktop app for Android, enter https://play.google.com/store/apps/details?id=com.microsoft.rdc.android. To find the URL of an app, use a search engine to locate the store page. For example, to find the Remote Desktop app, you could search Microsoft Remote Desktop Play Store.
DateAndTimeBlockChanges Write Boolean Block user from changing date and time on device (Samsung KNOX).
DeviceSharingAllowed Write Boolean Allow multiple users to log into the Company Portal using their AAD credentials (Samsung KNOX Standard 4.0+).
DiagnosticDataBlockSubmission Write Boolean Block submitting diagnostic data from device.
FactoryResetBlocked Write Boolean Block factory reset on device.
GoogleAccountBlockAutoSync Write Boolean Block Google account auto sync functionality on device.
GooglePlayStoreBlocked Write Boolean Block Google Play store (Samsung KNOX Standard 4.0+).
KioskModeApps Write MSFT_MicrosoftGraphapplistitem[] Kiosk mode apps
KioskModeBlockSleepButton Write Boolean Kiosk mode block sleep button
KioskModeBlockVolumeButtons Write Boolean Kiosk mode block volume buttons
LocationServicesBlocked Write Boolean Location services blocked
NfcBlocked Write Boolean Block Near Field Communication (NFC) technology (Samsung KNOX Standard 4.0+).
PasswordBlockFingerprintUnlock Write Boolean Block using fingerprint to unlock device.
PasswordBlockTrustAgents Write Boolean Block Smart Lock or other trust agents from adjusting lock screen settings (Samsung KNOX Standard 5.0+).
PasswordExpirationDays Write UInt32 Number of days until device password must be changed. (1-365)
PasswordMinimumLength Write UInt32 Minimum number of digits or characters in password. (4-16)
PasswordMinutesOfInactivityBeforeScreenTimeout Write UInt32 Maximum minutes of inactivity until screen locks. Ignored by device if new time is longer than what's currently set on device. If set to Immediately, devices will use the minimum possible value per device.
PasswordPreviousPasswordBlockCount Write UInt32 Number of new passwords that must be used until an old one can be reused.
PasswordRequired Write Boolean Require password to access device.
PasswordRequiredType Write String Specify the type of password required. deviceDefault, alphabetic, alphanumeric, alphanumericWithSymbols, lowSecurityBiometric, numeric, numericComplex, any
PasswordSignInFailureCountBeforeFactoryReset Write UInt32 Number of consecutive times an incorrect password can be entered before device is wiped of all data.
PowerOffBlocked Write Boolean Block user from powering off device. If this setting is disabled the setting 'Number of sign-in failures before wiping device' does not function.
RequiredPasswordComplexity Write String Define the password complexity. none, low, medium, high
ScreenCaptureBlocked Write Boolean Block capturing contents of screen as an image.
SecurityRequireVerifyApps Write Boolean Security require verify apps
StorageBlockGoogleBackup Write Boolean Block sync with Google backup.
StorageBlockRemovableStorage Write Boolean Block removable storage usage (Samsung KNOX Standard 4.0+).
StorageRequireDeviceEncryption Write Boolean Require encryption on device. Not all devices support encryption.
StorageRequireRemovableStorageEncryption Write Boolean Storage cards must be encrypted. Not all devices support storage card encryption. For more information, see the device and mobile operating system documentation.
VoiceAssistantBlocked Write Boolean Block voice assistant (Samsung KNOX Standard 4.0+).
VoiceDialingBlocked Write Boolean Block voice dialing (Samsung KNOX Standard 4.0+).
WebBrowserBlockAutofill Write Boolean Block autofill.
WebBrowserBlocked Write Boolean Block web browser on device.
WebBrowserBlockJavaScript Write Boolean Block JavaScript in the browser.
WebBrowserBlockPopups Write Boolean Block pop-ups in web browser.
WebBrowserCookieSettings Write String Allow or block browser cookies browserDefault, blockAlways, allowCurrentWebSite, allowFromWebsitesVisited, allowAlways
WiFiBlocked Write Boolean Block Wi-Fi (Samsung KNOX Standard 4.0+).
Assignments Write MSFT_DeviceManagementConfigurationPolicyAssignments[] Represents the assignment to the Intune policy.
Ensure Write String Present ensures the policy exists, absent ensures it is removed. Present, Absent
Credential Write PSCredential Credentials of the Intune Admin
ApplicationId Write String Id of the Azure Active Directory application to authenticate with.
TenantId Write String Id of the Azure Active Directory tenant used for authentication.
ApplicationSecret Write PSCredential Secret of the Azure Active Directory tenant used for authentication.
CertificateThumbprint Write String Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
ManagedIdentity Write Boolean Managed ID being used for authentication.
AccessTokens Write StringArray[] Access token used for authentication.

MSFT_DeviceManagementConfigurationPolicyAssignments

Parameters

Parameter Attribute DataType Description Allowed Values
dataType Write String The type of the target assignment. #microsoft.graph.groupAssignmentTarget, #microsoft.graph.allLicensedUsersAssignmentTarget, #microsoft.graph.allDevicesAssignmentTarget, #microsoft.graph.exclusionGroupAssignmentTarget, #microsoft.graph.configurationManagerCollectionAssignmentTarget
deviceAndAppManagementAssignmentFilterType Write String The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude. none, include, exclude
deviceAndAppManagementAssignmentFilterId Write String The Id of the filter for the target assignment.
groupId Write String The group Id that is the target of the assignment.
groupDisplayName Write String The group Display Name that is the target of the assignment.
collectionId Write String The collection Id that is the target of the assignment.(ConfigMgr)

MSFT_MicrosoftGraphapplistitem

Parameters

Parameter Attribute DataType Description Allowed Values
odataType Write String odatatype of the item. #microsoft.graph.appleAppListItem
appId Write String Kiosk mode managed app id
appStoreUrl Write String Define the app store URL.
name Write String Define the name of the app.
publisher Write String Define the publisher of the app.

Description

This resource configures the settings of Android Device Administrator device restriction policy in your cloud-based organization.

Permissions

Microsoft Graph

To authenticate with the Microsoft Graph API, this resource required the following permissions:

Delegated permissions

  • Read

    • DeviceManagementConfiguration.Read.All
  • Update

    • DeviceManagementConfiguration.ReadWrite.All

Application permissions

  • Read

    • DeviceManagementConfiguration.Read.All
  • Update

    • DeviceManagementConfiguration.ReadWrite.All

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param(
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )
    Import-DscResource -ModuleName Microsoft365DSC

    node localhost
    {
        IntuneDeviceConfigurationPolicyAndroidDeviceAdministrator 'myAndroidDeviceAdmin'
        {
            DisplayName                              = 'Android device admin'
            AppsBlockClipboardSharing                = $True
            AppsBlockCopyPaste                       = $True
            AppsBlockYouTube                         = $False
            Assignments                              = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments {
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    dataType                                   = '#microsoft.graph.allDevicesAssignmentTarget'
                }
            )
            BluetoothBlocked                         = $True
            CameraBlocked                            = $True
            CellularBlockDataRoaming                 = $False
            CellularBlockMessaging                   = $False
            CellularBlockVoiceRoaming                = $False
            CellularBlockWiFiTethering               = $False
            CompliantAppListType                     = 'appsInListCompliant'
            CompliantAppsList                        = @(
                MSFT_MicrosoftGraphAppListitem {
                    name        = 'customApp'
                    publisher   = 'google2'
                    appStoreUrl = 'https://appUrl.com'
                    appId       = 'com.custom.google.com'
                }
            )
            DateAndTimeBlockChanges                  = $True
            DeviceSharingAllowed                     = $False
            DiagnosticDataBlockSubmission            = $False
            FactoryResetBlocked                      = $False
            GoogleAccountBlockAutoSync               = $False
            GooglePlayStoreBlocked                   = $False
            KioskModeBlockSleepButton                = $False
            KioskModeBlockVolumeButtons              = $True
            LocationServicesBlocked                  = $False
            NfcBlocked                               = $False
            PasswordBlockFingerprintUnlock           = $False
            PasswordBlockTrustAgents                 = $False
            PasswordRequired                         = $True
            PasswordRequiredType                     = 'numeric'
            PowerOffBlocked                          = $False
            RequiredPasswordComplexity               = 'low'
            ScreenCaptureBlocked                     = $False
            SecurityRequireVerifyApps                = $False
            StorageBlockGoogleBackup                 = $False
            StorageBlockRemovableStorage             = $False
            StorageRequireDeviceEncryption           = $False
            StorageRequireRemovableStorageEncryption = $True
            VoiceAssistantBlocked                    = $False
            VoiceDialingBlocked                      = $False
            WebBrowserBlockAutofill                  = $False
            WebBrowserBlocked                        = $False
            WebBrowserBlockJavaScript                = $False
            WebBrowserBlockPopups                    = $False
            WebBrowserCookieSettings                 = 'allowAlways'
            WiFiBlocked                              = $False
            Ensure                                   = 'Present'
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}

Example 2

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param(
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )
    Import-DscResource -ModuleName Microsoft365DSC

    node localhost
    {
        IntuneDeviceConfigurationPolicyAndroidDeviceAdministrator 'myAndroidDeviceAdmin'
        {
            DisplayName                              = 'Android device admin'
            AppsBlockClipboardSharing                = $True
            AppsBlockCopyPaste                       = $False # Updated Property
            AppsBlockYouTube                         = $False
            Assignments                              = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments {
                    deviceAndAppManagementAssignmentFilterType = 'none'
                    dataType                                   = '#microsoft.graph.allDevicesAssignmentTarget'
                }
            )
            BluetoothBlocked                         = $True
            CameraBlocked                            = $True
            CellularBlockDataRoaming                 = $False
            CellularBlockMessaging                   = $False
            CellularBlockVoiceRoaming                = $False
            CellularBlockWiFiTethering               = $False
            CompliantAppListType                     = 'appsInListCompliant'
            CompliantAppsList                        = @(
                MSFT_MicrosoftGraphAppListitem {
                    name        = 'customApp'
                    publisher   = 'google2'
                    appStoreUrl = 'https://appUrl.com'
                    appId       = 'com.custom.google.com'
                }
            )
            DateAndTimeBlockChanges                  = $True
            DeviceSharingAllowed                     = $False
            DiagnosticDataBlockSubmission            = $False
            FactoryResetBlocked                      = $False
            GoogleAccountBlockAutoSync               = $False
            GooglePlayStoreBlocked                   = $False
            KioskModeBlockSleepButton                = $False
            KioskModeBlockVolumeButtons              = $True
            LocationServicesBlocked                  = $False
            NfcBlocked                               = $False
            PasswordBlockFingerprintUnlock           = $False
            PasswordBlockTrustAgents                 = $False
            PasswordRequired                         = $True
            PasswordRequiredType                     = 'numeric'
            PowerOffBlocked                          = $False
            RequiredPasswordComplexity               = 'low'
            ScreenCaptureBlocked                     = $False
            SecurityRequireVerifyApps                = $False
            StorageBlockGoogleBackup                 = $False
            StorageBlockRemovableStorage             = $False
            StorageRequireDeviceEncryption           = $False
            StorageRequireRemovableStorageEncryption = $True
            VoiceAssistantBlocked                    = $False
            VoiceDialingBlocked                      = $False
            WebBrowserBlockAutofill                  = $False
            WebBrowserBlocked                        = $False
            WebBrowserBlockJavaScript                = $False
            WebBrowserBlockPopups                    = $False
            WebBrowserCookieSettings                 = 'allowAlways'
            WiFiBlocked                              = $False
            Ensure                                   = 'Present'
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}

Example 3

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param(
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )
    Import-DscResource -ModuleName Microsoft365DSC

    node localhost
    {
        IntuneDeviceConfigurationPolicyAndroidDeviceAdministrator 'myAndroidDeviceAdmin'
        {
            DisplayName                              = 'Android device admin'
            Ensure                                   = 'Absent'
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}