Application Restrictions/Configuration

ENTERPRISE / 12.04.15 / Brent Thornton


Quite often I am asked for a way to avoid hardcoding app settings or having a user enter settings manually.  In BBOS we had custom IT policies, in BB10 we had to use a work around to set configs using a special URL. When BES started managing iOS and Android we had to get really creative on how we accomplished this task, until now in BES 12.3+…

Let’s set the stage with the client application because without it you will never see the App Configuration options in BES12. A Developer can define the set of restrictions in their android app.

Restrictions you say? Even Google admits the naming doesn’t fit the functionality: “For historical reasons, these configuration settings are known as restrictions, and are implemented with files and classes that use this term (such as RestrictionsManager). However, these restrictions can actually implement a wide range of configuration options, not just restrictions on app functionality.” So, while they can be used to restrict an app, the better term is configuration. I digress.

Restrictions are defined in an xml file and referenced in the app manifest file.

Manifest Reference

<meta-data android:name="android.content.APP_RESTRICTIONS"
    android:resource="@xml/app_restrictions" />



<?xml version="1.0" encoding="utf-8"?>
 <restrictions xmlns:android="" >
         android:title="string resource"
         android:restrictionType=["bool" | "string" | "integer"
                                         | "choice" | "multi-select" | "hidden"
                                         | "bundle" | "bundle_array"]
         android:description="string resource"
         android:entries="string-array resource"
         android:entryValues="string-array resource"
         android:defaultValue="reference" >
             <restriction ... />
     <restriction ... />

The details are important as they help define a template that the BES uses to generate the configuration screen for the admin. The developer then makes use of these restrictions in their code by reading, applying and listening for changes to the restrictions. For more information on how to do this check out the developer docs here .

Now that the restrictions have been defined for the app and the app is making use of them it is time to setup the configuration on the BES. For the sake of simplicity, we will use an app from Google Play that already has App Restrictions implemented. Google Chrome is a great example of this.

Add the application to the App management console and open the Settings tab. Right above the Cancel and Save buttons you should see a section titled App configuration. Note: If you do not see this section then there are no App Restrictions implemented in that app.


Click the + near the top right to add a configuration. Note you can add as many as you like and prioritize them (incase a user is assigned multiple app groups with the same apps, but different configs).

The next screen you see is the BES rendering of the application restrictions xml file the developer created. You can see all the settings available with their default values. Set a couple of settings and click save.


Select Save again on the Settings tab and you should be back on the App management screen. Now create a new App Group, enable for Android for Work, give it a name and description and click the + to add an app to it. When you find you app with a config associated with it you should notice the App config drop down on the right column.


Select the App config and click Add to take you back to the App Group, then Add again to take you back to the App management screen. Now all that is left is applying the app group to a user or group of users and the application and the configuration you set will be delivered to the users Android for Work devices. I won’t cover applying App Groups to Users and Groups in this article. It is pretty straight forward.

A couple of important notes:

  1. You cannot modify an older app group created pre BES 12.3, you have to create or modify a new one.
  2. The apps could be in use if you decide to change an App Config. This shouldn’t cause an issue if the developer has taken this edge case in to consideration.
  3. You cannot configure an app assigned to individual users, it needs to exist in an App Group.

Take it to the next level

There are a small set of Default Variables in BES listed here: . You can make use of these in your App Configs. Not all work in my testing but the important ones like %UserName% and %UserDomain% do. There is a lot of power in this creating really unique user experiences.

If you have any questions or want to reach out on another topic please tweet me @brentthornton32

About Brent Thornton