Android Management API Policy Support

Topic

NinjaOne has implemented some basic API sets outlined in this article in JSON representations. We are working to release additional APIs with future releases. 

Environment

• Android OS
• NinjaOne MDM

Description

To learn more about Android Management API (AMAPI), please see the Android developer documentation. 

• Android Application Endpoint
• Delegated Scope
• Permission Grant 
• Device Connectivity Management
• Factory Reset Protection (FRP) Management
• Accessible Track IDs 
• Custom Messaging
• Always On VPN Package

Android Application Endpoint:

{{server}}/ws/mdm/application/android/{packageName}

The above endpoint has been created to fetch the data below.

• Display a list of permissions for that application (packageName), including runtime.
• View the latest pre-release version and app trans for any app that access has been granted. 
• Return an appTracks array with package data. 

Delegated Scope:

Set the DelegatedScope fields on an Android policy application. These provide additional privileges for the applications affected. Delegated scopes are a multi-select API, allowing an application within Policy/Applications/App settings to be granted one or more delegated scopes for additional functionality on-device.

Scopes can be applied to multiple applications, with the exception of SECURITY_LOGS, CERT_SELECTION and NETWORK_ACTIVITY_LOGS, which can be delegated to only one app at a time.

Example Payload

Permission Grant: 

Configure the Android permission policy and its grant state for the application configuration: all user-choice (i.e., prompt) or deny.

android.permission.READ_CALENDAR

android.permission_group.CALENDAR.

GRANT

Example Payload

Device Connectivity Management:

Control device connectivity such as Wi-Fi, USB data access, keyboard/mouse connections, and more. 

Example Payload

Factory Reset Protection (FRP) Management:

FRP management allows system administrators to input a specific Google account which overrides the FRP email on devices that are reset in an unauthorized way (e.g., recovery, re-flashed, too many wrong password attempts, etc.). Once set via an input string in Policy/Security under the title “Factory Reset Protection allowlisted account”, only this account can be used to unlock a reset device.

As best practice, NinjaOne suggests that these bind accounts not be user-associated.

Example Payload

Accessible Track IDs: 

Select the track ID for an application on any Android MDM policy. The appTrackInfo[] list included in the response contains the following for given apps:

• trackId: The track’s unique identifier, taken from the releaseTrackId in the URL of the page in the Play Console that displays the app's track information.
• trackAlias: The human-readable name for the track, which is modifiable in the Play Console.

To install a closed track on a user's device, specify the accessibleTrackIds in their device's policy.

Example Payload

Custom Messaging:

Allow organizations to set a custom lockscreen message, which can help administrators better communicate why something is blocked. 

Example Payload

Always On VPN Package:

Configure the AlwaysOnVpnPackage fields on an Android policy. 

Example Payload