Multi policies

Can more than one policy be applied to a device in Relution?

Relution 5 allows device configurations to be applied across multiple policies on a device. Previously, only one policy could be assigned to a device. The functionality is available for iOS, Android and Windows 10 platforms. Furthermore, iOS, macOS and tvOS also allow multiple restriction configurations to be applied to a device, which iOS automatically combines on the device.

For which use cases are multiple policies useful?

For example, there are central configurations such as WiFi and software updates for all devices. In addition, in the school context, teacher devices but certain apps and student devices require special restrictions as well as the shared device approach for selected classes. In the case of public authorities or in a corporate context, different apps or configurations for different departments are conceivable in addition to a shared configuration.

To map the example in the school context, three different policies with 12 partly identical configurations had to be maintained before Relution 5.

With Relution 5, it is now possible to use a base policy for all devices and, in addition, individual policies with special configurations for teacher devices, student devices and shared devices, as the following comparison shows:

What are the benefits of using multiple policies?

As a result, with Relution 5’s solution, there are no more redundant configurations. Changes to WiFi settings only need to be made once centrally to affect all devices. There is no need to adjust multiple policies for the same settings.

Can policies with the same configurations be targeted?

Basically, there are configurations that can exist multiple times on a device according to the technical specifications of the operating system manufacturers and configurations that may only exist once. For example, multiple WiFi or e-mail configurations are permitted, but there can only be one software update configuration on a device. It is therefore now possible to specify an order for the policies per platform, which can be used to define the priority. If multiple policies with a software update configuration are now applied to a device, the settings of the first policy have priority and are applied, since the configuration is only permitted once.

How are different app compliances handled, all applied to a device via multiple policies?

For iOS, if multiple policies, each with an app conformance, are applied to an iOS/macOS/tvOS device, the settings of the individual configurations are consolidated and applied to the device. The prioritization of the assigned policies is not applied in this case and the app conformance is executed on the device according to the following set of rules.

Blocklist and allowlist are summarized as follows:

• If only blocklists are present, they are combined
• If at least one allowlist is present, all blocklists are ignored and all allowlists are combined
• “Add all required apps” is only considered for the particular app conformance that has this setting selected for an allowlist “Add all auto-deployments” will only be considered if this setting is selected in all app conformities with an allowlist
• “Web links” will be set to the most restrictive setting of all app conformities

Required apps are summarized as follows:

• Required apps from all app conformities are combined
• Any required app for which “Auto Install” is selected will be installed automatically.

How are different “manage apps” configurations handled, all applied to an Android Enterprise device via multiple policies?

If several Android Enterprise policies with a “manage apps” configuration are applied to a device, only the configuration from the policy with the highest priority was observed until now. Instead, it is now possible to distribute the configuration of apps across multiple policies. The different app lists are now combined into a common list.

If the same app is defined in multiple policies, the entry with the strongest restriction in terms of installation type wins for them:

Blocked > Force-installed > Pre-installed > Available

The rest of the app’s settings (managed properties, permissions, and advanced settings) are taken from this configuration.

If the installation type is also ambiguous, the entry from the policy with the highest priority applies. If the app is disabled in at least one configuration, the app is basically disabled on the device.

Can multiple policies be stored for new device enrollments?

For normal enrollments and auto enrollments, it is now also possible to specify multiple policies that are assigned to the device during enrollment.

Where are all applied policies to a device displayed?

To better track the application of individual configurations to devices, the compliance view in the device details has been revised. With Relution 5, all configurations are listed, even those that do not result in compliance violations. For each policy applied, all current configurations on the device can be seen at a glance.

Can policies be targeted to specific user groups when enrolling new devices?

With Relution 5, in addition to standard policies for all newly enrolled devices, policies can also be defined for specific user or user group groups, which are automatically applied during enrollment.