I’m trying to understand a discrepancy in the Android App Configuration Policy. The policy has defaultPermissionPolicy set to DENY, yet under the app-level permissionGrants, the camera permission is set to PROMPT. According to the development documentation, permissionGrants should override the policy-level defaultPermissionPolicy. However, when I apply this to a device, it doesn’t seem to work as expected. When I try to access the camera, it directly shows a permission denied message.
"permissionGrants": [{
"autoUpdateMode": "AUTO_UPDATE_DEFAULT",
"defaultPermissionPolicy": "PROMPT",
"installType": "AVAILABLE",
"packageName": "com.mt.mtxx.mtxx",
"permissionGrants": [
{
"permission": "android.permission.CAMERA",
"policy": "PROMPT"
}
]
}]
"defaultPermissionPolicy": "DENY",
Has anyone else encountered this issue or can provide insight into what might be going wrong?
luckluckloong is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Tested this on my end and it is working as intended.
On Fully Managed Devices (Device Owner), the values set on app level permissionGrants overrides the restriction set using permissionGrants and defaultPermissionPolicy which applies to all apps.
Another thing to note is starting on Android 12, profile owners may no longer grant sensor-related permissions, but may deny them. This is part of the security and privacy enhancements changes that were introduced in Android 12 (API level 31) which are listed here.
You may also want to double check your policy and build it according to our documentation.
Using the policy below, I was able to confirm that android.permission.CAMERA was granted for the app.
{
"applications": [
{
"packageName": "com.android.example",
"installType": "FORCE_INSTALLED",
"permissionGrants": [
{
"permission": "android.permission.CAMERA",
"policy": "GRANT"
}
]
}
],
"permissionGrants": [
{
"permission": "android.permission.CAMERA",
"policy": "PROMPT"
}
],
"defaultPermissionPolicy": "DENY"
}
1