Device Trust from Android Enterprise - Available signals

Page Summary

Device Trust from Android Enterprise provides device posture signals to registered applications for computing a device trust score.
Access to device trust signals is restricted via an allowlist, requiring registration.
Available signals include OS version, pending updates, security patch levels, critical app details, device model/brand, screen lock complexity, management state, disk encryption, network state, Google Play Protect status, DNS over TLS status, and WebView package.
The management state signals vary depending on whether the application is running within the personal or work profile and the device ownership type.
Specific management state signals like Device.WorkProfileState are available starting from particular AMAPI SDK versions.

Device Trust from Android Enterprise makes available a set of device posture signals on Device that authorized applications—including applications on the allowlist and apps assigned the COMPANION_APP role (see Manage application roles and Policy Configuration)—can access to compute a trust score for the device.

Each signal field on Device and its nested model classes includes a corresponding get*Metadata() method returning Metadata, which reports any Metadata.DataIssue encountered when retrieving the signal (such as missing manifest permissions).

For information on how to integrate the Android Management API SDK in your application, see Device Trust from Android Enterprise - Integration guide.

Signals
OS Version	`Device#getSoftwareInfo()` returns a `SoftwareInfo` object containing OS version details (older OS versions typically have more vulnerabilities): `SoftwareInfo#getAndroidVersion()`: user-visible Android version string. `SoftwareInfo#getAndroidSdkVersion()`: API level of the Android platform version running on the device.
Android Device Policy version	`SoftwareInfo#getAndroidDevicePolicyVersionCode()` and `SoftwareInfo#getAndroidDevicePolicyVersionName()` return the version code and user-visible version name of the Android Device Policy app on the device.
Does the device have pending OTA	`SoftwareInfo#getSystemUpdateInfo()` returns a `SoftwareInfo.SystemUpdateInfo` indicating whether there is a pending OS update for the device (a proxy for whether the device is vulnerable to exploits): `SystemUpdateInfo#getUpdateStatus()` (an `UpdateStatus` value). `SystemUpdateInfo#getUpdateReceivedTime()`: when the update first became available. On Android 15 and higher, this signal is available in all scenarios. On Android 14 and lower, it is only available when the device is managed by the Android Device Policy app (not on non-managed devices or devices managed by a custom DPC).
Device Security Patch Level	`SoftwareInfo#getDeviceSecurityPatchInfos()` returns a list of `SoftwareInfo.SecurityPatchInfo` objects (with `getComponent()` and `getSecurityPatchLevel()` returning a list of `SecurityPatchLevel` objects) for the current security patch level of the device across updatable `SecurityPatchComponent` types: `SYSTEM` `KERNEL` `SYSTEM_MODULES` (also known as Android's mainline modules)
Published Security Patch Level	`SoftwareInfo#getPublishedSecurityPatchInfos()` returns a list of `SoftwareInfo.SecurityPatchInfo` objects (with `getComponent()` and `getSecurityPatchLevel()` returning a list of `SecurityPatchLevel` objects) for the current published security patch level across updatable `SecurityPatchComponent` types: `SYSTEM` `KERNEL` `SYSTEM_MODULES` (also known as Android's mainline modules)
Critical App Details	`Device#getApplicationReports()` returns details on all installed applications to extensibility apps and calling applications with role `COMPANION_APP` on an AMAPI-managed device (see Manage application roles and Policy Configuration; when called inside a work profile, reports are limited to apps installed in the work profile). For all other callers (such as applications on the allowlist), `Device#getApplicationReports()` returns details only on the following critical apps: `com.android.chrome` `com.google.android.gms` `com.google.android.apps.work.clouddpc` `com.android.vending` The device's current WebView package (such as `com.google.android.webview`) Details are returned as a list of `ApplicationReport` objects exposing: `getPackageName()` `getVersionName()` and `getLongVersionCode()` `getSigningKeyCertSha256Fingerprints()` `getApplicationSource()` (an `ApplicationSource` value) and `getInstallerPackageName()` These fields are only populated on AMAPI-managed devices (fully managed devices and work profiles). On non-managed devices, personal profiles, or custom-DPC devices, these fields may not be populated: `getInstallerPackageName()` returns an empty string (`""`) and `getApplicationSource()` returns `APPLICATION_SOURCE_UNSPECIFIED`. Callers in those environments shouldn't treat `APPLICATION_SOURCE_UNSPECIFIED` as indicating a sideloaded app. `getLastUpdateTime()`
Device Hardware Info	`Device#getHardwareInfo()` returns a `HardwareInfo` object exposing: `HardwareInfo#getModel()`: device model. `HardwareInfo#getBrand()`: device brand. `HardwareInfo#getManufacturer()`: device manufacturer. `HardwareInfo#getHardware()`: hardware name. `HardwareInfo#getDevice()`: industrial design name. `HardwareInfo#getProduct()`: overall product name.
Screen lock complexity	`Device#getDeviceSettings()` provides `DeviceSettings#getScreenLockComplexity()`, returning a `DeviceSettings.ScreenLockComplexity` value indicating how complex the current user's or profile's screen lock is. Requires the `REQUEST_PASSWORD_COMPLEXITY` permission in the calling app's manifest for all callers.
Management State (and managing app)	`Device#getOwnership()` returns a `Device.Ownership` value. `Device#getManagementMode()` returns a `Device.ManagementMode` value. `Device#getManagementAppPackageName()` returns the package name of the managing app. `Device#getWorkProfileState()` returns a `Device.WorkProfileState` value. The returned information depends on the profile the application is running in. For details, see the Management state table.
Disk encryption	`DeviceSettings#getEncryptionStatus()` returns a `DeviceSettings.EncryptionStatus` value indicating whether the device's storage is encrypted.
Access Network State (Network state and Wi-Fi state)	`Device#getNetworkInfo()` returns a `NetworkInfo` object, and `NetworkInfo#getNetworkParams()` returns a list of `NetworkInfo.NetworkParams` objects with details about all active networks on the device: `getNetworkTransport()` (a list of `NetworkTransport` values, such as cellular or Wi-Fi) `getWifiSecurityLevel()` (`WifiSecurityLevel`: `OPEN`, `PERSONAL`, `ENTERPRISE_EAP`, `ENTERPRISE_192`) `getPrivateDnsState()` (`PrivateDnsState`) Requires the `ACCESS_NETWORK_STATE` permission in the calling app's manifest for all callers.
Google Play Protect VerifyApps	`DeviceSettings#getGooglePlayProtectVerifyAppsState()` returns the current `GooglePlayProtectVerifyAppsState`.
Is DNS over TLS enabled	`NetworkParams#getPrivateDnsState()` returns a `PrivateDnsState` value indicating whether private DNS is used on the network.
WebView package	`SoftwareInfo#getWebviewPackage()` returns the name of the current WebView package.
Human-readable business name of the management provider	On AMAPI-managed devices, `Device#getManagementProviderInfo()` returns a `ManagementProviderInfo` object whose `getBusinessName()` method provides the human-readable business name of the management provider. This field isn't set on non-managed devices or devices managed by a custom DPC. This signal is available starting from AMAPI SDK v1.7.0-rc01.

Management state

The values returned for the management signals depend on the profile that your application is running in. Accessing signals from within the Personal Profile, on a non-managed device, or on a device managed by a custom DPC requires your application to be on the allowlist. On an AMAPI-managed fully managed device or from within a Work Profile, applications assigned the COMPANION_APP role can also access these signals without being on the allowlist (limited to signals from the work profile when called inside a work profile).

Management state	Signals when called from within the Personal Profile	Signals when called from within the Work Profile
Non-managed device	ownership: `PERSONALLY_OWNED` managementMode: `UNMANAGED` managementAppPackageName: `N/A` workProfileState: A13+: `WORK_PROFILE_NOT_PRESENT` A9-12: `WORK_PROFILE_STATE_UNSPECIFIED`	`N/A`
Work Profile on personally-owned device (BYOD)	ownership: `PERSONALLY_OWNED` managementMode: `UNMANAGED` managementAppPackageName: `N/A` workProfileState: A13+: `WORK_PROFILE_PRESENT` A9-12 (AMAPI): `WORK_PROFILE_PRESENT` A9-12 (CustomDPC): `WORK_PROFILE_STATE_UNSPECIFIED`	ownership: `PERSONALLY_OWNED` managementMode: `PROFILE_OWNER` managementAppPackageName: `Package name of the Profile Owner application` workProfileState: A9+: `WORK_PROFILE_PRESENT`
Work Profile on company-owned device	ownership: `COMPANY_OWNED` managementMode: `UNMANAGED` managementAppPackageName:`N/A` workProfileState: A13+: `WORK_PROFILE_PRESENT` A9-12 (AMAPI): `WORK_PROFILE_PRESENT` A9-12 (CustomDPC): `WORK_PROFILE_STATE_UNSPECIFIED`	ownership: `COMPANY_OWNED` managementMode: `PROFILE_OWNER` managementAppPackageName: `Package name of the Profile Owner application` workProfileState: A9+: `WORK_PROFILE_PRESENT`
Fully managed device	`N/A`	ownership: `COMPANY_OWNED` managementMode: `DEVICE_OWNER` managementAppPackageName: `Package name of the Device Owner application` workProfileState: A11+: `WORK_PROFILE_NOT_PRESENT` A9-10: `WORK_PROFILE_STATE_UNSPECIFIED`

Device Trust from Android Enterprise - Available signals Stay organized with collections Save and categorize content based on your preferences.

Page Summary

Management state

Device Trust from Android Enterprise - Available signals