Android设备管理：免谷歌审核自定义EMM及应用管控可行性问询

Great question—let’s break this down piece by piece since you’ve got interconnected needs for your enterprise deployment of apps A, B, C, and D (where C/D depend on A/B).

Absolutely, both Device Management APIs and EMM solutions can handle these requirements, and they’re tailor-made for enterprise use cases:

App Anti-Uninstall #

• Fully Managed Devices (Corporate-Owned): If you’re deploying company-owned devices, you can use the Android Device Policy Manager (DPM) API to mark apps as required applications. When an app is set as required, the OS automatically installs it (if not present) and blocks users from uninstalling it. For example, you’d use a call like:

  devicePolicyManager.setRequiredApplication(adminComponentName, "com.yourcompany.appA", true);
  

  This works for A, B, C, and D—ensuring your dependency apps stay on the device.
• Work Profiles (COPE Mode): For devices that mix personal and work use, you can deploy your apps in a work profile. Apps in the work profile are managed separately, and you can set them as non-removable via your EMM or DPM API. Users can’t uninstall work-profile apps without removing the entire profile (which your EMM can restrict).

Play Store Whitelist/Blacklist #

• Play for Work Integration: Most EMMs (or custom solutions using Google’s Play Developer APIs) let you configure app allowlists (whitelists) or blocklists. With a whitelist, users can only install apps you explicitly approve (in your case, A, B, C, D). Blocklists let you restrict specific apps while allowing others.
• Custom App Distribution: If you’re not using Play Store, you can push APKs directly via your EMM and block access to the Play Store entirely using DPM policies (setApplicationHidden() to hide the Play Store package).

Yes, it’s totally feasible—here’s what you need to know:

• No Google Approval Required for Core Functionality: Android’s DPM API is publicly available, so you can build a custom EMM without needing to get approved by Google. You’ll need to develop an EMM server and a device-side management app (that acts as a device owner or profile owner) to enforce policies.
• Device Enrollment Options: You can enroll devices using methods like QR codes, NFC bump, or zero-touch enrollment—all of which don’t require Google’s approval. Your custom EMM just needs to generate the enrollment configuration (e.g., a JSON payload for QR enrollment) that devices use to register with your server.
• Limitations to Note:
  • If you want to integrate with Google’s official Play for Work ecosystem (for automated app licensing and bulk deployment), you’d need to register as a Google EMM Partner. But this isn’t mandatory—you can still distribute apps via APKs or manage Play Store access via policies without this partnership.
  • Custom EMMs require ongoing maintenance to support new Android versions, as DPM APIs evolve with each release (e.g., new policy controls in Android 13+).

Given that C and D rely on A and B, structure your deployment to prioritize dependency stability:

• Mark A and B as Required Apps: This ensures they’re installed first and can’t be uninstalled, eliminating dependency errors for C and D.
• Chain App Deployment: Configure your EMM to install A and B before deploying C and D. Most custom EMMs can handle sequential app pushes, or you can use DPM’s installPackage() method with dependencies specified.
• Lock Down Device Policies: Enforce your mandatory policies (e.g., password rules, camera restrictions, network controls) via the DPM API. For example, to set a complex password requirement:

  devicePolicyManager.setPasswordQuality(adminComponentName, DevicePolicyManager.PASSWORD_QUALITY_COMPLEX);
  

• Restrict Unwanted Apps: Use a Play Store whitelist to only allow A, B, C, D, or block the Play Store entirely if you’re using APK distribution.

内容的提问来源于stack exchange，提问作者RaviVadera