# Troubleshooting # Security Policy #### Troubleshooting help for Security policies ##### **"Security policy with this name already exists in this enterprise"** Choose a different **Description Name**. ##### **"Cannot delete security policy because it is used in configuration"** Remove the policy from every device group that uses it, then delete it again. ##### **Devices have no lock screen** **Lockscreen disabled** is **Yes** by default in a new policy. Open the policy and switch it to **No**. ##### **The minimum character fields have no effect** **Minimum letters**, **Minimum lower case**, **Minimum non letter**, **Minimum numeric**, **Minimum symbol** and **Minimum upper case** only apply when **Quality** is **Complex**. **Minimum length** also applies to the other password-based qualities. ##### **Devices lost their Wi-Fi networks** Turning **Common criteria mode** off after it was enabled can remove the user-configured Wi-Fi networks on the device. Push the needed networks through a Network and Connectivity policy. # Interaction Policy #### Troubleshooting for Interaction Policies ##### **"Interaction policy with this name already exists in this enterprise"** Choose a different **Description Name**. ##### **"If any kiosk setting is set, then all kiosk settings must be set to a value other than 'Unspecified'."** Fill in every Kiosk dropdown, or use **Clear Kiosk settings** to reset them all. ##### **"Kiosk status bar 'NotificationsAndSystemInfoEnabled' requires kiosk system navigation to be either 'NavigationEnabled' or 'HomeButtonOnly'."** Showing notifications needs a working home button — change **Kiosk system navigation** accordingly. ##### **"Screen brightness mode must be either 'Automatic' or 'Fixed' when screen brightness is set."** Either clear **Screen brightness %** or choose an enforcing brightness mode. ##### **"Screen timeout must be set when mode is SCREEN\_TIMEOUT\_ENFORCED" or "When screen timeout is set, mode must be SCREEN\_TIMEOUT\_ENFORCED"** **Screen timeout** and **ScreenTimeoutEnforced** belong together: set both or neither. ##### **"Setup Action '…' requires an application with install type 'REQUIRED\_FOR\_SETUP'."** This appears when saving a device group: the app launched by the setup action must be in the same device group with install type **RequiredForSetup**. Adjust the app's Application policy or the setup action. ##### **"Cannot delete interaction policy because it is used in configuration"** Remove the policy from every device group that uses it, then delete it again. ##### **The setup action does not run on devices** If the device group contains the device management client app, the policy's setup action is replaced with the system's own client-launch action. Check also that the launch app is delivered with install type **RequiredForSetup**. # Administrative Policy #### Troubleshooting for Administrative Policys ##### **"Administrative policy with this name already exists in this enterprise"** Choose a different **Description Name**. ##### **"Wipe cannot be scheduled before the block action." or "There must be at least one day between the block and wipe actions."** In the enforcement rule, set **Wipe after days** to at least one day more than **Block after days**. ##### **"Enforcement rule name must be unique"** Two enforcement rules have the same **Policy to enforce**. Each option can only be used once — remove or change one of the rules. ##### **"Cannot delete administrative policy because it is used in configuration"** Remove the policy from every device group that uses it, then delete it again. ##### **The authentication fields cannot be edited** **Authentication type** and **Required account email** require a Domain-Managed Enterprise bound under your own Google domain. Upgrade the enterprise on the **Enterprise** page to use them; the selectable emails are the accounts of that domain. # Application Settings Policy #### Troubleshooting for Application Settings Policies ##### **"Application setting policy with this name already exists in this enterprise"**
Choose a different **Description Name**.
##### **"Cannot delete application setting policy because it is used in configuration"** Remove the policy from every device group that uses it, then delete it again. ##### **Apps disappeared from devices after the policy was applied** **Play Store Mode = Whitelist** uninstalls every app that has no Application policy. Create Application policies for the apps that should stay, or switch to **Blacklist**. ##### **Devices lost network access** **VPN Lockdown Enabled** blocks all networking while the VPN app is not connected. Check that the **VPN Package Name** is correct, that the VPN app is delivered to the devices through an Application policy, and that it can reach your VPN server. ##### **The user's keyboard stopped working** If **Permitted Method Inputs** lists any packages, all other keyboards are blocked. Add the keyboard's package name to the list or clear the list. # Device Function Policy #### **Troubleshooting for Device function policies** ##### **"Location is on although the policy did not set it"**
A new Device Function policy starts with **Location Mode** set to **LocationEnforced**, and a device group without a Device Function policy enforces location as well, so devices can report their position for the device map. Set **Location Mode** to **LocationUserChoice** or **LocationDisabled** if the group must not enforce location.
##### **"Device function policy with this name already exists in this enterprise"** Choose a different **Description Name**. ##### **"Cannot delete device function policy because it is used in configuration"** Remove the policy from every device group that uses it, then delete it again. ##### **"A device ignores a setting"** Check the device type and Android version: **Microphone Access** and **Network Reset Disabled** only work on fully managed devices, **PrintingDisallowed** needs Android 9 or later, and enforcing **Location Mode** on a work profile (Android 11 or later) requires the user to change the setting themselves. ##### **"The screen still turns off while charging"** Check that the right power source is selected in **Stay On Plugged Mode** — AC, USB and wireless charging are controlled separately. ##### **"Devices in this group are not on the map"**
Check that **Location Mode** is **LocationEnforced** (or the group has no Device Function policy), that the devices run KMM Client `v0.6.0 (40)` or newer, and request a fresh position from the device page.
# Application Policy #### Troubleshooting for Application policy
##### **"Application policy with this name already exists in this enterprise"** Choose a different **Description Name**. ##### **"Network, Charging and DeviceIdle constraints not allowed for this install type"** Installation constraints only work with **ForceInstalled** or **PreInstalled**. Clear the constraint fields or change the **Install Type**. ##### **"Install priority can only be set for ForceInstalled or PreInstalled apps."** Clear **Install Priority** or change the **Install Type**. ##### **"Kiosk role type requires install type to be RequiredForSetup or Custom."** Change the **Install Type**, or remove the **Kiosk** role. ##### **"Only Kiosk role type can have UserControlSettings set to UserControlAllowed."** For **CompanionApp** and **SystemHealthMonitoring** apps, set **User Control Settings** to something other than **UserControlAllowed**. ##### **"Play related fields cannot be set for Custom install type"** Clear **Minimum Version Code**, **Install Priority**, **Auto Update Mode**, **Accessible Track Ids** and the installation constraints — they do not apply to custom apps. ##### **"Signing key certificate fingerprint required for Custom install type" or "APK version code must be set for Custom install type."** The custom app's fingerprint and version are normally filled in automatically when you select the app. Re-select the **Application** and check the **Signin Key Fingerprint** and **APK Version Code** fields. ##### **"Custom install type can only be used with custom apps" or "Install Type must be Custom for custom APKs"** **Custom** works only for uploaded APKs, and uploaded APKs work only with **Custom**. Check which app you selected. ##### **"Role type not allowed for Custom install type"** A custom app can hold the **Kiosk** role only. Remove the other roles. ##### **"Cannot delete application policy because it is used in configuration"** Remove the policy from every device group that uses it, then delete it again. ##### **The app never installs** Check the installation constraints (the device may be waiting for Wi-Fi, charging or idle time), the device's Android version against **Min Android**, and for custom apps that the device is fully managed. # Network And Connectivity Policy #### **Troubleshooting for Network and connectivity policies** ##### **Network and connectivity policy with this name already exists in this enterprise** Choose a different **Description Name**. ##### **PAC URI cannot be configured when direct proxy settings are enabled** Clear either **Proxy PAC URL** or the **Proxy Host / Port / Exclusion List** fields. ##### **At least one SSID must be specified if Wi-Fi allowlist is enabled** Add at least one name under **Wifi SSIDs**, or change **Wifi SSID Policy Type**. ##### **SSIDs must not be specified if Wi-Fi policy type is Unspecified** Remove the names from **Wifi SSIDs** or choose a policy type. ##### **A passphrase is required when any security type other than 'None' is selected** Enter a **Passphrase** for WepPsk, WpaPsk or Wep8021x networks. ##### **Passphrase is not required if security type is WPA-EAP, WPA3-Enterprise\_192 or Unspecified** Clear the **Passphrase** for that configuration. ##### **WEP PSK must be 10 or 26 characters** Enter the WEP key in its 10- or 26-character hexadecimal form. ##### **Enterprise Wi-Fi requires at least one domain suffix. / Invalid domain suffix: …** Fill in **EAP Domain Suffix Match** with comma-separated domain names that each contain a dot. ##### **WPA-EAP or WPA3-Enterprise\_192 must contain: EAP Outer, Identity, Server CA Ref, Client Cert Type, Client Cert Ref and Network Certificates** Fill in all EAP fields and add at least one certificate, or choose a personal security type. ##### **Cannot delete network and connectivity policy because it is used in configuration** Remove the policy from every device group that uses it, then delete it again. ##### **A device ignores a setting** Check the **Min Android** column against the device's Android version, and make sure the device is company-owned. Most Network Access and Wi-Fi Policies settings do not apply to personally owned devices. ##### **Devices lost their Wi-Fi networks after the policy was applied** **Configure Wifi = DisallowConfiguringWifi** removes all networks from a fully managed device except those under **Network Configurations**. Add the needed networks there, or turn on **Escape Hatch Enabled** so users can reconnect. ##### **An enterprise (EAP) network does not connect** Enterprise Wi-Fi is not yet delivered to devices in the current release. Use a personal network for now. # System Update Policy #### Troubleshooting for System update policy ##### **"System update policy with this name already exists in this enterprise"** Choose a different **Description Name**. ##### **"Windowed update type requires start and end minutes to be set"** Fill in **Start Minutes** and **End Minutes** (0–1439), or choose another **Update Type**. ##### **"Start and end minutes can only be set if update type is Windowed"** Clear **Start Minutes** and **End Minutes**, or switch the **Update Type** to **Windowed**. ##### **"Invalid: Start date for month" or "Invalid: End date for month"** A freeze period date does not exist — check that the day fits the month (months 1–12, days 1–31). ##### **"Freeze period must not exceed 90 days"** Shorten the freeze period. ##### **"Freeze periods must not overlap" or "Each freeze period must be separated by at least 60 days."** Adjust the freeze period dates so the periods are apart from each other. ##### **"Cannot delete system update policy because it is used in configuration"** Remove the policy from every device group that uses it, then delete it again. ##### **Updates install even though a freeze period is active** Freeze periods require an **Update Type** other than **Unspecified**. Set the type to Automatic, Windowed or Postpone. ##### **Google Play system updates wait for a reboot** Google Play system updates (Mainline updates) are downloaded automatically but are only installed when the device reboots. # Managed Configurations #### Troubleshooting Managed configurations ##### ##### **"No Managed Configurations available for this package"** **[![5501e4eb-aee0-4ad5-8e30-836adc03788a.png](https://wiki.kuori.com/uploads/images/gallery/2026-09/scaled-1680-/5501e4eb-aee0-4ad5-8e30-836adc03788a.png)](https://wiki.kuori.com/uploads/images/gallery/2026-09/5501e4eb-aee0-4ad5-8e30-836adc03788a.png)**
The app does not support managed configurations. For a Google Play app there is nothing to do — the app simply has no configurable settings. For an uploaded APK this means the APK declares no restrictions; if the app should be configurable, check with the app's developer that the restrictions are included in the APK. ##### **"Managed configuration with this name already exists in this enterprise"** Choose a different **Description name**. ##### **"Cannot delete managed configuration because it is used in configuration"** The configuration is used by an Application policy or as a device group's client configuration. Remove it from use, then delete it again. ##### **A warning triangle is shown next to the package name** The package's restriction structure has unfinished settings — the warning lists them, for example *Property 'colors' of type 'Choice' should have selectable values defined.* Complete the structure under **Applications → APK Restrictions Structure**, then continue. ##### **A placeholder like %store\_id% appears on the device unchanged** The Application policy using the configuration did not fill in the placeholder. Open the policy and enter a value for it in the **Managed Configuration** section. ##### **The Create button cannot be selected** A **Description name** and at least one selected setting are required before the configuration can be created. ##### **Devices did not receive changed values** After editing a configuration, the device groups that deliver it are marked **Out of Sync**. Open the Device Groups page and sync them. # APK Restriction Structure #### Troubleshooting APK restrcition structures
##### **A warning triangle is shown on a package or setting** The structure has unfinished settings. The warning lists them, for example *Property 'pick\_one' of type 'Choice' should have selectable values defined.* Fill in the **Selectable entries** of the named settings and save. ##### **The app is not in the list** Only uploaded APK apps whose APK declares restrictions appear here. Google Play apps are never listed — their settings come from Google Play. If an uploaded app is missing, the APK does not declare any restrictions; that must be fixed in the app itself. ##### **The app ignores the configured values** The delivered values do not match what the app expects. Check that each **Selectable entries** value, the **Type** and the **Key** are exactly what the app's documentation states. ##### **A new app version's settings do not appear** The structure is read only when the app is first uploaded. To read it fresh, delete the app from the Application List and upload the new APK — this loses the hand-filled entries, so note them down first. ##### **The warnings did not disappear after saving** Every **Choice** and **MultiSelect** setting must have at least one selectable entry. Check for unfinished settings with the **Show Unfinished** switch. # Application List Page #### Troubleshooting for Application list page
##### **"File too large. Max size is 1 GB."** The chosen APK exceeds the upload limit. Use a smaller build. ##### **The upload is rejected with a file type error** Only APK files are accepted. Make sure the file is a real `.apk` — a renamed file of another type is detected and rejected, and a file that cannot be read as a valid APK is not added. ##### **The Google Play window stays empty** The embedded store takes a small moment to open — wait for it. If it never loads, check that the browser can reach Google Play (no blocking firewall or ad blocker). ##### **The Delete button is disabled** The app is used by one or more Application policies — the **Assigned Policies** column shows which. Delete those policies first, then delete the app. ##### **The Download button is disabled** Google Play apps have no file in KMM to download; only uploaded APK apps can be downloaded. ##### **A Google Play app shows no version or filename** This is normal: Google Play delivers the app content, so KMM stores only the name and package for it. # Device Groups #### Troubleshooting for Device groups
##### **"Device group name cannot start with system reserved prefix 'initial\_'."** The prefix is reserved for the automatically created initial setup groups. Choose another name. ##### **"Group name can only contain ASCII letters (a-z, A-Z), numbers (0-9), hyphens, and underscores."** Remove spaces and special characters from the **Name ID**. ##### **"Group cannot be deleted while it has devices assigned"** Open the group, select the devices under **Group devices** and remove them with **Remove selected from group**, then delete the group. ##### **"Default group cannot be deleted" or "Cannot delete devices from the default group"** The default group is the fallback for devices removed from other groups, so it must always exist and keeps its devices. Move a device onward by enrolling it into another group. ##### **"Setup Action '…' requires an application with install type 'REQUIRED\_FOR\_SETUP'."** The Interaction policy's setup action launches an app that is not delivered with install type **RequiredForSetup** in this group. Adjust the app's Application policy or the setup action. ##### **"Only one kiosk application is allowed." or "Only kiosk custom launcher or application role kiosk can apply"** The group has more than one kiosk. Keep a single Application policy with the **Kiosk** role, or the kiosk custom launcher alone. ##### **"The group keeps going Out of Sync"** That is how policy edits reach devices: changing any policy or managed configuration the group uses marks it Out of Sync. Select the sync icon to push the changes. To see **Out of Sync** groups use the **Out of Sync** filter on the device group list, or the **Out of Sync** card on the dashboard, to see every group that needs a sync. ##### **"Tasks for a published group show Open or Pending for a long time"**
Devices that are not connected receive their tasks when they connect. The task stays Open until then instead of failing. Check the device's **Client connection** dot; if it is red, work through the connectivity checklist in the FAQ.
##### **"Use Security service can't be switched on"**
It requires **Use Client** to be on. The two switches sit side by side; the question mark beside each explains what it installs.
##### **"Devices got the wrong apps or files after publish"**
Fixed in 1.6.0: devices always receive the apps and files of their own group and enterprise, and each task is sent once. If an older publish left a device in that state, publish the group again.
# Enrollment Tokens #### Troubleshooting for Enrollment tokens
##### **"Required account email must be provided when Management is PersonalUsageDisallowed"** Pick a **Required Account Email**, or use **PersonalUsageDisallowedUserless**. ##### **Management and Required Account Email are crossed out** They require a Domain-Managed Enterprise. Upgrade on the **Enterprise** page; the selectable emails are the accounts of the bound domain. ##### **The device shows "Wrong account" during setup** The token has a **Required Account Email** and someone signed in with a different account. Sign in with exactly the required address. ##### **The token no longer enrolls devices** Check the card: an **Expired** badge means the duration has passed — create a new token. A **One Time Only** token stops working after its single use. ##### **The device group I want is not in the dropdown, but an initial\_ name is** That group has an initial setup group, and tokens for it are created through the `initial_...` entry. Enrolled devices move to the actual group automatically once setup finishes — see the *Device Groups* manual. # Devices Page #### Troubleshooting for Devices page
##### **"Actions and Tasks are locked while group change is in progress."** The device is between groups. Wait for the device to pick up the change — it must be online — or, as an administrator, cancel with **Lift Lock (Return to previous group)**; the console warns if the device may be out of sync afterwards. ##### **"Applied Group Name and Configured Group Name differ"** A group change has been made but the device has not applied it yet. This is the same in-progress situation as above. ##### **"Request Screenshot is disabled"**
Either the device's KMM Client is not connected (the **Client connection** dot in the Status section is red or grey; check **Use Client** in the device group), or a screenshot has already been requested and the button reads **Screenshot Requested**. If the device could not take it, the bell shows **Screenshot Failed** with the reason and the button becomes available again.
##### **"A task shows Failed"** The **Reason** column tells why. Fix the cause — commonly the device was offline or storage was full — and select **Rerun**. ##### **"The device is not compliant with its policy"** Open the **Policy Compliance** tab: each entry names the setting and the reason. Typical causes are a policy requirement the user has not fulfilled (such as a password) or an app that could not be installed. ##### **"Reboot seems to do nothing"** Reboot works on fully managed devices with Android 7.0 or later, and commands can take up to ten minutes to reach the device. ##### **"Change group or reboot failed for some selected devices"**
The result of a bulk action is reported per device. Devices that failed stay selected so you can retry; the message names the reason, for example that Google rejected the request. Devices with a group change in progress cannot be selected.
##### **"The device is not on the map"**
The map shows only devices that have reported a position. The device needs KMM Client `v0.6.0 (40)` or newer and location services on (enforced by default for groups without a Device Function policy; otherwise set **Location Mode** to **LocationEnforced**). Select **Refresh location** on the Location tab or **Refresh all** on the map and wait for the device to answer. The map uses the same filters as the list.
##### **"The client connection dot is grey / red / yellow"** - **Grey:** the device's group does not use the KMM Client. - **Red:** the group uses the client but it is not connected; see the connectivity checklist in the FAQ. - **Yellow:** connected but weak (slow round trip or missed heartbeat replies); hover the dot for the response time. The dot and the map markers update live. ##### **"Refresh Device Data seems to do nothing"**
The page reloads by itself as soon as the refresh from AMAPI finishes. If nothing changes, AMAPI had no newer data for the device from Google's DPC.
##### **"A task shows Failed"**
A task for a device that is not connected waits instead of failing. The Tasks tab updates itself when a task completes or fails.
# Firewall rules and encryption (KMM) ### Managed Android devices Outbound rules from the network the devices are on. Devices run Google's Android Device Policy for enrollment and policy, and the KMM client application for files, APK installs, screenshots and task reporting.
Address Protocol Port Purpose
mdm.kuori.com TCP 443 HTTPS REST calls from the KMM client (files, APK downloads, screenshots, token refresh, location reports)
mdm.kuori.com (path /ws) TCP 443 WebSocket (WSS) from the KMM client for task delivery, heartbeat, connection quality and location requests
Google Android Enterprise endpoints TCP 443, 5228–5230 Android Device Policy, Google Play, Firebase Cloud Messaging, device provisioning, OTA updates. See the Google document linked below.
DNS servers UDP/TCP 53 Name resolution
NTP servers (time.google.com) UDP 123 Time synchronization
Staging and development environments use `mdm-stage.kuori.com` and `mdm-dev.kuori.com` with the same ports. Google's own network requirements for Android Enterprise devices: - [Android Enterprise Network Requirements - Android Enterprise Help](https://support.google.com/work/android/answer/10513641) ### Network whitelisting limitation (Android devices) IP address–based whitelisting is not a viable approach for this solution. The devices in scope run Android and rely on Google Play, Android Device Policy, Firebase Cloud Messaging and other Google-managed infrastructure. These services do not use fixed IP addresses; they operate on large, dynamic, globally distributed cloud networks, so the addresses change frequently and cannot be reliably predicted or restricted to a fixed range. - IP-based whitelisting would be unreliable and may cause service disruptions. - Essential functionality (policy delivery, app installs and updates, authentication) could fail if traffic is blocked due to changing IPs. - Maintaining an up-to-date allowlist of IP ranges is not practical or sustainable. The Kuori hostnames above are stable and can be allowed by name. Google traffic requires general outbound internet access, and any restrictive filtering approach may lead to unintended loss of functionality. ### External applications and network requirements Applications distributed to the devices through KMM, whether from managed Google Play or as custom APKs, may have their own network requirements, including ports and endpoints. These should be reviewed and approved individually before deployment. Relying on IP-based whitelisting for these applications is not recommended, as many cloud services use dynamic addresses that frequently change. Allow only the outbound connections each application needs.