SOTI Pulse Logo

Turning off Google Play Protect scanning

M
MarkS
ExtenData Solutions LLC

I am wondering if anyone has found a way to not only "ungray" the setting under Settings > Google > Security > Google Play Protect so that it can be toggled, but also actually toggle it OFF.

SOTI provided two methods for doing the first item, to re-enable the setting so that it can be manually toggled.  The methods are actually the same thing (a feature control) done two different ways:

(1) Send script command:

writesecureprofstring DeviceFeature DisableVerifyApps 1

apply featurecontrol

(2)  Create / assign a Feature Control that has "Disable Verify Apps Enforcement" checked.

In my experience, these have the effect of re-enabling the toggle on the GPP setting, but leaving the setting toggled ON.  It then has to manually be toggled OFF.  I have certain apps that are mission-critical and mass-deployed, so touching each device to turn off GPP scanning for first deployment and subsequent app updates is absolutely not a feasible option.   So far, SOTI Support has been unable to provide a means to programmatically toggle that option OFF.

My other rather large challenge with this is, under AEDO, I've found that a Lockdown Screen profile has the side effect of toggling GPP back on, and graying it back out again so that it once again cannot be toggled off.  SOTI says that this is the "expected behavior," to which I respond, WHY?  Perhaps I am missing a pertinent concept here, but to my mind it is ridiculous to have a lockdown screen profile that also has the effect of locking GPP scanning on.  These corporate users need app installations and app updates -- and those need to happen while the lockdown screen is in place.

I've found that if the lockdown profile is already applied, the above two methods will have the effect of "ungraying" the GPP option so that it can manually be turned off.  BUT if the lockdown profile ever is re-applied, or refreshes itself due to an editing change (such as perhaps adding an entry for whatever new app(s) are intended to be applied), then GPP is again turned on and the toggle is grayed out.

This is very frustrating.  I need a way to turn GPP scanning off, and KEEP it off, until I (and only I) tell it that it can turn back on again,

Any advice would be appreciated.

Thank you,

Mark

android enterprise aedo google-play-protect gpp
6 years ago
Android
ANSWERS
MD
Matt Dermody Diamond Contributor
6 years ago

There have been a couple of other threads on this topic and despite the discussions, there is not a great solution at the moment. GPP, and the inability to administer it, is a prime example of Google missing the mark for the Android Enterprise dedicated device use cases. Yes we understand the Line of Business enterprise app that we're deploying may have a vulnerability because it was developed 5+ years ago but its in a completely controlled environment where we are the Device Owner, not some end user that needs to be protected. It's quite ironic really as Google touts GPP as one of the primary advantages of moving to Android Enterprise. Google is trying to get rid of the stigma that Android isn't secure by forcing things like GPP and more frequent OS upgrades and API level targeting for developers and they're getting increasingly like Apple as a result. 

If you have a mission critical app that is being blocked you may have to disable Google Play completely. Otherwise if you're just concerned about the pop up that comes up when a new version is deployed I believe you can just accept that on one device for it to be accepted everywhere, but I'm not 100% on that. 

https://discussions.soti.net/thread/android-enterprise-do-disable-gpp-scan/

https://discussions.soti.net/thread/enable-app-disabled-by-google-play-protect/

M
MarkS
6 years ago

Thanks, Matt!

Well, at least this validates that both my findings and my line of thinking were not incorrect.

It has not been my experience that clicking "Install Anyway" on the pop-up will then validate the app for all other devices.  That would be beneficial, but I've not seen that happen.  I have not even seen the pop-up itself come up 100% of the time.  In many cases, the package just sits in Pending status for a long time, then finally fails with what SOTI flags as a file I/O error.  Especially if attempting to install an apk while the device is under a lockdown profile -- that GPP pop-up, if it even does come up behind the lockdown screen rather than simply being suppressed by the lockdown profile, is of course not seen, so I get the same result:  the package simply fails with a "File I/O error."

Unfortunately, disabling Google Play is frequently not an option, as other apps are being brought down to the device under an Application Catalog Rule that authenticates under Managed Google Play Store (AE binding) and gets apps as "Mandatory" installations.  I'm pretty sure that disabling Google Play Services or GMS would disable that or mess it up in some way.

MD
Matt Dermody Diamond Contributor
6 years ago

Especially if attempting to install an apk while the device is under a lockdown profile -- that GPP pop-up, if it even does come up behind the lockdown screen rather than simply being suppressed by the lockdown profile, is of course not seen, so I get the same result:  the package simply fails with a "File I/O error."

This might explain some odd behaviors I've been seeing as well. I had not considered that the GPP pop-up might be behind or suppressed (but obviously not accepted) by being in a lockdown state. Good find. 

Unfortunately, disabling Google Play is frequently not an option, as other apps are being brought down to the device under an Application Catalog Rule that authenticates under Managed Google Play Store (AE binding) and gets apps as "Mandatory" installations.  I'm pretty sure that disabling Google Play Services or GMS would disable that or mess it up in some way"

I figured this was the case, but it may be the only option right now if you have a mission critical app that GPP is interfering with. 

JJ
Jim J
3 years ago

In what version was "Disable Verify Apps Enforcement" introduced?

Similar Discussions