Runtime Permission Auto-Grant Failure (“Disabled by Admin”)

Applications may request runtime permissions that the operating system or SOTI MobiControl cannot automatically grant if the app’s target SDK version or manifest configuration is incompatible. This issue is common across multiple apps and is not limited to specific permissions. It often requires reviewing both the app’s manifest and the OS version on which it is running. 

• Android devices running versions that require runtime permissions
• Devices managed via SOTI MobiControl
• Apps requesting runtime permissions (e.g., BLUETOOTH_CONNECT, CAMERA, LOCATION, MICROPHONE, etc.)
• Apps targeting SDK versions lower than the version in which the required permission was introduced

• Runtime permissions are not granted automatically
• Permissions show “Disabled by Admin” in the app settings
• App functionality is blocked (e.g., pairing, scanning, or accessing hardware features)
• Manually granting permissions may fail or be restricted
• Scripts to automatically grant permissions fail if the OS does not recognize the permission for the app’s target SDK

• Confirm the app’s target SDK version and the OS version of the devices.
• Ensure the manifest declares all required runtime and legacy permissions.
• Explicitly request runtime permissions at app launch, if needed.
• Regularly review permission changes introduced in newer Android versions to keep apps compatible.

To resolve runtime permission issues for any app, follow these detailed steps:

Step 1: Identify the problematic permission

• Determine which permission is not being granted (e.g., BLUETOOTH_CONNECT, CAMERA, LOCATION).

• Check whether it is a runtime permission or a normal/legacy permission.

• Confirm the Android OS version of the device(s) where the issue occurs.

Step 2: Verify app target SDK

• Extract the app’s APK and check targetSdkVersion in AndroidManifest.xml.

• Compare the target SDK with the minimum SDK required for the permission.

• If the app targets a lower SDK than required, the OS may ignore the permission, causing MobiControl to be unable to auto-grant it.

Step 3: Review AndroidManifest.xml

• Open the app’s AndroidManifest.xml file and check:

  • All required runtime permissions are declared.

  • Any legacy permissions (e.g., BLUETOOTH, BLUETOOTH_ADMIN) are included for backward compatibility.

  • Permissions are using maxSdkVersion where necessary for older OS support.

  • If the permission requires additional supporting permissions (e.g., LOCATION for scanning), ensure they are included.

Step 4: Update the app if needed

• Increase targetSdkVersion to meet or exceed the SDK level required by the permission.

• Ensure all runtime permissions are declared in the manifest.

• Retain legacy permissions for backward compatibility.

• Add any additional supporting permissions required for proper functionality.

Step 5: Implement runtime permission requests

• For runtime permissions, ensure the app explicitly requests the permission at runtime when it launches or before performing related functionality.

• Manually granting permissions may work temporarily but is often blocked by OS restrictions.
• Scripts such as afw_set_permission_grant_state may fail if the app targets a lower SDK version than required.
• The most reliable solution is to update the app’s manifest and target SDK version.

• Runtime permissions were introduced in different Android versions, depending on the permission.
• Target SDK alignment is critical for permission auto-grant functionality.
• Apps targeting lower SDK versions may operate in compatibility mode and fail to request newer permissions correctly.