Zebra's GMS Restricted Mode

Zebra’s GMS Restricted Mode is a device state that provides complete control over which GMS applications and services are available on a Zebra device. Activating this mode disables all Google applications and services that are part of Google Mobile Services, providing improved control over data privacy.

In practice, this means that many applications on a GMS Restricted device are disabled, including Google Chrome, the Play Store app, YouTube, Gmail, Google Maps, Photos, etc. Any applications that depend on Google Play Services in any way can no longer rely on those Play Services being available; Play Services cover a range of functionality, with the most commonly used in enterprise being location, safetynet, maps and Firebase cloud messaging.

Important Notes:

• When location services are disabled, the device is set to “Device Only” location mode when in a restricted state unless otherwise specified as part of a profile.
  • This will have a knock-on effect on applications which request the coarse LOCATION permission and any functionality dependant on that (e.g. the BluetoothDevice.ACTION_FOUND Intent) since coarse location only provides access to the NETWORK_PROVIDER. 
  • Location is available when the Maps profile is enabled.
• Zebra make no guarantees that third-party applications from the Play Store will run under GMS Restricted since the dependencies of these applications on Play Services are unknown.
• Firebase Cloud Messaging (FCM) is used by many third-party applications to provide on-demand notification delivery. Applications that use FCM will no longer receive cloud messages through this framework when GMS Restricted is in effect, unless the corresponding profile is enabled.

• The ability to add or manage users on a device is prevented by GMS Restricted; GMS Restricted is not compabible with any existing Google accounts existing on the device.
• The default Google Package Verifier will not be available in GMS Restricted and is replaced with the Qualcomm package verifier.  Zebra offer many other ways to prevent malicious applications from being sideloaded for example MX Whitelisting via the Access Manager.
• GMS Restricted and Android Multi-User are mutually exclusive features.

In exchange for the absence of Google applications and services, a GMS Restricted device cannot communicate with Google servers for any purpose. This can help alleviate privacy concerns, reduce network bandwidth, and to a lesser degree help reduce the device memory footprint.

001.png 002.png 003.png

Example device experience out of the box

004.png 005.png 006.png

Example device experience after applying GMS Restricted

A device in the GMS Restricted state enforces no limitations on non-GMS applications. Since not all GMS applications are mandatory, the GMS apps on a Zebra device might differ from a consumer smartphone to best suit enterprise use cases. A GMS Restricted device is still able to:

• Run applications that are not part of GMS (on the condition that they do not have dependencies on GMS components).
• Run third party applications (on the condition that they do not have dependencies on GMS components).
• Run Zebra value-add applications built into the device, unless otherwise specified.
• Run Zebra value-add applications that are post-loaded onto the device (for example, Enterprise Browser), unless otherwise specified.
• Make and receive phone calls
• Use a WAN data connection
• Send Zebra analytics (unless disabled) or analytics for third-party applications.  Note that many analytics end points will be hosted by Google infrastructure.

GMS Restricted Profiles

GMS Restricted Profiles allow an administrator to select GMS functionality from a curated list to run on an otherwise restricted device.  For example, by default a GMS Restricted device does not have a browser but by applying the ‘Chrome’ profile you can use the Chrome browser.

Applying a profile will enable the application associated with that profile (if applicable) and any underlying GMS applications or services on which that application depends.  An application’s dependencies may change from Android version to Android version and so a definitive list of those dependencies is not publicly available but by applying GMS Restricted with a profile, you will not have to worry about changes to those dependencies since that is all handled by Zebra’s MX layer.

By enabling a profile, you are opening the possibility for your device to communicate with Google services and the amount of data exchanged with Google services will depend on the profile which has been enabled and the applications therein.  The table below gives an indication of the amount of data exchanged but should be considered as guidance only.

Available profiles:

Additional profiles may be added in the future, please consult the techdocs documentation for GMS Manager for an authoritative list of available profiles.

Important Notes for GMS Restricted Profiles:

• Only the version of the GMS application which ships with the device has been validated in GMS Restricted Mode.  You should not install or update the GMS app from the Play Store prior to applying Restricted Mode.
• Only one profile can be applied at a time and you cannot combine profiles.

Entering GMS Restricted

GMS Restricted is a configuration setting applied to a GMS device; it is not a separate product or OS image.

To activate GMS Restricted on a device using Zebra StageNow:

Related to the functions in GMS Manager are App Manager’s EnableGMSApps and DisableGMSApps actions.  Where possible, the GMS Manager should be used in preference to App Manager.

The GMS Manager’s Restricted action acts immediately to disable all GMS packages except those required to boot the device. When a device is in this state:

• No GMS packages are able run or communicate with Google servers including (but not limited to) the following apps:

•           The Play Store
  • Hangouts
  • Google Photos
  • Google Play Movies
  • Google Maps
  • Google Drive
  • Play Music
  • Gmail
  • Search
  • YouTube
  • Chrome

• • The list of GMS apps can vary from one Android version to another
  • This includes (but is not limited to) the following services:
    • Enhanced location (high-accuracy or battery saving that depends on nearby Wi-Fi access points)
    • Google Play Services
    • Google’s Play Protect
    • Creating unmanaged Google accounts
  • Because enhanced location is not available, the only way for a device to determine its position is through GPS (if it has the appropriate hardware) or through off-device RTLS technologies (unless an appropriate profile is applied).
• Neither built-in GMS applications nor the platform itself can exchange diagnostic data, analytics data or location information with Google.
  • This does not include the Zebra analytics service which can be separately disabled using the Analytics Manager.
• Applications that depend on GMS packages or applications have reduced functionality, notably any application that depends on Google Play Services.
  • Some examples of use cases that are not available on a GMS Restricted device:
    • Applications that use the Google Maps component must find an alternative or enable the Maps profile.
    • Applications that verify the integrity of the device will not be able to use the attestation API.
• The device keyboard is handled as a special case. When GMS Restricted is applied, the GMS keyboard is disabled but alternative keyboards are available on the device. Administrators are free to enable one of the available keyboards using the MX UI Manager Input Method Package Name attribute:
  • For the AOSP keyboard, specify:
    • InputMethodPackageName: com.android.inputmethod.latin
    • InputMethodClassName: com.android.inputmethod.latin.LatinIME
  • For Zebra’s own Enterprise Keyboard, specify:
    • InputMethodPackageName: com.symbol.mxmf.csp.enterprisekeyboard
    • InputMethodClassName: com.android.inputmethod.latin.LatinIME
  • Note: GMS Restricted may default to the AOSP keyboard automatically but in early releases it may be necessary to specify the desired keyboard with the MX UI Manager
• Having a secondary or guest user on the device is not compatible with GMS Restricted; only the primary user is supported. In most instances the user is prevented from creating secondary users when the device is in the GMS Restricted state. Although a Device Owner is still technically capable of creating additional users on a device in the GMS Restricted state, Zebra strongly discourages this practice because GMS Restricted is not in effect for those additional users.

When to Apply

If GMS Restricted state is to be used, Zebra strongly recommends that it be employed as soon as possible after device boot and before establishing a Wi-Fi connection. Before the GMS Restricted Action is applied, the device can communicate with Google, potentially allowing data to “escape.” This can be achieved in StageNow by applying the GMS Restricted Action as one of the first steps in the initial staging profile.

• Set-up wizard bypass barcode is scanned, and automatically launches the StageNow client on the device. This is not required for GMS Restricted but is common to many workflows.
• A staging profile is scanned and performs the following actions:
  1. GMS Restricted is applied using the Restricted Action of GMS Manager CSP or one of the available profiles.
  2. Perform additional staging actions, such as configuring the Wi-Fi network.

If a deployment uses a SIM card that can access a public APN, Zebra recommends that this SIM card be installed after the device is put into a GMS Restricted state to prevent data from leaving the device.

Google Play Services will attempt to install very soon after the device receives a WiFi or data connection, even without a Google account on the device – allowing Play services to install or partially install can in some instances interfere with or disable the default device WebView therefore it is important to apply GMS Restricted at the earliest opportunity.

Moving from AOSP to GMS Restricted

The following applications are present on non-GMS (AOSP) devices but do not have an out-of-box equivalent on a GMS-Restricted device:

• Browser, unless the Chrome profile has been applied
• Email
• Gallery
• Calendar
• Music
• Search