Update device restrictions for Android Enterprise

intune/app-management/configuration/configure-managed-home-screen.md

@@ -1,7 +1,7 @@
 ---
 title: Configure the Microsoft Managed Home Screen App
 description: Learn how to configure the Microsoft Managed Home Screen app.
-ms.date: 03/09/2026
+ms.date: 04/21/2026
 ms.topic: how-to
 ms.reviewer: abigailstein
 ms.collection:
@@ -23,6 +23,10 @@ Typically, if settings are available to you through device configuration profile
 
 If using App configuration, navigate to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and select **Apps** > **Configuration**. Add a configuration policy for **Managed devices** running **Android** and choose **Managed Home Screen** as the associated app. Select **Configuration settings** to configure the different available Managed Home Screen settings.
 
+In many environments, the Managed Home Screen app configuration policy and a device configuration restrictions policy work together. The Managed Home Screen app provides a controlled user experience but doesn't block access to all Android system features. The security and integrity of a kiosk configuration depends on the Managed Home Screen settings described in this article and the [device configuration restrictions](../../device-configuration/templates/ref-device-restrictions-android-enterprise.md) applied to the device.
+
+Administrators should review and configure device restriction settings to ensure end users can't access system settings, modify network or security configuration, or perform actions such as a device reset. For a list of restrictions that you can configure, see [Android template device settings list to restrict features using Intune](../../device-configuration/templates/ref-device-restrictions-android-enterprise.md).
+
 ## Choosing a configuration settings format
 
 There are two methods that you can use to define configuration settings for Managed Home Screen:

intune/device-configuration/templates/ref-device-restrictions-android-enterprise.md

@@ -1,7 +1,7 @@
 ---
 title: Device restriction settings for Android in Microsoft Intune
 description: On Android Enterprise or Android for Work devices owned by your organization, you can restrict settings on the device using Microsoft Intune. Allow copy and paste, notifications, app permissions, data sharing, password length, sign in failures, use fingerprint to unlock, reuse passwords, and enable bluetooth sharing of work contacts. Configure devices as a dedicated device kiosk to run one app, or multiple apps.
-ms.date: 09/17/2025
+ms.date: 04/21/2026
 ms.topic: reference
 params:
   siblings_only: true
@@ -193,8 +193,11 @@ For corporate-owned devices with a work profile, some settings only apply in the
   - **Not configured** (default): Intune doesn't change or update this setting. By default, the OS might disable the device home and overview buttons.
   - **Home button only**: Users can see and select the home button. They can't see or select the overview buttons.
   - **Home and overview buttons**: Users can see and select the home and overview buttons.
-
-    When a device is enrolled and using the Managed Home Screen app, enabling the **Overview** button allows end users to skip or ignore the sign in and session PIN screens. The screens are still shown, but users can ignore them, and aren't required to enter anything.
+
+    > [!IMPORTANT]
+    > When a device is enrolled and using the Managed Home Screen app, enabling the **Overview** button allows end users to skip or ignore the sign in and session PIN screens.
+    >
+    > If the **Overview** button is enabled and the **End-user access to device settings** setting isn't set to **Block**, users can access the Android system settings without device authentication. This behavior can allow network changes, security configuration changes, or a full device reset. So if you enable the **Overview** button, set the **End-user access to device settings** setting to **Block** to prevent accessing the Settings app.
 
   This setting applies to: