Samsung Android 7: Your IT Admin has restricted access to the app - Phone or com.android.phone is Blocked

[anonymousmigrat]

I know there is already a post with a similar title.  However, to assist other Airwatch Admins who may run into this, I figured I'd put key pieces of info in the title for a quicker and easier find.

If you've setup a Launcher profile on a Samsung phone with Android 7 and the 'Call Screen' portion of your Phone app is being blocked, please do read on.  For good measure, I'll mention that you will most likely be able to open the initial portion of the Phone app -- dialer, contacts, etc.  You will however, most likely be blocked and receive the ' Your IT Admin has restricted access to the app - Phone'  when you try to place the call.

The following application package IDs need to be added to an Airwatch Launcher payload as either a miscellaneous app on the home screen or under hidden apps.  To confirm, this seems to be on Samsung phones with Android 7 Nougat.  Earlier versions of Android must've had different package IDs for the phone app and related components.

- com.android.phone
- com.android.server.telecom
- com.android.incallui
- com.samsung.android.incallui
- com.android.incallui.incallactivity

I had a couple of them but not all.

Also, just for second good measure, if you click on the Launcher settings gear (the down arrow, same arrow as if you were to log into the Launcher as an Admin), and go to Blacklisted Apps -- this will show every app and hopefully package ID that is blocked when you receive a ' Your IT Admin has restricted access to the app - xxxx'  message.

[VegardAarseth]

Thanks

[JTaylor800]

Thank you, this was just what I was looking for.

[JPresson]

Thank you. I was having similar issue but it did allow the outbound call.  It would not however allow the device to request that the call be disconnected.

[mccannjg]

Thank you! I was trying to add the ones showing up in blacklisted list but it didn't work. Then I found your post...added the extras et voila

+1 to you!

[TSonny]

Hi Jalmy S. This is a good article. Shame that Airwatch hasn't included this steps part for their implementation for each customer.

[teckler]

Excellent, I'm glad I found this!

[DmitryKurdenkov]

Hi everyone.

Similar problem. Two differences. First - Android 9. Second - no any prompt, that something has been restricted by administrator, you just can not answer incoming call and you can not do anything during outgoing call (but you can make a call using phone app, that is allowed in launcher).

Only com.samsung.android.incallui in hidden apps brought calling interface back. But! No popup calling interface. During incoming call you need to open notification center, tap on incoming call, than you can tap answer. On lock screen you have no chance to answer.

I have added to hidden apps:

com.android.phone

- com.android.server.telecom

- com.android.incallui

- com.samsung.android.incallui

- com.android.incallui.incallactivity

And as far as nothing is blocked, i see nothing in Blacklisted Apps.

[DmitryKurdenkov]

Solved.

First, I forgot to place an emphasis, i have work managed android for enterprise devices.

Second, it’s enough to add just com.samsung.android.incallui in hidden apps. No other ids take any affect.

And the third, while it’s AFE, you need to add custom xml section in your launcher profile. This activates notification permission for launcher.

“<characteristic

          type="com.airwatch.android.androidwork.launcher"

          uuid="568bc89d-1df8-4ce9-a041-e5a24acdb7ab"><parm name="SkipCosuSetup" value="True"/><parm name="AllowNotificationPermission"

        value="True"/><parm name="AllowStatusBar" value="True"/></characteristic>“

[nigelsnowspark]

Hi,

Just an update to this thread. I also had to add the com.samsung.android.dialer as a hidden application or the users could not use the phone dialler after a reboot - seemed ok with the launcher prfile first assigned but did not persist over a reboot. Work Manged devices, Android 10, Samsung.

So,

Hidden apps

com.samsung.android.dialer

com.samsung.android.incallui

Custom setting

<characteristic  type="com.airwatch.android.androidwork.launcher" uuid="568bc89d-1df8-4ce9-a041-e5a24acdb7ec"><parm name="SkipCosuSetup" value="True"/></characteristic>

<characteristic type="com.airwatch.android.androidwork.launcher" uuid="568bc89d-1df8-4ce9-a041-e5a24acdb7ec"><parm name="SkipUsageAccessPermission" value="True"/></characteristic>