Every application installed on a device requests access to something: the camera, the microphone, the location, the contact list, the file system, the network. On a personal smartphone, these requests are shown to the user who decides whether to grant or deny them. On a managed business device, leaving permission decisions to individual users, or to default settings that grant broad access by default, creates both security exposure and operational inconsistency.
App permission management through MDM addresses this directly. Instead of relying on user decisions or application defaults, the organization’s IT or security team defines exactly which permissions each application is allowed on managed devices, applies those policies through the MDM platform, and enforces them consistently across every enrolled device in the fleet. The result is a permission environment that reflects the organization’s security and compliance requirements rather than whatever each application requests and each user accepts.
Understanding how this works, why it matters for different device categories, and how Moki’s platform implements permission control across iOS and Android helps organizations build a more defensible and consistent managed device environment.
Why App Permissions Matter on Managed Business Devices
On a personal device, an application’s permission request is a negotiation between the user and the app developer. The user decides whether the convenience or functionality the permission enables is worth the access it grants. On a managed business device, particularly a customer-facing kiosk or POS terminal, this calculus is entirely different.
A payment application on a kiosk that has camera access it never needs is a camera that could, under certain threat scenarios, be used to capture customer payment card information or facial images. A retail inventory application on an employee tablet that has location access beyond what its function requires is creating unnecessary location data retention that may have privacy compliance implications. A digital signage application that has unrestricted file system access when it only needs to read a specific media folder is creating broader attack surface than the application’s function warrants.
The principle of least privilege, granting each application only the permissions it actually needs for its intended function and nothing more, is a foundational security practice that app permission management through MDM implements at scale. On a fleet of 200 kiosks, configuring each device’s permissions individually is not practical. Through MDM, the permission policy is defined once and enforced automatically on every enrolled device.
How Permission Management Works on Android
On Android devices enrolled through Android Enterprise, Moki’s MDM platform provides granular control over application runtime permissions through the managed configuration framework.
Permissions on Android fall into two categories: install-time permissions, which are granted automatically when the application is installed, and runtime permissions, which the application requests while it is running. MDM control over runtime permissions allows the organization to pre-grant, permanently deny, or require user approval for each permission for each application without requiring any interaction at the device.
Pre-granting permissions is the appropriate approach for permissions that the application legitimately needs for its business function and where requiring user approval every time the permission is needed would interrupt the workflow. A barcode scanning application on a warehouse handheld device needs camera access to function. Pre-granting this permission through the MDM profile means the application can use the camera without prompting the user, which is the correct operational behavior for a purpose-built scanner.
Permanently denying permissions is the appropriate approach for permissions that an application does not need for its intended function on a managed device. A payment application that requests microphone access for a function it will not be used for in the business context should have microphone access denied through the MDM profile. The application cannot request it again because the denial is enforced at the device management layer rather than by the user.
How Permission Management Works on iOS
On iOS devices managed through Moki with Apple’s supervised mode, permission management works through supervised restrictions and managed app configuration. Apple’s permission framework is more restrictive about MDM-level permission control than Android’s, but supervised mode provides meaningful capabilities.
For supervised iOS devices, Moki can restrict access to specific device features, including camera, microphone, and location services, at the device level rather than the application level. This is a broader control than Android’s per-application permission management, but it provides a clear and reliable way to ensure that features not needed for the device’s intended use case are not accessible.
For devices in Single App Mode, the application is also constrained by what the kiosk mode configuration allows, which provides an additional permission control layer beyond the iOS permission system itself. An application running in Single App Mode cannot access device features that the mode restricts, regardless of what permissions it has been granted.
Permission Management for Specific Device Categories
The permission policies appropriate for a device depend on what the device does and what data it handles. Different device categories warrant different permission configurations.
Customer-facing kiosks in public environments should have the most restrictive permission profiles. Camera access should be denied unless the application specifically requires it for a customer-facing function such as a QR code scanner or check-in process. Location access should be denied unless the application’s function requires it. Microphone access should be denied. File system access should be limited to the application’s own data directory. These restrictions reduce the attack surface for devices that are in publicly accessible locations and minimize the potential for any application behavior that could expose customer data.
POS terminals handling payment data have compliance-driven permission requirements. PCI-DSS controls require that payment applications are isolated from unnecessary device capabilities that could create data leakage paths. Camera and microphone restrictions, combined with Moki’s kiosk lockdown, create a payment environment where the application operates with only the access it needs for the transaction and nothing beyond.
Employee tablets used for business applications in non-kiosk mode warrant a more nuanced permission approach. Applications may legitimately need permissions that would be denied on a customer-facing device, such as location access for delivery tracking or camera access for documentation. The MDM permission policy for employee devices should be based on the specific application set and the least-privilege principle applied to each application’s actual functional needs rather than a blanket restriction profile.
Building the Permission Policy
Defining the right permission policy for each device type and application combination requires knowing what each application actually needs to function versus what it requests by default. The application documentation and vendor communication are the starting points, but testing the application with restricted permissions in a staging environment confirms whether a restriction affects function or only denies access that the application requested but does not use.
Moki’s support team and the certified partner ecosystem can assist with permission policy development for common application and device type combinations encountered in dedicated device deployments.
Once defined, permission policies are applied through device configuration profiles in Moki and pushed to all devices in the relevant group. Compliance monitoring confirms that the permission state on enrolled devices matches the intended policy and surfaces any devices where the policy is not correctly applied.
Permission Management as Part of the Security Stack
App permission management does not stand alone as a security control. It is one layer in a comprehensive managed device security approach that includes kiosk mode lockdown to restrict device navigation, device encryption to protect data at rest, zero trust network access principles to limit device connectivity, and remote wipe capability as the final backstop for devices that are compromised or lost.
Together these controls create a managed device environment where the attack surface is minimized at every layer: the device cannot be navigated outside the intended application, the data on it is encrypted, the network access is restricted, and the application itself has only the device access it needs for its function.
Schedule a Moki demo to see how permission management and the broader security configuration work together in the platform, or start a free trial to begin building permission policies for your device types. Moki’s features page covers the full scope of device security and access control capabilities.