Quick Accuracy Check
The setup instruction is correct with one important clarification: Shared-device idle timeout and Sign out on lock are currently saved in policy but automatic enforcement is not implemented yet. They are safe to configure for future behavior, but admins should not expect automatic timeout or lock-triggered logout in the current build.
The crucial access rule is correct: a user must belong to a group whose assigned policy has Shared devices enabled. A normal tenant account from an unrelated group must be rejected.
1. Create or Choose a Shared-Device Policy
In the admin app, open the policy editor and go to Standard Policy. Enable shared devices in the Shared devices section.
Recommended first setup:
- Shared devices: on
- Require sign-in before launcher: on
- Shared-device idle timeout: 30, stored for future automatic timeout behavior
- Sign out on lock: off for the first test; this value is stored, but automatic lock sign-out is not active yet
- Public packages: keep the default 3S EMM agent package
- Cleanup packages: leave empty for the first test
- Preserve packages: leave empty for the first test
2. Assign That Policy to a Shared-Device Group
Create a group for the device pool, for example Warehouse Shared Phones or Prokiosk. Assign the shared-device policy to this group.
Put the physical shared devices into this group. These are the devices that should boot or return to the 3S EMM Shared Device sign-in screen.
3. Allow Users by Group Policy
Create or choose the user groups that should be allowed to sign in on shared devices.
Crucial requirement: the policy assigned to the allowed user's group must also have Shared devices enabled. A user is not allowed to sign in to shared-device mode only because they exist in the tenant.
This protects the device pool from unrelated company users. Members of non-shared groups should be rejected even if their email and password are valid.
4. Push Policy to the Device
Push or sync the policy to the device. Once the agent applies the policy successfully, the command result should include:
{
"enabled": true,
"session": "signed_out",
"home_lock": "shared_sign_in",
"shared_launcher_enabled": true,
"require_sign_in_before_launcher": true
}On the physical device, pressing the Home button should show the 3S EMM Shared Device sign-in screen.
5. Test Sign-In and Sign-Out
Check an allowed user
Use a tenant user who belongs to a shared-device-enabled group. Sign in with that user's email and password. The device should apply that user's group policy and open the normal launcher or kiosk experience.
Check sign-out
Sign out from the shared-device screen. The device should clear the local shared session, restore the original shared-device group, and return to the sign-in screen.
Check access denial
Test a user from a non-shared group. That user should be rejected by the backend. This verifies that unrelated group members cannot gain access simply by having a company account.
What Each Value Means
- Shared devices: turns shared-device mode on for this policy.
- Require sign-in before launcher: makes the sign-in screen the HOME target while no user session is active.
- Shared-device idle timeout: planned automatic timeout value; stored now, enforcement later.
- Sign out on lock: planned lock-triggered sign-out flag; stored now, enforcement later.
- Public packages: packages considered safe in signed-out state. Keep the 3S EMM agent package here.
- Cleanup packages: comma-separated app package names whose data should be cleared on explicit sign-out.
- Preserve packages: packages that must not be cleared during cleanup.
Current Limitations
- 3S EMM shared devices do not create Android secondary users.
- Automatic idle timeout is not implemented yet.
- Automatic sign-out on lock is not implemented yet.
- PIN, fingerprint, face sign-in, and credential autofill are not implemented yet.
- App data isolation depends on app behavior or configured cleanup packages.
Reference Slides
