V-284714

Discussion

Multiuser mode allows multiple users to share a mobile device by providing a degree of separation between user data. To date, no mobile device with multiuser mode features meets DoW requirements for access control, data separation, and nonrepudiation for user accounts. In addition, the MDFPP does not include design requirements for multiuser account services. Disabling multiuser mode mitigates the risk of not meeting DoW multiuser account security policies. SFR ID: FMT_SMF_EXT.1.1 #47

Check Content

Review documentation on the managed Google Android 17 device and inspect the configuration on the Google Android device to disable multiuser modes.

This validation procedure is performed on both the EMM administration console and the managed Google Android 17 device. 

On the EMM console:

COBO and COPE: 

1. Open "User restrictions".
2. Open "Set user restrictions".
3. Verify that "Disallow modify accounts" is toggled to "ON".

On the managed Google Android 17 device:

COBO and COPE:

1. Go to Settings >> Accounts and backup.
2. Tap "Add account" (work profile).
3. Verify that the action is not allowed.

If the EMM console device policy is not set to disable multiuser modes, or on the managed Google Android 17 device the device policy is not set to disable multiuser modes, this is a finding.