How to Configure App Pinning, Multi-User Guest Profiles, and Device Ownership Policies on Android

Architectural Foundation of Android Multi-User Profiles and UID Isolation

The Android operating system enforces multi-tenancy and runtime sandboxing at the Linux kernel boundary. While desktop operating systems map multiple users to distinct Posix user accounts with shared shared memory segments, Android calculates process execution boundaries using a mathematical derivation of User IDs (UIDs). In Android’s architecture, a user account is assigned an integer multiplier (UserHandle.PER_USER_RANGE = 100000). When an application (e.g., Application ID 10045) executes under the primary system user (User 0), its Linux UID is 10045; under Secondary User 10, the identical package executes under UID 1010045.

This strict kernel separation guarantees that cryptographic keystores, isolated storage volumes (/data/user/<user_id>/), internal databases, and background execution services remain entirely inaccessible across user spaces. Android layers three distinct security boundaries across this architectural foundation: transient App Pinning, ephemeral Guest Sessions, and fully managed Device Owner policies deployed via the Android Management API or Android Debug Bridge (ADB).

Isolation Mechanism	Kernel / Framework Boundary	Storage Lifecycle	Network & Hardware Access	Administrative Control
App Pinning	ActivityTaskManager.startLockTask()	Shared with active primary user	Standard permissions of pinned application	Biometric or passcode unpinning challenge
Guest Profile	FLAG_EPHEMERAL / UserManager	Isolated; completely purged on session exit	Separate telephony/SMS toggles; shared Wi-Fi	Owner can reset or wipe session dynamically
Secondary User	Persistent AID_USER namespace	Encrypted per-user storage directory	Independent Google account, apps, and files	Owner manages call/SMS access and user deletion
Device Owner (DO)	DevicePolicyManager (Root MDM)	Tenant-wide policy enforcement	Complete control over all users, radios, and USB	Hardware-bound enterprise provisioning

Configuring and Enforcing App Pinning

App Pinning (historically termed Screen Pinning) locks the mobile interface to a single foreground task. While pinned, the user cannot access notifications, view incoming message previews, switch to secondary applications, or navigate to home screens without biometric or passcode authentication.

Step 1: Enable App Pinning in System Settings

1. Open Settings on your Android device.
2. Navigate to Security & privacy > More security settings (or Advanced).
3. Select App pinning.
4. Toggle the service to On.
5. Crucially, ensure the toggle labelled Ask for PIN before unpinning is enabled. Without this directive active, any user can bypass the pinning lock by performing navigation gestures.

Step 2: Activating the Pin on a Foreground Application

1. Open the application intended for sandboxed interaction (e.g., Google Maps for navigation or Chrome for temporary web browsing).
2. Access the Overview / Recent Apps switcher (swipe up from the bottom edge and hold, or tap the square navigation icon).
3. Tap the application icon located directly above the application preview window.
4. From the contextual menu, tap Pin (represented by a pushpin icon).
5. Android displays a system confirmation dialogue. Tap Got it. The application is now locked in foreground execution.

Step 3: Unpinning and Authentication

To release the foreground lock:

• Gesture Navigation: Swipe up from the bottom of the screen and hold continuously.
• 3-Button Navigation: Press and hold both the Back and Home buttons simultaneously.

The operating system instantly suspends the application, locks the screen, and prompts for the primary user’s biometric fingerprint or PIN code before granting interface access.

Deploying and Administering Ephemeral Guest Profiles

When sharing a device for extended periods, Guest Profiles provide an isolated, ephemeral sandbox that shields personal photographs, application sessions, authentication tokens, and browsing histories from inspection.

Step 1: Initialise Multiple Users

1. Navigate to Settings > System > Multiple users.
2. Toggle Allow multiple users to On.
3. Select Add guest (or tap the Guest avatar icon in the quick settings shade).
4. Tap Switch to Guest. Android initialises a clean user sandbox under /data/user/10/ with pristine system application states.

Step 2: Restrict Telephony and SMS Communications

By default, Guest accounts cannot originate telephone calls or transmit SMS text messages. To audit or toggle these hardware communication privileges:

1. From the primary user account, navigate to Settings > System > Multiple users.
2. Tap the gear settings icon situated adjacent to Guest.
3. Toggle Turn on phone calls according to organizational security parameters.

Step 3: Purging Ephemeral Session Data

When the guest returns the hardware, the session must be purged to reclaim flash storage and erase transient credentials:

• Swipe down twice from the top of the display to access Quick Settings.
• Tap the User avatar icon and select Remove guest (or End session).
• Confirm deletion. Android unmounts the ephemeral storage block, invokes cryptographic key erasure on the user’s file-based encryption (FBE) keys, and zeroes the directory blocks.

Enforcing Enterprise Device Owner Policies via ADB

For dedicated corporate devices, kiosks, and high-security terminals, the DevicePolicyManager framework provides complete programmatic control over user creation, application installation, hardware features, and USB peripherals. Provisioning a Device Owner requires configuring an unmanaged device immediately following a factory reset.

Step 1: Prepare the Device for Management

1. Perform a factory data reset on the Android hardware.
2. Proceed through the initial setup wizard without adding a Google Account.
3. Navigate to Settings > About phone and tap Build number seven consecutive times to unlock Developer options.
4. Under Developer options, toggle USB debugging to On.

Step 2: Assign the Device Owner Component via ADB

Connect the Android device to an administrative workstation with the Android SDK Platform-Tools installed. Execute the following terminal commands to register a custom policy controller (e.g., Test DPC or an enterprise EMM agent):

# Verify device connectivity and ADB authorization
adb devices

# Install the Device Policy Controller (DPC) package
adb install TestDPC.apk

# Designate the DPC as the system Device Owner
adb shell dpm set-device-owner com.afwsamples.testdpc/.DeviceAdminReceiver

# Confirm active Device Owner status
adb shell dumpsys device_policy | grep "Device Owner"

Step 3: Enforcing Kiosk and User Restrictions Programmatically

Once Device Owner status is active, administrators can push system-level policies that prevent user switching, enforce persistent App Pinning (Lock Task Mode), or disable USB file transfers:

# Disallow multi-user creation across the operating system
adb shell cmd user set-user-restriction --user 0 no_add_user 1

# Prevent factory data reset by unauthorized personnel
adb shell cmd user set-user-restriction --user 0 no_factory_reset 1

# Disable USB data transfers and MTP mounting
adb shell cmd user set-user-restriction --user 0 no_usb_file_transfer 1

Troubleshooting Multi-User and App Pinning Faults

Observed Issue	Root Cause	Technical Diagnostic Method	Remediation Protocol
Pin Option Missing in Overview	App Pinning disabled in Settings or third-party launcher active	Inspect Settings > Security > App pinning; verify default home app	Enable App Pinning; switch to the native stock system launcher (e.g., Pixel Launcher)
Unpinning Does Not Prompt for PIN	“Ask for PIN before unpinning” toggle is disabled in system preferences	Check App Pinning configuration toggles	Enable the PIN verification toggle; ensure a secure lock screen PIN/passcode is set
Device Owner ADB Command Fails	Pre-existing accounts (Google, WhatsApp, email) or multiple users present on device	Terminal returns java.lang.IllegalStateException: Not allowed to set the device owner	Remove all user accounts under Settings > Passwords & accounts or execute a full factory reset
Guest Session Consumes Internal Storage	User files or cached media retained across unmanaged guest sessions	Inspect storage usage breakdown in Settings > Storage	Select “Start over” when switching to Guest or purge user directory via pm remove-user
Biometrics Unavailable in Work Profile	Enterprise policy restricts biometric authentication for managed keystore	Inspect EMM console or review DevicePolicyManager.KEYGUARD_DISABLE_FINGERPRINT	Update corporate DPC policy to authorise biometric unlock tokens for secondary profiles