MobixMDMPermissions & Data Safety
Last updated: 13 June 2026
MobixMDM is a Device Owner (Android Enterprise) management client. This page documents every sensitive permission it requests, the reason, and the corresponding data-safety disclosure. See also our Privacy Policy.
Sensitive & restricted permissions
| Permission | Why it is used |
|---|---|
BIND_ACCESSIBILITY_SERVICE | Remote support & screen sharing requested by IT admins (view/act on the screen to troubleshoot). Only purpose; never used for advertising or unrelated data collection. |
FOREGROUND_SERVICE_MEDIA_PROJECTION | Capture the screen during an authorized remote-support session. |
ACCESS_FINE/COARSE_LOCATION, ACCESS_BACKGROUND_LOCATION | Required by Android to read the connected Wi-Fi SSID for connectivity diagnostics; optional asset tracking of company-owned devices when enabled by the organization. |
FOREGROUND_SERVICE (+ _LOCATION, _DATA_SYNC, _SPECIAL_USE) | Persistent guard service that keeps policies enforced and collects telemetry. Special-use subtype declared: "Enforcement of MDM kiosk mode and continuous device telemetry collection." |
QUERY_ALL_PACKAGES | Build the installed-apps inventory, enforce the kiosk allow-list and verify app-deployment state. Use case: device management / enterprise. |
READ_PHONE_STATE | Read the hardware serial / device identifiers to uniquely identify the managed device. |
RECEIVE_BOOT_COMPLETED | Restart the management/guard service after a reboot so policies remain enforced. |
POST_NOTIFICATIONS | Show the mandatory foreground-service notification and management status. |
SYSTEM_ALERT_WINDOW | Display kiosk overlays / lockdown UI on top of other apps. |
| Bluetooth / Wi-Fi state | Apply network restrictions and report connectivity in the console. |
Device Owner capabilities
As a Device Owner, MobixMDM manages the device through Android's official DevicePolicyManager APIs (install/uninstall via PackageInstaller, lock, reboot, wipe, restrictions). These are granted by the enrollment, not by sensitive runtime permissions.
Data Safety summary
- Data collected: device identifiers, device diagnostics (battery, storage, performance), app inventory, approximate & precise location, and — during support sessions only — screen content.
- Data shared: none with third parties. Data goes only to the self-hosted server operated by the managing organization.
- Encryption in transit: yes (TLS) + per-device HMAC-SHA256 signing.
- Purpose: device management, security and IT support only. No advertising, no profiling, no resale.
- Account / deletion: managed by the organization (data controller); see the Privacy Policy.
Prominent disclosure
On first launch and during enrollment, users are informed that the device is managed and that location, app inventory and remote-support features may be used by their organization, before these features operate.