Google Android 17 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub.

It may be possible to transfer work profile data on a DoW Android device to an unauthorized Chromebook if the user has the same Google account set up on the Chromebook and in the work profile on the Android device. This may result in the exposure of sensitive DoW data.

SFR ID: FMT_MOF_EXT.1.2 #47

Review the EMM configuration to confirm Phone Hub has been disabled.

On the management tool:

1. Open "Nearby notification streaming policy". 2. Verify that "Nearby notification streaming policy" is set to "Disabled". 3. Open "Nearby app streaming policy". 4. Verify that "Nearby app streaming policy" is set to "Disabled".

If on the management tool the "Nearby Streaming Policy" is not set to "Disabled" and "Nearby app streaming policy" is not set to "Disabled", this is a finding.

Note: From a Chromebook, if a device is connected to the Phone Hub, try to set up the notifications. It will fail to connect to the device to complete the setup if Phone Hub has been disabled on the DoW Android device.

Configure the Google Android 17 device to disable the nearby notification streaming policy to disable Phone Hub.

On the EMM console:

COBO and COPE:

1. Open "Nearby notification streaming policy". 2. Set "Nearby notification streaming policy" to "Disabled". 3. Open "Nearby app streaming policy". 4. Set "Nearby app streaming policy" to "Disabled".

Configuration API: setNearbyNotificationStreamingPolicy to NEARBY_STREAMING_DISABLED