Package

com.google.android.apps.work.clouddpc

Device Policy

Play Store APKMirror Web search

19device profiles

56observations

51user-facing hits

28 Jul 2026last seen

Guidance

Disable with caution verified 4 Jun 2026

Android Device Policy - Google's enterprise management agent. It is a common preload on newer devices as part of the Google Mobile Services app suite, but it is an optional component rather than a guaranteed one; where it is not already present it is fetched from Google Play when required. It is the ongoing management agent, not just an enrolment-time component - once active it continues to receive and enforce policy for the life of the deployment. It plays two related roles: 1. As the Device Policy Controller (DPC) for the Android Management API (AMAPI): when an organisation manages devices through AMAPI, Android Device Policy is installed during enrolment and becomes the device owner or profile owner, then receives and enforces policy. 2. As the Device Policy Management Role holder on GMS devices: once present, it holds the platform role android.app.role.DEVICE_POLICY_MANAGEMENT, so the AOSP managed-provisioning framework delegates the provisioning flow to it. These two jobs are separable. The role holder runs the setup flow regardless of which EMM ultimately manages the device: on a device enrolled with a third-party EMM, that EMM's own agent becomes the device owner / DPC while Android Device Policy can still hold the role and run provisioning. (Verified on a Pixel running Android 17, where the device owner was a third-party DPC yet clouddpc held the DEVICE_POLICY_MANAGEMENT role.) For an AMAPI enrolment the same package does both jobs. On a device actively managed via AMAPI it must not be disabled - that is the management agent. On other devices it is the provisioning role holder; removing it is not advisable.

Note by

Package intelligence

Observed signing, permission, version and size signals from contributing devices - descriptive of that sample, not a verdict. These come from the v2 Package Search sync, which not every device has contributed to yet, so for some packages this detail is partial or not present at all.

signing certs

OEM-forked / varies

permissions

largest set observed

14.1 MB – 15.0 MB

APK size

36 – 37

target SDK

149.81.4 (10572820) → 162.26.1 (10787540)

versions observed

device profiles

Signed by Google's own signing key (the same key Google uses across devices), so it is a Google-provided preinstall that updates independently of the system image, though 2 different Google signing keys appear across the fleet.
Its largest observed manifest declares 82 permissions: 9 runtime (user-granted), 42 signature or system-level, 24 install-time and 7 vendor or uncatalogued. The signature/system share marks it as a privileged component, not an ordinary app.
Reported as an updated system app on 39 of 9 profiles - a newer build is installed over the one in the system image there.

Declared permissions (82)

Largest permission set observed for this package. Text is Android's own published description where one exists; platform permissions Android does not document show their granted protection level (in grey) instead; vendor or unknown constants show the name only.

Permission	Description
`ACCESS_BACKGROUND_LOCATION`	This app can access location at any time, even while the app is not in use.
`ACCESS_COARSE_LOCATION`	This app can get your approximate location from location services while the app is in use. Location services for your device must be turned on for the app to get location.
`ACCESS_FINE_LOCATION`	This app can get your precise location from location services while the app is in use. Location services for your device must be turned on for the app to get location. This may increase battery usage.
`ACCESS_NETWORK_STATE`	Allows the app to view information about network connections such as which networks exist and are connected.
`ACCESS_PDB_STATE`	Signature-level system permission, for platform-signed apps.
`ACCESS_WIFI_STATE`	Allows the app to view information about Wi-Fi networking, such as whether Wi-Fi is enabled and name of connected Wi-Fi devices.
`AUTHENTICATE_ACCOUNTS`	Install-time permission, granted automatically. docs ↗
`BIND_DEVICE_ADMIN`	Signature-level system permission, for platform-signed apps. docs ↗
`CALL_PHONE`	Allows the app to call phone numbers without your intervention. This may result in unexpected charges or calls. Note that this doesn't allow the app to call emergency numbers. Malicious apps may cost you money by making calls without your confirmation, or dial carrier codes which cause incoming calls to be automatically forwarded to another number.
`CAMERA`	This app can take pictures and record videos using the camera while the app is in use.
`CHANGE_COMPONENT_ENABLED_STATE`	Signature or privileged system permission.
`CHANGE_CONFIGURATION`	Signature or privileged system permission.
`CHANGE_WIFI_STATE`	Allows the app to connect to and disconnect from Wi-Fi access points and to make changes to device configuration for Wi-Fi networks.
`CONFIGURE_INTERACT_ACROSS_PROFILES`	Signature-level system permission, for platform-signed apps.
`COPY_ACCOUNTS`	Signature-level system permission, for platform-signed apps.
`CRYPT_KEEPER`	Signature or privileged system permission.
`DELETE_PACKAGES`	Signature or privileged system permission.
`DOWNLOAD_WITHOUT_NOTIFICATION`	-
`FOREGROUND_SERVICE`	Allows the app to make use of foreground services.
`FOREGROUND_SERVICE_DATA_SYNC`	Allows the app to make use of foreground services with the type "dataSync"
`FOREGROUND_SERVICE_SYSTEM_EXEMPTED`	Allows the app to make use of foreground services with the type "systemExempted"
`GET_ACCOUNTS`	Allows the app to get the list of accounts known by the phone. This may include any accounts created by applications you have installed.
`GET_PACKAGE_SIZE`	Allows the app to retrieve its code, data, and cache sizes
`HIDE_OVERLAY_WINDOWS`	This app can request that the system hides overlays originating from apps from being shown on top of it.
`INSTALL_DPC_PACKAGES`	Signature-level system permission, for platform-signed apps.
`INTERACT_ACROSS_USERS`	Signature or privileged system permission.
`INTERACT_ACROSS_USERS_FULL`	Signature-level system permission, for platform-signed apps.
`INTERNET`	Allows the app to create network sockets and use custom network protocols. The browser and other applications provide means to send data to the internet, so this permission is not required to send data to the internet.
`KILL_BACKGROUND_PROCESSES`	Allows the app to end background processes of other apps. This may cause other apps to stop running.
`MANAGE_ACCOUNTS`	Install-time permission, granted automatically. docs ↗
`MANAGE_APP_OPS_MODES`	Signature-level system permission, for platform-signed apps.
`MANAGE_DEFAULT_APPLICATIONS`	Signature-level system permission, for platform-signed apps.
`MANAGE_DEVICE_ADMINS`	Signature-level system permission, for platform-signed apps.
`MANAGE_DEVICE_POLICY_ACROSS_USERS`	Internal platform permission, granted only by the system.
`MANAGE_DEVICE_POLICY_APPS_CONTROL`	Internal platform permission, granted only by the system.
`MANAGE_DEVICE_POLICY_APP_EXEMPTIONS`	Internal platform permission, granted only by the system.
`MANAGE_DEVICE_POLICY_CERTIFICATES`	Internal platform permission, granted only by the system.
`MANAGE_DEVICE_POLICY_DEVELOPER_OPTIONS`	-
`MANAGE_DEVICE_POLICY_ORGANIZATION_IDENTITY`	Internal platform permission, granted only by the system.
`MANAGE_DEVICE_POLICY_PACKAGE_STATE`	Internal platform permission, granted only by the system.
`MANAGE_DEVICE_POLICY_QUERY_SYSTEM_UPDATES`	Internal platform permission, granted only by the system.
`MANAGE_DEVICE_POLICY_RUNTIME_PERMISSIONS`	Internal platform permission, granted only by the system.
`MANAGE_DEVICE_POLICY_SAFE_BOOT`	Internal platform permission, granted only by the system.
`MANAGE_PROFILE_AND_DEVICE_OWNERS`	Allows apps to set the profile owners and the device owner.
`MANAGE_USERS`	Signature or privileged system permission.
`MARK_DEVICE_ORGANIZATION_OWNED`	Signature-level system permission, for platform-signed apps.
`MASTER_CLEAR`	Signature or privileged system permission.
`NETWORK_MANAGED_PROVISIONING`	Signature-level system permission, for platform-signed apps.
`NFC`	Allows the app to communicate with Near Field Communication (NFC) tags, cards, and readers.
`PEERS_MAC_ADDRESS`	Signature-level system permission, for platform-signed apps.
`PERFORM_CDMA_PROVISIONING`	Signature or privileged system permission.
`POST_NOTIFICATIONS`	Allows the app to show notifications
`QUERY_ALL_PACKAGES`	Allows an app to see all installed packages.
`QUERY_USERS`	Signature or privileged system permission.
`READ_PHONE_NUMBERS`	Allows the app to access the phone numbers of the device.
`READ_PHONE_STATE`	Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.
`READ_PRIVILEGED_PHONE_STATE`	Signature or privileged system permission. docs ↗
`READ_SYNC_SETTINGS`	Allows the app to read the sync settings for an account. For example, this can determine whether the People app is synced with an account.
`READ_SYNC_STATS`	Allows an app to read the sync stats for an account, including the history of sync events and how much data is synced.
`RECEIVE_BOOT_COMPLETED`	Allows the app to have itself started as soon as the system has finished booting. This can make it take longer to start the phone and allow the app to slow down the overall phone by always running.
`REMOVE_ACCOUNTS`	Signature-level system permission, for platform-signed apps.
`REORDER_TASKS`	Allows the app to move tasks to the foreground and background. The app may do this without your input.
`REQUEST_PASSWORD_COMPLEXITY`	Allows the app to learn the screen lock complexity level (high, medium, low or none), which indicates the possible range of length and type of the screen lock. The app can also suggest to users that they update the screen lock to a certain level but users can freely ignore and navigate away. Note that the screen lock is not stored in plaintext so the app does not know the exact password.
`RUN_USER_INITIATED_JOBS`	Install-time permission, granted automatically. docs ↗
`SET_TIME`	Signature or privileged system permission.
`SET_TIME_ZONE`	Allows the app to change the phone's time zone.
`SET_WALLPAPER`	Allows the app to set the system wallpaper.
`SHUTDOWN`	Signature or privileged system permission.
`START_ACTIVITIES_FROM_BACKGROUND`	Signature or privileged system permission. docs ↗
`START_FOREGROUND_SERVICES_FROM_BACKGROUND`	Signature or privileged system permission.
`TRIGGER_LOST_MODE`	Signature-level system permission, for platform-signed apps.
`USE_COLORIZED_NOTIFICATIONS`	Signature-level system permission, for platform-signed apps.
`USE_CREDENTIALS`	Install-time permission, granted automatically.
`WAKE_LOCK`	Allows the app to prevent the phone from going to sleep.
`WRITE_SECURE_SETTINGS`	Signature or privileged system permission.
`WRITE_SETTINGS`	Allows the app to modify the system's settings data. Malicious apps may corrupt your system's configuration.
`WRITE_SYNC_SETTINGS`	Allows an app to modify the sync settings for an account. For example, this can be used to enable sync of the People app with an account.
`com.android.permission.INSTALL_EXISTING_PACKAGES`	-
`com.android.vending.setup.PLAY_SETUP_SERVICE`	-
`com.google.android.c2dm.permission.RECEIVE`	-
`com.google.android.providers.gsf.permission.READ_GSERVICES`	-
`com.google.android.setupwizard.SETUP_COMPAT_SERVICE`	-

Manage on devices

ADB commands for this package (the inverse of each is included so you can undo). Run from an authorised shell or wire the equivalent into your DPC. Verify on a test device first - this database doesn’t yet classify which packages are safe to change. --user 0 targets the current user; drop it (and use a privileged shell) to act device-wide.

Disable for the current user

adb shell pm disable-user --user 0 com.google.android.apps.work.clouddpc

Remove for the current user - a per-user uninstall; the APK stays on /system, so Restore re-adds it (-k keeps app data)

adb shell pm uninstall -k --user 0 com.google.android.apps.work.clouddpc

Re-enable

adb shell pm enable com.google.android.apps.work.clouddpc

Restore (re-install for the current user)

adb shell pm install-existing com.google.android.apps.work.clouddpc

Seen on

Each record is a device profile (make + model + Android version). Each unique handset that syncs against a matching profile will increase the observations of a package, thereby increasing confidence that a package is expected to be on a device.

OEM	Model	Android	Provenance	Observations	Last seen
Google	Pixel 10 Pro	Android 16	Google	1 1 user-facing	26 Mar 2026
Google	Pixel 10 Pro	Android 17	Google	1 1 user-facing	26 Jul 2026
Google	Pixel 6	Android 12	-	1 1 user-facing	22 Jun 2025
Google	Pixel 6	Android 16	-	1 1 user-facing	13 Oct 2025
Google	Pixel 6 Pro	Android 15	-	9 7 user-facing	23 Jun 2025
Google	Pixel 7	Android 13	Google	1 1 user-facing	19 Feb 2026
Google	Pixel 7 Pro	Android 16	Google	1 1 user-facing	9 Mar 2026
Google	Pixel 8	Android 16	-	4 4 user-facing	3 Jun 2026
Google	Pixel 8a	Android 15	-	1 1 user-facing	5 Oct 2025
Google	Pixel 9 Pro XL	Android 16	Google	21 20 user-facing	29 Mar 2026
Google	Pixel 9 Pro XL	Android 17	Google	2 2 user-facing	28 Jul 2026
Google	Pixel 9a	Android 15	-	1 1 user-facing	15 Jun 2025
Google	Pixel 9a	Android 16	Google	6 6 user-facing	2 Jun 2026
Google	Pixel 9a	Android 17	-	1 1 user-facing	16 Jul 2026
Motorola	motorola edge 50 fusion	Android 16	Google	1 1 user-facing	10 Jun 2026
OnePlus	CPH2653	Android 16	-	1	24 Nov 2025
Rhino	C10	Android 10	-	1 1 user-facing	14 Jul 2025
Rhino	T8	Android 14	-	1	17 May 2025
Smt_hk	OV2219	Android 12L	Google	1 1 user-facing	16 Feb 2026

Known labels

Locale-aware display names seen in the wild.