Salesforce Docs Portal

Enhanced Mobile App Security Policies for Mobile Publisher

Review the security policies and severity levels that are supported on Mobile Publisher for Experience Cloud apps.

Required Editions

Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions

For each security policy that you activate, you set a level. Each severity level represents the action that your app automatically takes when the security policy is violated.

Note
Note In Setup for Mobile Publisher, you can customize the colors and fonts of the app screens associated with each policy and level. However, the text within the alerts isn't customizable. Also, Android app builds with Enhanced Security enabled fail if you have also enabled Automatic Protection in the Google Play Console environment.
Severity Level Actions Enforced
critical Wipes app data and logs user out
error Blocks access to the app until the issue is resolved, but doesn’t log user out
warn Notifies the user of the violation and recommends how to resolve, but user is able to continue using the app
info Blocks prohibited action or logs user action and informs user

When you enable Enhanced Mobile App Security, you can activate these security policies for your Mobile Publisher for Experience Cloud app.

Note
Note When you enable Enhanced Mobile App Security, you also enable code obfuscation for an Android app and string obfuscation for an iOS app. Code or string obfuscation protects your app from reverse engineering. You don’t need to activate a separate policy in Mobile Security to enable code or string obfuscation.
Policy Name Description Severity Level
Block Jailbroken Device A jailbroken or rooted mobile device can access system files to install unapproved apps or to modify settings.

Severity:

  • critical
  • error
  • warn
Block Man In The Middle Attack

A man-in-the-middle attack allows attackers to secretly intercept communications between two systems, client and server.

This policy relies on network connectivity. If a user’s device has low connectivity or the device is in airplane mode without an internet connection, the policy can get triggered.

To use this policy on Android apps, we recommend that your app requests permission to the device’s coarse and fine locations. The property on Android that detects man-in-the-middle attacks can detect if a user has changed locations or Wi-Fi networks.

Severity:

  • critical
  • error
  • warn
Minimum OS Version Specify the minimum operating system (OS) version your user’s mobile device must meet.

The number of the minimum OS version.

Severity:

  • critical
  • error
  • warn

Example: 11.9
Maximum OS Version Specify the maximum operating system (OS) version your user's mobile device can’t exceed.

Severity:

  • critical
  • error
  • warn

Example: 12.1.9
Log Out User After Changing Biometric Login Data (iOS only) Biometric login uses facial or fingerprint recognition to unlock devices and apps.

Severity: info

Blocked Device List A device blocklist is a list of devices that a user is blocked from using. Specify blocked devices as a semicolon separated list.

Severity:

  • critical
  • error
  • warn

Examples:

  • iPhone11,8 (blocks iPhone XR)
  • Google (blocks all Google devices)
Allowed Device List A device allowlist is a list of devices that a user can use. Specify allowed devices as a semicolon separated list.

Severity:

  • critical
  • error
  • warn

Examples:

  • iPhone11,8 (allows iPhone XR)
Block Contacts (iOS only) Block access to contacts on a user's device.

Severity: info

Block Calendar (iOS only) Block calendar access on a user’s device.

Severity: info

Minimum Security Patch Version (Android only) A security patch helps protect a user’s mobile device from vulnerabilities. Specify the required minimum security patch version.

The date of the minimum security patch version.

Severity:

  • critical
  • error
  • warn

Example: 2027-05-18
Log Out User After Device Restart Specify if you want to log out a user after a device restart.

Severity: info

Maximum Days Offline Without Policy Refresh (Android only) We perform a security policy refresh when a user opens the app. Specify the maximum number of days a user can go without a security policy refresh.

Severity:

  • critical
  • error
  • warn

Example: 30
Log Security Policy Evaluation Result A security policy evaluation assesses whether users are meeting security requirements. Log the results of a security policy evaluation.

Severity: info