Through your EMM's policy, using the screenCaptureDisabled setting. When enabled, the platform applies FLAG_SECURE behaviour to all windows belonging to the managed user, which blocks screenshots, screen recording, screen sharing to non-secure displays, and blanks the Recents (recent apps) thumbnail for affected apps.
| Blocked | Detail |
|---|---|
| User screenshots | Hardware button combo (Power + Volume Down) and gesture-based capture |
| Screen recording | Built-in screen recorder and third-party recording apps |
| Recents thumbnails | App previews in the recent apps overview appear blank |
| Screen sharing / casting | Mirroring to Chromecast, external displays, or video conferencing screen-share |
| Circle to Search | Gesture-triggered AI search that reads on-screen content |
| Assist structure | Context data passed to assistant apps (Android 6.0+) |
| Not blocked | Why |
|---|---|
| Physical camera | A user can photograph the screen with another device. Screen capture restrictions are a software control, not a physical one |
| Root-level capture tools | On a rooted or compromised device, tools with elevated privileges can circumvent FLAG_SECURE. This is outside the threat model for most enterprise deployments |
On modern Android, adb shell screencap returns black pixels for windows protected by FLAG_SECURE. Standard ADB does not bypass the restriction. Some EMM remote view implementations use device-level services that may also respect or bypass the flag depending on implementation - check with your EMM vendor.
AMAPI exposes two screenCaptureDisabled fields depending on the scope:
Work/managed scope - set screenCaptureDisabled: true at the top level of the policy. This blocks screen capture for all apps in the managed profile or on the fully managed device.
Personal scope (COPE only) - set personalUsagePolicies.screenCaptureDisabled: true to block screen capture for personal-side apps on a company-owned device with a work profile. This is one of the few controls that reaches into the personal profile on COPE.
{
"screenCaptureDisabled": true,
"personalUsagePolicies": {
"screenCaptureDisabled": true
}
}Custom DPCs call DevicePolicyManager.setScreenCaptureDisabled(), available since API 21 (Android 5.0). The method takes a boolean and applies to the calling admin's user scope.
From Android 6.0, this method also blocks the assist structure from being collected when an app belonging to the affected user is in the foreground - meaning assistant services cannot read on-screen content.
| Scenario | Effect of screenCaptureDisabled |
|---|---|
| Fully managed | Blocks capture device-wide. All apps are affected |
| Dedicated (kiosk) | Same as fully managed. Particularly relevant for devices displaying sensitive information in public-facing kiosks |
| COPE | Work scope: blocks capture only when a work app is in the foreground. Personal scope: requires personalUsagePolicies.screenCaptureDisabled separately. Both must be set for full device coverage |
| BYOD (work profile) | Blocks capture only when a work app is in the foreground. The user can still screenshot personal apps freely. The EMM has no control over the personal side |
On COPE devices, setting only screenCaptureDisabled: true blocks capture for work apps but not personal apps. A user can still screenshot personal apps or anything visible on the personal side. To block capture across the entire device, set both the top-level screenCaptureDisabled and personalUsagePolicies.screenCaptureDisabled to true.
If the goal is to prevent AI-driven screen reading (Circle to Search, assistant context) without preventing users from taking screenshots, use assistContentPolicy (Android 15+) instead of screenCaptureDisabled. This controls whether AssistContent - screenshots and app information - can be sent to privileged assistant apps, while leaving user-initiated screenshot and screen recording functionality available.
This distinction matters for organisations that want to restrict data leakage through AI assistants but still allow users to capture their own screens for legitimate purposes like bug reporting or sharing non-sensitive content.
For a broader overview of controlling AI features on managed devices, see How do I manage generative AI apps and features on managed devices?.
Screen capture restrictions are one layer of a broader data loss prevention strategy. Related controls include:
DISALLOW_BLUETOOTH_SHARING user restriction prevents sharing files via BluetoothDISALLOW_OUTGOING_BEAM blocked NFC sharing on earlier versionsNo single setting covers all data exfiltration paths. Evaluate which controls are appropriate for your risk profile rather than enabling everything - overly aggressive restrictions degrade the user experience without proportional security benefit.
requestBugreport()).adb screencap respects FLAG_SECURE on modern Android, USB debugging opens other data exfiltration paths (adb pull, adb backup). Disable it using usbDataAccess in AMAPI or the DISALLOW_DEBUGGING_FEATURES user restriction.