Detection of Device Administrator Permissions

ID: DET0630
Domains: Mobile
Analytics: AN1701
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1701

The user is prompted for approval when an application requests device administrator permissions.
Application vetting services can check for the string BIND_DEVICE_ADMIN in the application’s manifest. This indicates it can prompt the user for device administrator permissions.
The user can see which applications are registered as device administrators in the device settings.

Log Sources
Data Component Name Channel
Permissions Request (DC0116) User Interface None
Permissions Requests (DC0114) Application Vetting None
System Settings (DC0118) User Interface None