Grant runtime permissions

With Knox v3.0, we've introduced selective permissions, so that you can declare only the permissions that your app uses. This topic shows how to declare these permissions, and also how to handle app permissions dynamically at runtime as opposed to all at once when the application is installed.

Selective permissions allow you to show a simple pop-up upon installation. Here, only the necessary permissions to run your app are presented to the use instead of the entire Knox Permission set inherited by your KPE from older Knox versions. These permissions are what you include in you Android manifest.

If you choose to use the Selective Knox Permission feature, the Knox system only grants your app access to the permissions you declared in your Android manifest.

Declare permissions

Paste the following code in the MainActivity() to provide runtime permission to the app to install shortcut.

private void grantPermissions() {

        List<String> runtimePermissions = new ArrayList<>();
        // PermissionsTODO Add permssions to be used by your application
        // Instantiate the EnterpriseDeviceManager class
        EnterpriseDeviceManager enterpriseDeviceManager = EnterpriseDeviceManager.getInstance(this);
        // Get the ApplicationPolicy class where the applyRuntimePermissions method lives
        ApplicationPolicy applicationPolicy = enterpriseDeviceManager.getApplicationPolicy();

        AppIdentity appIdentity = new AppIdentity(getApplicationContext().getPackageName(), null);
        try {
            // Grant runtime permissions to list of permissions provided
            int ret = applicationPolicy.applyRuntimePermissions(appIdentity, runtimePermissions,
            if (ret == 0) {

                for (String permission : runtimePermissions) {
                    mUtils.log(getResources().getString(R.string.permissions_granted, permission));

            } else {

        } catch (Exception e) {
            mUtils.processException(e, TAG);

The Selective permissions meta-tag is optional for all types of licenses, (ELM,KLM, KPE).

  • If your app doesn’t declare the meta tag, it will get all permissions by default.
  • If your app declares the meta tag, it will get and display only the selected permissions.

Note – the license key is stored in constantsfile. Copy this over from the sample app or create your own.

Tutorial Progress

You are 5/8 done! Go to the next step.