Establish and enforce enterprise account security requirements (e.g., two-factor authentication, password complexity, account lockout policy);

Define the handling method when a device fails security compliance checks (e.g., lock the device, restore factory settings);

Specify the default management policy for new devices joining the platform, reducing initial configuration workload;

Control certain global business rules and system switches (e.g., device naming rules, KC app configuration, approval process toggles).

The configurations in this module apply to all users and devices within the enterprise.

Only users with Enterprise Administrator permissions can access and modify System Settings.

Configuration changes take effect immediately. It is recommended to adjust settings during off-peak business hours.

Before enterprise go-live, administrators preset account and password policies in System Settings to ensure all newly created accounts meet security standards;

For store or business terminal devices, define “Restore Factory Settings” in Compliance Settings as the handling method for non-compliance to prevent misuse;

During bulk device deployment, automatically bind management policies via the Default Device Policy to reduce manual assignment workload;

Maintain consistent asset naming through device naming rules, facilitating later maintenance and statistical analysis.

This is a global configuration and takes effect immediately for all users in the organization.

Currently, only email is supported for sending verification codes.

It is recommended to set the OTP input frequency according to the security level required:

Enabling 2FA may increase login steps for users, so inform them in advance.

Disabling 2FA lowers account security and should be done with caution.

When Inactive Accounts is enabled, accounts that have not logged in for the set number of days will be automatically disabled.

Session expiration and concurrent session limits apply only to Web Console logins.

Once enabled, the policy applies to all users in the organization.

Login failure handling options include Send alert email or Temporarily lock account.

The console access whitelist only allows specified IP addresses to access the admin console. It is recommended to open access only to fixed office networks.

This is a global setting and applies to all accounts in the organization.

The minimum password length should be at least 8 characters.

The required number of special and numeric characters should be adjusted according to security needs.

Number of previous passwords that cannot be reused prevents frequent reuse of old passwords.

Minimum password change interval (days) is recommended to be 30 days or more in high-security environments.

The day values for Disable Device and Factory Reset Device must not exceed 30 days.

The Factory Reset Device day value must be greater than the Disable Device day value.

To configure immediate action, set the corresponding days to 0 (meaning no waiting, immediate execution).

Modifications take effect immediately for newly detected non-compliance events but will not affect events already in progress.

For KMA devices, parameters are synced to the device in real time.

For GMA devices, parameters are sent to the device during the next policy update.

Default GMA Device Policy: Uses global configurations, including modules such as Password, Restrictions, Wi-Fi, and more.

Default KMA Device Policy: Supports preset configurations for selected modules (e.g., System Settings, Permission Settings, Custom Wallpaper).

Once saved, the default device policy will apply immediately to newly enrolled devices.

Impact on existing devices:

The default policy is a global configuration; if a device or group already has an assigned policy, that policy will take priority.

Enabling the Prompt User Before Applying option will display a confirmation prompt when modifying or applying the policy to prevent accidental changes.

This rule only applies when the device is first registered on the platform; it will not batch update names of existing devices.

Supported delimiters: -, ., _.

Supported sequence types: Auto-increment Number, SN, IMEI, Wi-Fi MAC Address.

The naming format will be previewed in real time during configuration to confirm it meets requirements.

This configuration applies to all devices under the enterprise that have the KiwiCloud Application installed.

Settings take effect immediately after saving.

Higher frequency settings may increase device power consumption and data usage.

Location reporting frequency options: 15 minutes, 30 minutes, 1 hour, 2 hours.

Disabling the approval flow does not skip approval steps — they are automatically approved by the system instead.

You can control approval flow independently for different task types: Device Policy, App Library, App Release Policy, Kiosk Policy, File Distribution Policy.

It is recommended to keep approval flow enabled in high-security environments to prevent accidental changes.