How can we help?

CORE MDM turns an Android phone into a managed phone you control from your browser. It has three parts:

• The CORE MDM app on the phone, which applies your rules.
• The console at coremdm.org/console, where you change settings and send commands.
• This website, with the installer, help and organization pages.

The app runs as device owner, the highest level of control Android gives an app. Android itself enforces the rules, so the person using the phone can't just switch them off, restart into safe mode, or reset the phone to escape them.

When you flip a switch in the console, the phone picks it up within seconds. Rules already applied keep working when the phone is offline, and commands sent to an offline phone wait until it reconnects.

Both methods give the same result: CORE MDM installed and set as device owner. Open the installer and pick one.

1. Factory reset the phone, or remove every account under Settings › Accounts. If you reset, skip Google sign-in during setup.
2. Turn on developer options: Settings › About phone, then tap Build number 7 times.
3. Turn on USB debugging in Settings › System › Developer options.
4. Connect the phone with a USB cable. If ADB is installed on your computer, close it first by running adb kill-server.
5. On the install page, press Connect phone, choose the phone in the browser popup, then tap Allow on the phone's “Allow USB debugging?” prompt.
6. Press Install and set device owner. The page checks for accounts, installs the latest version and makes it device owner. Watch the Log box for progress.

1. Factory reset the phone, or start with a new one. Stay on the first Welcome screen.
2. Tap the same blank spot on the Welcome screen 6 times. A QR scanner opens. (On Android 7 and 8 it first connects to Wi-Fi to download the scanner.)
3. Optional: on the install page, enter your Wi-Fi name, security type and password so the phone connects by itself. These stay in your browser.
4. Scan the code. The phone downloads CORE MDM and sets it as device owner; this takes a minute or two.
5. Accept the prompts saying the phone will be managed, then finish setup.

Open CORE MDM and sign in with email and password, or tap Continue with Google. New here? Tap New here? Create an account. Signing in adds the phone to your account and starts CORE MDM's background service.

If someone gave you an enrollment token, paste it in the box that appears and tap Verify & Enroll. Otherwise tap Skip; signing in is all you need.

Before any settings appear, the app asks you to choose a PIN. It must be at least 4 digits (the console can raise this to 6 or 8).

• The app locks itself every time it leaves the screen or the screen turns off.
• Wrong guesses make you wait: 30 seconds after 3 tries, 1 minute after 5, 2 minutes after 7, 5 minutes after 10.

Go to coremdm.org/console and sign in with the same email and password you used on the phone. Your phone appears within seconds. Click Manage → to control it.

If a school, charity, group or company gave you a join code, open the Organization tile in the app, choose Join an organization, type the code and tap Find organization. Confirm on the next screen. Joining means:

• The organization's admins can set rules on this phone, including some you can't change.
• Its name, logo and message appear on the CORE MDM lock screen.
• Only its admins can take the phone out again.

If CORE MDM was installed like a normal app, it runs as a device admin only. Lock, wipe, alarm, messages, rename and the app list still work. Blocking and hiding apps, the enforced PIN, reboot, kiosk mode, starting the filter remotely and most restrictions need device owner.

The top of the app's home screen shows which you have: Device Owner — Protected, Admin Active — Not Device Owner, or Device Admin Not Active. To upgrade, remove the phone's accounts and use the installer.

The top row counts Total devices, Online, Offline and Alarming. Each phone has a card showing:

• Name and model, Android version, and IMEI and serial (device owner phones).
• Badges: ONLINE or OFFLINE, ALARM while the alarm sounds, PENDING while a command waits, and the organization's name if it belongs to one.
• Chips showing what's on, such as “WhatsApp off”, “Social off”, “3 sections”, “2 timed” or “Remote-only”. “Nothing blocked” means no restrictions are set.
• Last seen. A phone counts as online if it checked in within the last 5 minutes.
• Sound Alarm and Manage → buttons.

Use the search box to find a phone by name, model, IMEI or serial.

Manage → opens the phone's panel. You can rename the phone from its header. The search box (“Search all settings”) finds any setting across every tab, even by everyday words like “tether” or “screenshot”.

A switch shows what's currently set on the phone. On phones in an organization you may see:

• “Default from <org> — you can change it”: the organization chose a starting value; you can change it for this phone.
• “🔒 Locked by <org>”: the switch is greyed out. Only the organization's admins can change it.

A yellow banner means something must be switched on at the phone, such as “Screen guard is off on this phone” or “Usage access is off on this phone”. Follow its instructions.

If Remote-only mode is on, a banner says the app on the phone is locked, with a Turn off button.

Plays the phone's alarm tone on a loop until you press Stop Alarm. Great for finding a lost phone nearby.

• Instant, not queued. The card shows a pulsing ALARM badge while it sounds.
• It plays at the phone's alarm volume, so a phone with alarm volume at zero may be quiet.
• Also available on every device card, and from the phone app's Remote Control screen.
• Works without device owner.

Turns the screen off and locks it immediately, like pressing the power button.

Restarts the phone. It's offline for about a minute. Useful to clear a stuck state. Needs Android 7 or newer. The phone can't get stuck restarting over and over.

Turns on 13 restrictions in one step. Use it for a lost or stolen phone.

• Blocks safe mode, factory reset, USB debugging and adding users.
• Blocks installing, uninstalling and sideloading apps.
• Locks Wi-Fi, Bluetooth and mobile network settings.
• Disables the pull-down status bar, screenshots and the camera.

Factory resets the phone, erasing all apps, accounts, photos and files on the phone. An SD card is not erased. Found on the Commands tab and the Danger tab; a red confirmation appears first.

Shows a full-screen alert on the phone, on top of everything and even over the lock screen. The person taps to close it.

• Title: up to 80 characters (default “Message from Administrator”).
• Message: up to 500 characters.

Examples: “Come home for dinner”, or a contact number on a lost phone. A message to an offline phone appears when it reconnects.

While a command waits, its button shows a spinner and “pending… tap to cancel”, and the card shows a PENDING badge. Messages appear in the Queued for the phone list with a Cancel button. Once the phone picks a command up, it can't be cancelled.

Both keep the app's data and are fully reversible.

Pauses WhatsApp and WhatsApp Business, and blocks whatsapp.com, whatsapp.net and wa.me.

Apps paused: Instagram, Instagram Lite, Threads, Facebook, Facebook Lite, Messenger, Messenger Lite, TikTok, Snapchat, X (Twitter), Reddit, Pinterest, Tumblr, LinkedIn, Discord, BeReal, YouTube, YouTube Music, Telegram, Viber and LINE.

Sites blocked (with the content filter on): instagram.com, threads.net, facebook.com, messenger.com, tiktok.com, snapchat.com, x.com, twitter.com, reddit.com, pinterest.com, tumblr.com, linkedin.com, discord.com, bereal.com, youtube.com, telegram.org, viber.com, line.me and their image and video servers.

Apps paused: ChatGPT, Claude, Gemini, Microsoft Copilot, Bing, Perplexity, DeepSeek, Grok, Jasper, Character.AI, Replika, Luzia and Poe.

Sites blocked (with the content filter on): chatgpt.com, openai.com, claude.ai, gemini.google.com, copilot.microsoft.com, perplexity.ai, deepseek.com, grok.com, character.ai, poe.com, replika.com, you.com and more.

Turns off the part of Android that apps use to show web pages inside themselves. Web pages stop loading inside every app at once.

Close one section of an app while the rest keeps working. Needs the screen guard.

When a blocked section opens, CORE MDM presses Back and shows a short note, “<section> is blocked”. It may flash for a moment first. Nothing on screen is recorded or sent.

The screen guard is CORE MDM's accessibility service. It powers parts of apps and web pages inside apps. Android requires a person to switch it on by hand:

1. On the phone, open CORE MDM › Screen Guard.
2. Tap Open Accessibility settings.
3. Choose CORE MDM and switch it on. Return to the app; it shows “Screen guard is on”.

On device owner phones, CORE MDM then stops it being switched off from Settings.

The Installed apps list shows every app on the phone. The phone refreshes it every 30 minutes and whenever an app is installed or removed. Use Search apps… to find one.

• Hide button: confirm, and the app disappears from the home screen. Press Hidden to bring it back.
• Switch: blocks (pauses) the app. Turn it off to let it open again.

Tags: SYSTEM (part of Android; blocking these can break the phone), BLOCKED BY RULE (paused by a quick block; turn that off to release it), HIDDEN.

1. Open the Time limits tab.
2. Under Add a limit, find the app and type the minutes per day (0–1440). It saves when you click away.
3. The app moves to Daily allowances, showing “X of Y min used today”.

Edit the number to change it, or press ✕ to remove it.

• Android counts the time since midnight, however the app was opened.
• Within a minute of running out, the app is paused and the console shows PAUSED TODAY.
• After midnight (phone's time) it's released and the count restarts.
• An app you blocked separately stays blocked.
• The console's “used today” figure updates about every 30 minutes.

Time limits and the app usage report need Android's usage access permission. Android won't let an app grant this to itself, so do it once on the phone:

1. Open CORE MDM › Time Limits and tap Turn on.
2. Find CORE MDM in the list and allow it.

Until then, the console shows “Usage access is off on this phone”.

A blocker that runs on the phone itself. It checks every website the phone tries to reach against your block lists. Blocked sites show “site can't be reached”. It covers every app and browser, on Wi-Fi and mobile data, and your browsing doesn't go through any outside server.

Turning it on

• Device owner phones: flip Enable Content Filter on the Internet tab; it starts with no tap on the phone. It then stays on permanently: Android restarts it at boot, the person can't switch it off, Private DNS is locked, and CORE MDM can't be uninstalled while it runs.
• Other phones: someone must approve Android's VPN prompt once on the phone.

Block subdomains too (on by default): blocking example.com also blocks www.example.com, m.example.com and so on.

Built-in blocklist (on by default): major social media sites, video streaming (YouTube, Netflix, Hulu, Twitch, Vimeo, Dailymotion) and major adult sites.

Extra lists, each on unless you switch it off.

Extra group, off unless switched on: Google Maps images & YouTube blocks map photos, Street View, Google image hosts and YouTube videos. Gmail and Play Store images and YouTube thumbnails disappear too.

• Always blocked sites: type a site such as example.com and press + Add or Enter. Press ✕ on it to remove.
• Always allowed sites: never blocked, even if a list includes them. The best way to fix one site without turning off a whole group.

Filter DNS server: where allowed lookups are sent. Empty means 1.1.1.1 (Cloudflare). You can enter another, like 1.1.1.3 (Cloudflare family) or 8.8.8.8 (Google), then press Save.

Import a blocklist: paste the web address of a hosts file or a one-site-per-line list and press Save. The phone downloads it and blocks everything in it. Clear the box and save to remove it.

Forces the phone's Private DNS to a filtering service and locks the setting. Type a host and press Lock DNS; press Clear to remove it. Needs Android 9 or newer.

Turn on Only allow the apps I choose, then tick the apps allowed to show web pages inside themselves. Any other app that opens a web page has it closed. This stops links in chat apps and games from being a back door to the web.

Normal browsers aren't affected; hide them with Hide Browsers. Needs the screen guard.

Every internet request on the phone gets an error, so apps and browsers can't reach anything. Calls and texts still work, and CORE MDM itself stays connected so you can turn it off. It switches off the content filter while on.

Kiosk mode keeps the phone inside one app; the person can't leave or reach the home screen. Under Kiosk Allowed Packages, type an app's package name (such as com.example.app, shown in the Apps list) and press + Add.

1. Turn on Only chosen apps can install apps. Apps already on the phone stay.
2. Under Apps allowed to install apps, switch on each app that may install others. For the Play Store, pick Google Play Store. CORE MDM is always allowed.
3. From then on, any app that arrives another way (another store, a file manager, a browser download) is removed straight away.

Updates to apps already on the phone aren't affected.

These stop the phone's Settings app from being used to undo your rules.

Choose 4, 6 or 8 digits. This requires the phone's own screen lock to be a number PIN at least that long (Android asks the person to set a new one if theirs is too short), and sets the same minimum for the CORE MDM app PIN.

Turn on Location tracking and the phone reports where it is about every 5 minutes. The console shows the position, how accurate it is, when it was taken, and a map.

• On device owner phones, location permission is granted automatically. Otherwise allow it on the phone (CORE MDM › Location & Tracking).
• The first position takes about 5 minutes; until then the console says “No location yet”.
• It uses a little extra battery.
• Tell the person who carries the phone that location is on.

1. Enter the Latitude and Longitude of the centre. Tip: long-press a spot in Google Maps to copy its coordinates.
2. Set the Radius in metres (at least 50, default 200). 150–500 m suits a home or school.
3. Choose When it leaves: Lock the phone, Sound the alarm, or Show a message (your text, or “This phone has left the allowed area”).
4. Press Turn on geofence. The circle appears on the map.

• It reacts to leaving, not entering.
• After it fires, it waits 10 minutes before it can fire again.
• Turn on location tracking too, for the most reliable results.

Daily screen-time window (Usable from / Locks at) and Scheduled lockdown (Unlock at / Lock at) both lock the phone's screen at the lock time every day.

App usage (last 24 h) lists the 15 most-used apps with their time. It updates every 15 minutes and needs usage access.

On the Danger tab, press Remove device. The phone disappears from your list, and next time it's online CORE MDM signs out. Rules already on the phone stay until someone signs in again. Use this to move a phone to another account.

Phones in an organization show “🔒 This phone belongs to <org>”; only its admin can remove them.

On the phone, open CORE MDM › Danger Zone › Remove MDM and enter the PIN. CORE MDM shows every hidden app again, lifts every restriction, gives up device owner and uninstalls itself. The phone's data is kept.

Organizations are set up by the CORE MDM team, who name an owner by email. The owner signs in at coremdm.org/org. Open your organization to see five tabs: Lock screen, Rules, Phones, Join code and Admins.

Each of 44 settings can be set for the whole organization:

Choose Default or Locked first, then set it on or off. Tip: lock only what must never change (content filter, Prevent Factory Reset, Protect MDM from Uninstall) and use Default for the rest.

Set a name, a logo (shrunk to 256 px, under 200 KB) and a message such as “Property of … — if found please call …”. A preview shows the result. It appears on every member phone's CORE MDM lock screen.

The join code is 8 letters and digits, with no easily confused characters (no 0, O, 1, I or L). Make a new code stops the old one immediately; phones already in stay in.

The Phones tab lists each phone's name, model and last-online time, with Remove from organization. The organization can't see apps, location or activity.

On the Admins tab, add a person by email. They sign in on the organization page with that email and can change the lock screen, rules and join code, and remove phones. Only the owner can add or remove admins.

Below: Quick Actions (Lock Now, Reboot), App Settings (theme, PIN, rename device) and the Danger Zone. The magnifier searches every setting.

• Private DNS presets: one tap for AdGuard, Cloudflare Security, Cloudflare Family or CleanBrowsing.
• Restore all in App Manager: un-hides and un-pauses every app at once (apps blocked by a quick block stay blocked).
• Remote Control: sound or stop the alarm on any phone on your account; a ringing phone shows SOUNDING.
• Change or remove the PIN: App Settings › App PIN Lock. A removed PIN must be set again next time the app opens.
• Theme: Light, Dark or Auto.
• Work profile: if the phone can't be device owner, CORE MDM can manage a separate work profile instead, with much less control.

• A permanent notification, “Remote monitoring active”, while CORE MDM runs. Management is never hidden.
• The PIN screen whenever the app opens, with the organization's branding if the phone joined one.
• “Managed remotely” when remote-only mode is on.
• Full-screen messages you send.
• Paused apps greyed out, hidden apps gone, and a short “… is blocked” note when a section closes.

Any Android phone from any brand running Android 8.0 or newer, including Samsung, Pixel, Motorola and Xiaomi.

Not if you block it. As device owner, CORE MDM can block uninstalling, factory reset, safe mode and USB debugging. You remove it with Remove MDM in the app.

There's no PIN recovery. The console keeps working without the PIN, so manage the phone from there.

Only to receive changes. Rules already applied keep working offline, and commands wait until it reconnects.

Only the account signed in on them. If a phone joins an organization, its admins see the phone's name, model and last-online time.

No. It manages what a phone can do. The filter checks site names on the phone and keeps no history. Location is collected only when you turn on tracking or a geofence. See the Privacy Policy.

The app checks for new versions about every 6 hours and installs them itself. It only installs a newer version of the same app signed by the same developer.