Restricted Settings are Android protections that block an app from enabling sensitive capabilities when it was installed from outside a trusted app store. They are used for permissions such as accessibility access, notification access and device admin functions, limiting abuse of sideloaded or suspicious apps.
How Restricted Settings Works on Android
Restricted Settings is an Android control that raises the bar for risky capability grants on apps installed outside a trusted store. It does not block every sideloaded app, but it forces a stricter path before an app can obtain highly sensitive access such as accessibility services, notification access, or device admin functions.
That design matters because those permissions are often abused as a bridge from initial install to durable control. On a normal app, a user may be prompted into granting access with little context. With restricted settings, Android treats the install source as part of the trust decision and makes certain privileges harder to activate when the app did not come from a vetted channel.
Why It Exists
The core problem is not app installation itself, but the combination of sideloading and powerful capabilities that can observe, intercept, or manipulate the device. Accessibility access can let an app read screen content or automate taps. Notification access can expose one-time codes and alert content. Device admin functions can create persistence and make removal harder.
Restricted Settings is therefore a containment measure for trust boundary abuse. It assumes that an app installed from outside a trusted store deserves less automatic confidence, especially when it asks for permissions that could be used to assist fraud, surveillance, or lock-in of the device.
Common Abuse Patterns
The restriction is especially relevant to mobile fraud and banking malware, where attackers often combine sideloading with overlay abuse, accessibility abuse, and message interception. A malicious app may appear innocuous at install time, then later seek elevated permissions to capture credentials, confirm transactions, or suppress warnings.
That is why Android control guidance around banking trojans and on-device fraud is useful context here. NHI Mgmt Group’s Android Banking Trojans Guide maps the permission abuse and fraud chains that make these settings valuable in practice.
Restricted Settings is not limited to banking malware. Any suspicious app that relies on deceptive permission flows, invisible automation, or persistent device control can be constrained by the same trust model. The practical goal is to reduce the chance that a sideloaded app can quietly turn itself into an operator on the device.
What Users and Defenders Should Understand
For users, the important point is that a blocked permission request is a signal, not an inconvenience to bypass casually. If an app genuinely needs a sensitive capability, the safest answer is usually to obtain it from a trusted distribution path and verify why the permission is necessary.
For defenders, Restricted Settings is only one layer. It helps, but it does not replace app vetting, mobile threat detection, device policy enforcement, or user education about sideloading risk. Security teams should treat repeated attempts to request accessibility, notification, or admin access from non-store apps as a useful indicator of suspicious behaviour.
Risk and Threat Considerations
Restricted Settings addresses a real attack path, because attackers often need one powerful permission to convert a simple install into durable device abuse. If the restriction is bypassed or users are tricked into relaxing it, a sideloaded app can intercept notifications, automate actions, or resist removal.
Failure mechanism: The app is installed from an untrusted source, then attempts to obtain a high-impact permission that gives it visibility, control, or persistence on the device.
Impact: The device can be used for credential theft, transaction manipulation, message interception, or long-lived compromise of user trust and account security.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Sensitive permission grants often depend on secret or session abuse after install. |
| SI-3 — Malicious Code Protection | Restricted Settings helps reduce exposure to sideloaded malware and app abuse. | |
| Recommendation — Manage authenticators and rotate secrets that could be abused after a risky app install. Scan and block suspicious mobile apps before they can request privileged capabilities. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | This control addresses the malware risk pattern that Restricted Settings is meant to suppress. |
| Recommendation — Use malware defenses to detect and quarantine suspicious sideloaded applications. | ||
| NIST CSF 2.0 | PR.AA-05 — Authentication and Access Enforcement | The term is about enforcing access limits on sensitive app capabilities. |
| Recommendation — Enforce access restrictions for apps that seek sensitive device capabilities. | ||
Practitioner Guidance
What to watch for: Focus on apps that request accessibility, notification access, or device admin rights soon after install, especially when they are sideloaded or promoted through non-standard distribution channels. Those combinations deserve review because they often indicate a path to abuse rather than a legitimate feature need.
Practitioner takeaway: Treat restricted settings as a control that buys time and reduces abuse, but not as a substitute for app provenance checks and device-level monitoring.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org