Android kiosk mode: Gmail shows Access Denied when attaching photosSolved

Hi @felixfrost ,

This usually happens when the main app is allowed in kiosk mode, but one of the helper packages required for the attachment flow is not allowed.

In Android kiosk mode, attaching a photo from inside Gmail may call a file picker, media provider, gallery component, or another Gmail-related background package. Sharing from Photos/Gallery to Gmail can still work because that uses a different app flow.

To identify and allow the missing package:

1. On the tablet, reproduce the issue in kiosk mode
2. In Hexnode, go to Manage > select the device > Applications.
3. Open Blocked Packages and check which package was blocked during the attachment attempt. If the list contains many old entries, clear the existing blocked packages first, reproduce only this Gmail attachment issue again, and then scan the device. This makes it easier to identify the relevant package.
4. Copy the blocked package ID shown for the attachment workflow.
5. Go to Apps > + Add Apps > With Bundle ID.
6. Add the copied package ID as an app in the inventory.
7. Open the active kiosk policy and go to Kiosk Lockdown > Background Apps.
8. Add the newly created package entry to Background Apps and save the policy.
9. Run a Scan Device action from Manage > Device > Actions > Scanning & Monitoring > Scan Device.

After the policy syncs, try composing a new email in Gmail and attaching a photo again.

Regards,
Isabel Lora
Hexnode UEM

That makes sense. I had a long list under Blocked Packages though. If I clear the blocked package list and try the Gmail attach flow again, how long should it take for the blocked package to show up again?

The blocked package entry appears after the device reports the blocked action back to Hexnode. The timing can vary depending on the device state and connectivity.

The best sequence is:

1. Clear the existing blocked package entries if the list is too noisy.
2. On the tablet, reproduce the exact Access Denied behavior from Gmail.
3. Run Scan Device from Hexnode.
4. Refresh the Applications section and check Blocked Packages again.

If it does not appear immediately, repeat the Gmail attachment attempt once more and run Scan Device again. Once the package appears, add that specific package to the app inventory using its bundle ID and include it under Background Apps in the kiosk policy.

Regards,
Isabel lora
Hexnode UEM