# Allow APK Install Without Removing Restrictions for the Entire Fleet What does “Install apps from unknown sources” mean in Hexnode UEM? ------------------------------------------------------------------ In Hexnode UEM, the **[Install apps from unknown sources](https://www.hexnode.com/mobile-device-management/help/set-up-android-mdm-restrictions-using-hexnode-mdm/#allow-app-settings:~:text=Install%20apps%20from,Enterprise%20%E2%80%93%20Device%20Owner.)** setting is an Android restriction found under **Policy > Android > Advanced Restrictions > Allow App Settings**. When this restriction is disabled in an applied policy, Android blocks the installation of any `.apk` file that did not come from the Google Play Store or the Hexnode app inventory. The restriction applies to every device associated with that policy. This is a policy-enforced restriction — not a device-level toggle that can be temporarily bypassed by a script, another policy, or a remote command while the restrictive policy remains applied. [![Screenshot of the Hexnode UEM console showing the 'Install apps from unknown sources' restriction in Android that allows APK install under Policies tab](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/07/Install-apps-from-unknown-sources-restriction-in-Hexnode-UEM.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/07/Install-apps-from-unknown-sources-restriction-in-Hexnode-UEM.png "'Install apps from unknown sources' restriction that allows APK install in Hexnode UEM console") What you need to know before starting ------------------------------------- - The target device must be an Android device managed in Hexnode UEM. - The app package must be a `.apk` file. This configuration does not apply to `.pkg` or other formats. - The current policy applied to the device must have **Install apps from unknown sources** disabled. - The exception is for one device. Other devices in the same policy group continue using the original restricted policy. - Editing the original policy directly would remove the restriction for all devices assigned to it — not just the target device. Cloning is the correct approach for a single-device exception. Why the restriction cannot be overridden without changing the policy -------------------------------------------------------------------- The **Install apps from unknown sources** restriction in Hexnode UEM is enforced at the MDM policy level. A second policy, a remote script, or a temporary exemption cannot override it while the restrictive policy remains applied to the device. The only way to permit unknown source installation on a specific device is to apply a policy to that device where the restriction is not enabled. **Note:** Removing the restriction from the original policy would affect all devices associated with that policy. Clone the policy first to create a controlled exception for the target device without changing the rest of the fleet. How to allow APK installation from unknown sources on one Android device ------------------------------------------------------------------------ ### Step 1: Clone the existing Android policy 1. Go to the **Policy** tab in the Hexnode portal. 2. Locate the Android policy currently applied to the target device. 3. Click the **clone** icon on the right side of the policy row to duplicate it. ### Step 2: Remove the restriction in the cloned policy 1. Open the cloned policy. 2. Navigate to **Android > Advanced Restrictions > Allow App Settings**. 3. Remove the restriction for **Install apps from unknown sources**. 4. Save the cloned policy. ### Step 3: Reassign the target device to the cloned policy 1. Remove the original restricted policy from the target Android device. 2. Apply the cloned policy to the target Android device. 3. Sync the device to confirm the policy is applied. What happens after applying the cloned policy --------------------------------------------- The target Android device receives the cloned policy where **Install apps from unknown sources** is permitted. Third-party `.apk` installation is now allowed on that device. All other devices remain assigned to the original policy with the restriction active — their configuration is unchanged. Real-world scenario ------------------- An IT admin manages a fleet of 60 Android tablets in a warehouse. All 60 devices are assigned an Android policy with **Install apps from unknown sources** disabled. A logistics vendor provides a custom inventory `.apk` that needs to be sideloaded on one specific tablet used by the warehouse supervisor. The admin clones the existing policy, removes the unknown sources restriction in the clone, removes the original policy from the supervisor’s tablet, and applies the clone. The supervisor’s tablet can now install the vendor `.apk`. The other 59 tablets remain on the original restricted policy. What this configuration does not do ----------------------------------- Common misconceptions about unknown sources exceptions in Hexnode UEMMisconceptionRealityA script can temporarily bypass the restriction for one device.No. The restriction is policy-enforced. It cannot be overridden by a script or remote command while the restrictive policy remains applied.A second policy can override the restriction on a single device.No. The existing restrictive policy must be removed from the device and replaced with a policy where the restriction is not enabled.Editing the original policy creates a single-device exception.No. Editing the original policy changes the restriction for all devices assigned to it. Clone the policy to create a controlled exception for one device.This configuration applies to .pkg files.No. Android application packages use the `.apk` format. `.pkg` files are used on macOS. This configuration applies to Android devices and `.apk` files only.Unknown sources can be enabled from the device itself while a policy blocks it.No. MDM policy enforcement overrides the device-level setting. The user cannot enable unknown sources on the device while the restrictive policy is applied.