1# @ohos.enterprise.restrictions (Restrictions) 2 3This **restrictions** module provides APIs for disallowing general features of devices. You can globally disable or enable the features such as Bluetooth, HDC, USB, and Wi-Fi. 4 5> **NOTE** 6> 7> - The initial APIs of this module are supported since API version 12. Newly added APIs will be marked with a superscript to indicate their earliest API version. 8> 9> - The APIs of this module can be used only in the stage model. 10> 11> - The APIs of this module can be called only by a device administrator application that is enabled. For details, see [MDM Kit Development](../../mdm/mdm-kit-guide.md). 12 13## Modules to Import 14 15```ts 16import { restrictions } from '@kit.MDMKit'; 17``` 18 19## restrictions.setDisallowedPolicy 20 21setDisallowedPolicy(admin: Want, feature: string, disallow: boolean): void 22 23Disallows a feature. 24 25**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_RESTRICTIONS or ohos.permission.PERSONAL_MANAGE_RESTRICTIONS<sup>15+</sup> 26 27**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 28 29 30**Parameters** 31 32| Name | Type | Mandatory| Description | 33| -------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 34| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 35| feature | string | Yes | Feature to set.<br>- **bluetooth**: Bluetooth capability. If allowed or disallowed Bluetooth devices have already been configured via [addDisallowedBluetoothDevices](js-apis-enterprise-bluetoothManager.md#bluetoothmanageradddisallowedbluetoothdevices20) and [addAllowedBluetoothDevices](js-apis-enterprise-bluetoothManager.md#bluetoothmanageraddallowedbluetoothdevices), disabling the device Bluetooth capability through **setDisallowedPolicy** will take precedence. The device restrictions will not apply until Bluetooth is re-enabled.<br>- **modifyDateTime**: capability of modifying the system time. Currently, this feature is available only for 2-in-1 devices.<br>- **printer**: printing capability. Currently, this feature is available only for 2-in-1 devices.<br>- **hdc**: OpenHarmony Device Connector (HDC).<br>- **microphone**: microphone capability.<br>- **fingerprint**: fingerprint authentication capability. If this capability has been disabled for a user using [setDisallowedPolicyForAccount](#restrictionssetdisallowedpolicyforaccount14), a policy conflict will be reported when **setDisallowedPolicy** is invoked.<br>- **usb**: USB capability. After this capability is disabled, the external USB device cannot be used. This means that the current device in host mode cannot connect to other external devices.<br> A policy conflict will be reported if **setDisallowedPolicy** is called in the following three scenarios:<br> 1. Available USB devices have been added via [addAllowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanageraddallowedusbdevices).<br> 2. The access policy of the USB storage device has been set to read-only or disabled via [setUsbStorageDeviceAccessPolicy](js-apis-enterprise-usbManager.md#usbmanagersetusbstoragedeviceaccesspolicy).<br> 3. Disallowed USB device types have been added via [addDisallowedUsbDevices](js-apis-enterprise-usbManager.md#usbmanageradddisallowedusbdevices14).<br>- **wifi**: Wi-Fi capability.<br>- **tethering**<sup>14+</sup>: network sharing capability. The device can share the network (hotspot) with other devices.<br>- **inactiveUserFreeze**<sup>14+</sup>: capability of freezing inactive users. Currently, this feature is available only for 2-in-1 devices. When the system switches to the enterprise space user, the personal space users are inactive users.<br>- **camera**<sup>14+</sup>: camera capability.<br>- **mtpClient**<sup>18+</sup>: MTP client capability (including reading and writing). Currently, this feature is available only for 2-in-1 devices. The Media Transfer Protocol (MTP) allows users to access media files linearly on mobile devices. If the MTP client's write permission has already been disabled for a user via [setDisallowedPolicyForAccount](#restrictionssetdisallowedpolicyforaccount14), using **setDisallowedPolicy** to disable this feature will throw a policy conflict error.<br>- **mtpServer**<sup>18+</sup>: MTP server capability. Currently, this feature is available only for mobile phones, tablets, and 2-in-1 devices.<br>- **sambaClient**<sup>20+</sup>: samba client capability. Currently, this feature is available only for 2-in-1 devices. <br>Samba is a free software that implements the SMB protocol on Linux and UNIX systems, consisting of both server and client programs. <br>Server Messages Block (SMB) is a communication protocol for sharing files and printers on a local area network (LAN). It provides shared access to files, printers, and other resources between different computers within the LAN. <br>The SMB protocol follows a client-server model, allowing clients to access shared file systems, printers, and other resources on servers through this protocol.<br>- **sambaServer**<sup>20+</sup>: samba server capability. This feature is available only for 2-in-1 devices.<br>- **backupAndRestore**<sup>20+</sup>: backup and restore capability. If this feature is disabled, the **Settings** > **System** > **Backup & Restore** and **Settings** > **Cloud** options will become unavailable. This feature is available only for mobile phones and tablets. To completely disable the backup and restore capability, you are advised to call [applicationManager.addDisallowedRunningBundlesSync](./js-apis-enterprise-applicationManager.md#applicationmanageradddisallowedrunningbundlessync) to disable applications with this feature, such as Backup & Restore, HiSuite, and Cloud.<br>- **maintenanceMode**<sup>20+</sup>: device maintenance mode. Currently, this feature is available only for mobile phones, tablets, and 2-in-1 devices.<br>- **mms**<sup>20+</sup>: Multimedia Messaging Service (MMS), which is the capability of a device to receive and send MMS messages. Currently, this feature is available only for mobile phones and tablets.<br>- **sms**<sup>20+</sup>: Short Messaging Service (SMS), which is the capability of a device to receive and send SMS messages. Currently, this feature is available only for mobile phones and tablets.<br>- **mobileData**<sup>20+</sup>: cellular data. Currently, this feature is available only for mobile phones and tablets.<br>- **airplaneMode**<sup>20+</sup>: airplane mode. Currently, this feature is available only for mobile phones and tablets.<br>- **vpn**<sup>20+</sup>: Virtual Private Network (VPN).<br>- **notification**<sup>20+</sup>: device notification capability. When this feature is disabled, notifications sent by third-party applications will not be displayed.<br>- **nfc**<sup>20+</sup>: Near Field Communication (NFC).<!--RP1--><!--RP1End--> <br> **NOTE**<br>Since API version 15, applications granted with the ohos.permission.PERSONAL_MANAGE_RESTRICTIONS permission and [activated as device administrator applications](./js-apis-enterprise-adminManager.md#adminmanagerstartadminprovision15) can set the following features: **bluetooth**, **hdc**, **microphone**, **usb**, **wifi**, **tethering**, and **camera**<!--RP3--><!--RP3End-->.| 36| disallow | boolean | Yes | Whether to disallow the feature. The value **true** means to disallow the feature; the value **false** means the opposite. | 37 38**Error codes** 39 40For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 41 42| ID| Error Message | 43| -------- | ------------------------------------------------------------ | 44| 9200001 | The application is not an administrator application of the device. | 45| 9200002 | The administrator application does not have permission to manage the device. | 46| 201 | Permission verification failed. The application does not have the permission required to call the API. | 47 48**Example** 49 50```ts 51import { Want } from '@kit.AbilityKit'; 52 53let wantTemp: Want = { 54 bundleName: 'com.example.myapplication', 55 abilityName: 'EntryAbility', 56}; 57 58try { 59 restrictions.setDisallowedPolicy(wantTemp, 'printer', true); 60 console.info('Succeeded in setting printer disabled'); 61} catch (err) { 62 console.error(`Failed to set printer disabled. Code is ${err.code}, message is ${err.message}`); 63} 64``` 65 66## restrictions.getDisallowedPolicy 67 68getDisallowedPolicy(admin: Want, feature: string): boolean 69 70Obtains a disallowed feature. 71 72**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_RESTRICTIONS or ohos.permission.PERSONAL_MANAGE_RESTRICTIONS<sup>15+</sup> 73 74**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 75 76**Parameters** 77 78| Name | Type | Mandatory| Description | 79| ------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 80| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 81| feature | string | Yes | Feature to set.<br>- **bluetooth**: Bluetooth capability.<br>- **modifyDateTime**: capability of modifying the system time. Currently, this feature is available only for 2-in-1 devices.<br>- **printer**: printing capability. Currently, this feature is available only for 2-in-1 devices.<br>- **hdc**: OpenHarmony Device Connector (HDC).<br>- **microphone**: microphone capability.<br>- **fingerprint**: fingerprint authentication capability.<br>- **usb**: USB capability. After this capability is disabled, the external USB device cannot be used. This means that the current device in host mode cannot connect to other external devices.<br>- **wifi**: Wi-Fi capability.<br>- **tethering**<sup>14+</sup>: network sharing capability. The device can share the network (hotspot) with other devices.<br>- **inactiveUserFreeze**<sup>14+</sup>: capability of freezing inactive users. Currently, this feature is available only for 2-in-1 devices. When the system switches to the enterprise space user, the personal space users are inactive users.<br>- **camera**<sup>14+</sup>: camera capability.<br>- **mtpClient**<sup>18+</sup>: MTP client capability (including reading and writing). Currently, this feature is available only for 2-in-1 devices. The Media Transfer Protocol (MTP) allows users to access media files linearly on mobile devices.<br>- **mtpServer**<sup>18+</sup>: MTP server capability. Currently, this feature is available only for mobile phones, tablets, and 2-in-1 devices.<br>- **sambaClient**<sup>20+</sup>: samba client capability. Currently, this feature is available only for 2-in-1 devices. <br>Samba is a free software that implements the SMB protocol on Linux and UNIX systems, consisting of both server and client programs. <br>Server Messages Block (SMB) is a communication protocol for sharing files and printers on a local area network (LAN). It provides shared access to files, printers, and other resources between different computers within the LAN. <br>The SMB protocol follows a client-server model, allowing clients to access shared file systems, printers, and other resources on servers through this protocol.<br>- **sambaServer**<sup>20+</sup>: samba server capability. This feature is available only for 2-in-1 devices.<br>- **backupAndRestore**<sup>20+</sup>: backup and restore capability. If this feature is disabled, the **Settings** > **System** > **Backup & Restore** and **Settings** > **Cloud** options will become unavailable. This feature is available only for mobile phones and tablets.<br>- **maintenanceMode**<sup>20+</sup>: device maintenance mode. Currently, this feature is available only for mobile phones, tablets, and 2-in-1 devices.<br>- **mms**<sup>20+</sup>: Multimedia Messaging Service (MMS), which is the capability of a device to receive and send MMS messages. Currently, this feature is available only for mobile phones and tablets.<br>- **sms**<sup>20+</sup>: Short Messaging Service (SMS), which is the capability of a device to receive and send SMS messages. Currently, this feature is available only for mobile phones and tablets.<br>- **mobileData**<sup>20+</sup>: cellular data. Currently, this feature is available only for mobile phones and tablets.<br>- **airplaneMode**<sup>20+</sup>: airplane mode. Currently, this feature is available only for mobile phones and tablets.<br>- **vpn**<sup>20+</sup>: Virtual Private Network (VPN).<br>- **notification**<sup>20+</sup>: device notification capability.<br>- **nfc**<sup>20+</sup>: Near Field Communication (NFC).<!--RP2--><!--RP2End--> <br> **NOTE**<br>Since API version 15, applications granted with the ohos.permission.PERSONAL_MANAGE_RESTRICTIONS permission and [activated as device administrator applications](./js-apis-enterprise-adminManager.md#adminmanagerstartadminprovision15) can obtain the following features: **bluetooth**, **hdc**, **microphone**, **usb**, **wifi**, **tethering**, and **camera**<!--RP4--><!--RP4End-->.| 82 83**Return value** 84 85| Type | Description | 86| ------- | ------------------------------------------------------------ | 87| boolean | The value **true** means the feature is disallowed; the value **false** means the opposite.| 88 89**Error codes** 90 91For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 92 93| ID| Error Message | 94| -------- | ------------------------------------------------------------ | 95| 9200001 | The application is not an administrator application of the device. | 96| 9200002 | The administrator application does not have permission to manage the device. | 97| 201 | Permission verification failed. The application does not have the permission required to call the API. | 98 99**Example** 100 101```ts 102import { Want } from '@kit.AbilityKit'; 103 104let wantTemp: Want = { 105 bundleName: 'com.example.myapplication', 106 abilityName: 'EntryAbility', 107}; 108 109try { 110 let result: boolean = restrictions.getDisallowedPolicy(wantTemp, 'printer'); 111 console.info(`Succeeded in querying is the printing function disabled : ${result}`); 112} catch (err) { 113 console.error(`Failed to set printer disabled. Code is ${err.code}, message is ${err.message}`); 114} 115``` 116 117## restrictions.setDisallowedPolicyForAccount<sup>14+</sup> 118 119setDisallowedPolicyForAccount(admin: Want, feature: string, disallow: boolean, accountId: number): void 120 121Disallows a feature for a specified user. 122 123**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_RESTRICTIONS 124 125**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 126 127**Parameters** 128 129| Name | Type | Mandatory| Description | 130| -------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 131| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 132| feature | string | Yes | Feature to set.<br>- **fingerprint**: device fingerprint authentication capability. Currently, this feature is available only for 2-in-1 devices. The rules for using this parameter are as follows:<br>1. If this capability has been disabled through the [setDisallowedPolicy](#restrictionssetdisallowedpolicy) API, using **setDisallowedPolicyForAccount** will throw a policy conflict.<br>2. When **setDisallowedPolicyForAccount** is used to disable or enable the device fingerprint authentication capability for a specified user, any subsequent action via the [setDisallowedPolicy](#restrictionssetdisallowedpolicy) API will override the previous setting. If [setDisallowedPolicy](#restrictionssetdisallowedpolicy) enables the capability, all users gain access to the device fingerprint authentication.<br>- **mtpClient**<sup>20+</sup>: MTP client capability (writing). Currently, this feature is available only for 2-in-1 devices. The Media Transfer Protocol (MTP) allows users to access media files linearly on mobile devices. If the MTP client's write permission has already been disabled for a user via [setDisallowedPolicy](#restrictionssetdisallowedpolicy), using **setDisallowedPolicyForAccount** to disable this feature will throw a policy conflict error.| 133| disallow | boolean | Yes | Whether to disallow the feature. The value **true** means to disallow the feature; the value **false** means the opposite. | 134| accountId | number | Yes | User ID, which must be greater than or equal to 0.<br>You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9) to obtain the user ID.| 135 136**Error codes** 137 138For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 139 140| ID| Error Message | 141| -------- | ------------------------------------------------------------ | 142| 9200001 | The application is not an administrator application of the device. | 143| 9200002 | the administrator application does not have permission to manage the device. | 144| 9200010 | A conflict policy has been configured. | 145| 201 | Permission verification failed. The application does not have the permission required to call the API. | 146| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 147 148**Example** 149 150```ts 151import { Want } from '@kit.AbilityKit'; 152 153let wantTemp: Want = { 154 bundleName: 'com.example.myapplication', 155 abilityName: 'EntryAbility', 156}; 157 158try { 159 restrictions.setDisallowedPolicyForAccount(wantTemp, 'fingerprint', true, 100); 160 console.info('Succeeded in setting fingerprint disabled'); 161} catch (err) { 162 console.error(`Failed to set fingerprint disabled. Code is ${err.code}, message is ${err.message}`); 163} 164``` 165 166## restrictions.getDisallowedPolicyForAccount<sup>14+</sup> 167 168getDisallowedPolicyForAccount(admin: Want, feature: string, accountId: number): boolean 169 170Obtains the status of a feature for a specified user. 171 172**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_RESTRICTIONS 173 174**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 175 176**Parameters** 177 178| Name | Type | Mandatory| Description | 179| ------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 180| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 181| feature | string | Yes | Feature to set.<br>- **fingerprint**: device fingerprint authentication capability. Currently, this feature is available only for 2-in-1 devices. Note that when [setDisallowedPolicyForAccount](#restrictionssetdisallowedpolicyforaccount14) is used to disable or enable the device fingerprint authentication capability for a specified user, any subsequent action via the [setDisallowedPolicy](#restrictionssetdisallowedpolicy) API will override the previous setting. The value **false** will be returned.<br>- **mtpClient**<sup>20+</sup>: MTP client capability (writing). Currently, this feature is available only for 2-in-1 devices. The Media Transfer Protocol (MTP) allows users to access media files linearly on mobile devices.| 182| accountId | number | Yes | User ID, which must be greater than or equal to 0.<br>You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9) to obtain the user ID.| 183 184**Return value** 185 186| Type | Description | 187| ------- | ------------------------------------------------------------ | 188| boolean | The value **true** means the feature is disabled; the value **false** means the opposite.| 189 190**Error codes** 191 192For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 193 194| ID| Error Message | 195| -------- | ------------------------------------------------------------ | 196| 9200001 | The application is not an administrator application of the device. | 197| 9200002 | the administrator application does not have permission to manage the device. | 198| 201 | Permission verification failed. The application does not have the permission required to call the API. | 199| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 200 201**Example** 202 203```ts 204import { Want } from '@kit.AbilityKit'; 205 206let wantTemp: Want = { 207 bundleName: 'com.example.myapplication', 208 abilityName: 'EntryAbility', 209}; 210 211try { 212 let result: boolean = restrictions.getDisallowedPolicyForAccount(wantTemp, 'fingerprint', 100); 213 console.info(`Succeeded in querying is the fingerprint function disabled : ${result}`); 214} catch (err) { 215 console.error(`Failed to set fingerprint disabled. Code is ${err.code}, message is ${err.message}`); 216} 217``` 218 219## restrictions.addDisallowedListForAccount<sup>14+</sup> 220 221addDisallowedListForAccount(admin: Want, feature: string, list: Array\<string>, accountId: number): void 222 223Adds a list of applications that are not allowed to use a feature for a specified user. 224 225**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_RESTRICTIONS 226 227**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 228 229**Parameters** 230 231| Name | Type | Mandatory| Description | 232| -------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 233| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 234| feature | string | Yes | Feature to set.<br>- **snapshotSkip**: screen snapshot capability.| 235| list | Array\<string> | Yes | List of content such as the bundle names. | 236| accountId | number | Yes | User ID, which must be greater than or equal to 0.<br>You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9) to obtain the user ID.| 237 238**Error codes** 239 240For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 241 242| ID| Error Message | 243| -------- | ------------------------------------------------------------ | 244| 9200001 | The application is not an administrator application of the device. | 245| 9200002 | The administrator application does not have permission to manage the device. | | 246| 201 | Permission verification failed. The application does not have the permission required to call the API. | 247| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 248 249**Example** 250 251```ts 252import { Want } from '@kit.AbilityKit'; 253 254let wantTemp: Want = { 255 bundleName: 'com.example.myapplication', 256 abilityName: 'EntryAbility', 257}; 258let valueList:Array<string> = ["com.xx.aa.", "com.xx.bb"]; 259try { 260 restrictions.addDisallowedListForAccount(wantTemp, 'snapshotSkip', valueList, 100); 261 console.info('Succeeded in adding disallowed snapshotSkip feature'); 262} catch (err) { 263 console.error(`Failed to add disallowed snapshotSkip feature. Code is ${err.code}, message is ${err.message}`); 264} 265``` 266 267## restrictions.removeDisallowedListForAccount<sup>14+</sup> 268 269removeDisallowedListForAccount(admin: Want, feature: string, list: Array\<string>, accountId: number): void 270 271Removes the list of applications that are not allowed to use a feature for a specified user. 272 273**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_RESTRICTIONS 274 275**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 276 277**Parameters** 278 279| Name | Type | Mandatory| Description | 280| -------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 281| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 282| feature | string | Yes | Feature to set.<br>- **snapshotSkip**: screen snapshot capability.| 283| list | Array\<string> | Yes | List of content such as the bundle names. | 284| accountId | number | Yes | User ID, which must be greater than or equal to 0.<br>You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9) to obtain the user ID.| 285 286**Error codes** 287 288For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 289 290| ID| Error Message | 291| -------- | ------------------------------------------------------------ | 292| 9200001 | The application is not an administrator application of the device. | 293| 9200002 | The administrator application does not have permission to manage the device. | | 294| 201 | Permission verification failed. The application does not have the permission required to call the API. | 295| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 296 297**Example** 298 299```ts 300import { Want } from '@kit.AbilityKit'; 301 302let wantTemp: Want = { 303 bundleName: 'com.example.myapplication', 304 abilityName: 'EntryAbility', 305}; 306let valueList:Array<string> = ["com.xx.aa.", "com.xx.bb"]; 307try { 308 restrictions.removeDisallowedListForAccount(wantTemp, 'snapshotSkip', valueList, 100); 309 console.info('Succeeded in removing disallowed snapshotSkip feature'); 310} catch (err) { 311 console.error(`Failed to remove disallowed snapshotSkip feature. Code is ${err.code}, message is ${err.message}`); 312} 313``` 314 315## restrictions.getDisallowedListForAccount<sup>14+</sup> 316 317getDisallowedListForAccount(admin: Want, feature: string, accountId: number): Array\<string> 318 319Obtains the list of applications that are not allowed to use a feature for a specified user. 320 321**Required permissions**: ohos.permission.ENTERPRISE_MANAGE_RESTRICTIONS 322 323**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 324 325**Parameters** 326 327| Name | Type | Mandatory| Description | 328| ------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 329| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 330| feature | string | Yes | Feature to set.<br>- **snapshotSkip**: screen snapshot capability.| 331| accountId | number | Yes | User ID, which must be greater than or equal to 0.<br>You can call [getOsAccountLocalId](../apis-basic-services-kit/js-apis-osAccount.md#getosaccountlocalid9) to obtain the user ID.| 332 333**Return value** 334 335| Type | Description | 336| ------- | ------------------------------------------------------------ | 337| Array\<string> | List of applications that have been added by the user and for which a certain feature is disabled.| 338 339**Error codes** 340 341For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 342 343| ID| Error Message | 344| -------- | ------------------------------------------------------------ | 345| 9200001 | The application is not an administrator application of the device. | 346| 9200002 | The administrator application does not have permission to manage the device. | 347| 201 | Permission verification failed. The application does not have the permission required to call the API. | 348| 401 | Parameter error. Possible causes: 1. Mandatory parameters are left unspecified; 2. Incorrect parameter types; 3. Parameter verification failed. | 349 350**Example** 351 352```ts 353import { Want } from '@kit.AbilityKit'; 354 355let wantTemp: Want = { 356 bundleName: 'com.example.myapplication', 357 abilityName: 'EntryAbility', 358}; 359 360try { 361 let result: Array<string> = restrictions.getDisallowedListForAccount(wantTemp, 'snapshotSkip', 100); 362 console.info('Succeeded in querying disallowed list for account'); 363} catch (err) { 364 console.error(`Failed to query disallowed list for account. Code is ${err.code}, message is ${err.message}`); 365} 366``` 367 368## restrictions.setUserRestriction<sup>20+</sup> 369 370setUserRestriction(admin: Want, settingsItem: string, restricted: boolean): void 371 372Sets restrictions on user behaviors. 373 374**Required permissions**: ohos.permission.ENTERPRISE_SET_USER_RESTRICTION 375 376**System capability**: SystemCapability.Customization.EnterpriseDeviceManager 377 378**Parameters** 379 380| Name | Type | Mandatory| Description | 381| -------- | ------------------------------------------------------- | ---- | ------------------------------------------------------------ | 382| admin | [Want](../apis-ability-kit/js-apis-app-ability-want.md) | Yes | EnterpriseAdminExtensionAbility. | 383| settingsItem | string | Yes | User behavior.<br>- **setApn**: setting APN. Currently, only mobile phones and tablets are supported.<br>- **powerLongPress**: long-pressing the power button to open the power menu. Currently, only mobile phones and tablets are supported.| 384| restricted | boolean | Yes | Whether to restrict the user behavior. The value **true** means to restrict the user behavior; the value **false** means the opposite. | 385 386**Error codes** 387 388For details about the error codes, see [Enterprise Device Management Error Codes](errorcode-enterpriseDeviceManager.md) and [Universal Error Codes](../errorcode-universal.md). 389 390| ID| Error Message | 391| -------- | ------------------------------------------------------------ | 392| 9200001 | The application is not an administrator application of the device. | 393| 9200002 | The administrator application does not have permission to manage the device. | | 394| 201 | Permission verification failed. The application does not have the permission required to call the API. | 395 396**Example** 397 398```ts 399import { Want } from '@kit.AbilityKit'; 400import { restrictions } from '@kit.MDMKit'; 401 402let wantTemp: Want = { 403 bundleName: 'com.example.myapplication', 404 abilityName: 'EntryAbility', 405}; 406 407try { 408 restrictions.setUserRestriction(wantTemp, 'setApn', true); 409 console.info('Succeeded in restricting from setting apn'); 410} catch (err) { 411 console.error(`Failed to restrict from setting apn. Code is ${err.code}, message is ${err.message}`); 412} 413``` 414