SkieCan a student sideload an app from a computer over USB?
No. Developer options and adb are blocked on managed devices, so a computer cannot push an app over USB debugging. USB file transfer is off by default, and USB data can be disabled entirely on Android 14 and newer as an optional setting. Any stray install is also removed by the install guard.
Sideloading over USB normally needs USB debugging, which in turn needs developer options, which a user unlocks by tapping the build number seven times. On a Skie device that menu is blocked. The student cannot enable debugging, so adb has nothing to talk to.
File transfer over USB is blocked by default, so a cable cannot be used to drop files on the device either. For a tighter set-up, USB data can be disabled entirely on Android 14 and newer, as an optional switch. That is useful for kiosk tablets and exam devices.
As a final layer, the install guard removes any app that is installed after enrolment and is not allowed. The baseline snapshot of apps present at setup stops it from touching what was already there.
There is one legitimate use of adb in the life of a device, which is enrolment. Provisioning over a laptop uses adb once, on a device that is freshly reset. After Skie is set as device owner, those routes are closed for the user.
Practical tip: if your IT team needs to debug an app, use a test device that is not enrolled, not a student's. Keep enrolled devices free of debugging so that the compliance score stays clean and the read-back is straightforward.