SkieHow does Skie block installing apps from unknown sources?
Skie turns on Android's install-unknown-apps restriction, so no app can be installed from a browser download, a file manager or a messaging app. It is on by default. Apps come from Google Play only, through the policy, and the Skie dashboard shows the protection per device.
Unknown sources is Android's name for installing an APK that does not come from the store. It is how sideloaded games, modified apps and bypass tools reach a tablet. A student who finds a file on a friend's phone or in a chat can try to open it, and if the setting is allowed, Android offers to install it.
Skie sets the DISALLOW_INSTALL_UNKNOWN_SOURCES restriction as the device owner. Android then refuses the install, and the toggle that normally grants an app permission to install packages cannot be turned on. This applies to the whole device, not just to one app.
This protection is on by default and appears in the hardening list. It works together with install guard, which silently removes an app installed after enrolment if it is not allowed, and with the always-blocked list of browsers, VPN apps and proxy apps. Those are described elsewhere. The point here is that the door is shut before an install even begins.
Because every app comes from Google Play, you control what is available through app lists and the organisation app store. Your own apps are submitted for Skie approval before they can be used on devices.
Practical tip: if a teacher needs a particular app, add it to the right app list instead of looking for an exception. It takes effect for the group through policy, and the unknown sources block stays on.