SkieWhy does Skie block switching users on managed devices?
Skie blocks user switching with Android's user switch restriction, and it is on by default. Even if another user existed on the device, nobody could move into it. It keeps the managed space as the only place a student can be, and removes the switch entry from the quick settings and lock screen.
Switching users is the step that moves a person from one Android user space to another. It is normally reached from the quick settings panel or the lock screen, where the user icon lists the spaces on the tablet.
Skie already stops new users being added. So why block switching too? Because defence in depth matters. A device can arrive from the factory or a previous owner with a second user or guest space on it, and a managed device should not rely on that being absent. The DISALLOW_USER_SWITCH restriction means the managed user is the only one a person can reach.
The protection is default on and it is its own switch in the hardening section, so you can see its state per device. It is read back from Android after each apply and counts toward the compliance score. It works together with the add users and remove users blocks, each described in its own entry.
If you see a device where this reads off, a sync or a compliance run will usually put it right, and Skie re-applies the protection by itself.
One situation is worth knowing about. A school that deliberately uses Android multi-user for shared lab tablets would need to turn this and the add users block off for that group. Most schools are better served by Skie's own structure: one student, one device, with schedules that change app sets by period. Practical tip: audit new device models for pre-existing users when you add them. The add-a-model wizard and the readiness gate help you catch it.