App Configuration
Threema Work allows to remotely edit app settings. You can control the app’s configuration, disable specific features, and the end user is relieved from setting up the app manually.
Threema Work allows to remotely edit app settings. You can control the app’s configuration, disable specific features, and the end user is relieved from setting up the app manually.
If you don’t use an MDM system for the app’s deployment, the app configuration (previously called “Threema MDM”) in the management cockpit is a convenient way of controlling the app’s settings. In the management cockpit, the same settings that are available when using a regular MDM system can be configured. Learn more…
On Android and iOS, apps can be installed in a Managed Profile to separate personal and professional use. Apps that are installed this way can be remotely configured using an MDM system.
Threema Work supports the following platforms and profile types:
Platform | System Requirement | Supported Profile Types |
Android | Android 5.0+ | Android Enterprise / Managed Configurations |
iOS | iOS 7+ | Managed App Configuration |
To ensure compatibility, please contact the developer of your MDM system.
| Name | Type | Min | Max | OS | Renewable¹ | User-editable² | Default value |
|---|---|---|---|---|---|---|---|
| Chat contents | |||||||
| th_disable_export | bool | - | - | All | Yes | No | - |
| If set to true, the user cannot export chats. | |||||||
| th_disable_save_to_gallery | bool | - | - |
Android iOS (2.7.3k) |
Yes | No | - |
| If set to true, media files will not be auto-saved to the local gallery. | |||||||
| th_disable_screenshots | bool | - | - | Android | Yes | No | - |
| If set to true, the user cannot take screenshots on Android, and no thumbnail is displayed in Android’s app switcher. | |||||||
| th_disable_message_preview | bool | - | - |
Android (3.02k) iOS (2.9.1k) |
Yes | No | - |
| If set to true, the message preview in push notifications is disabled. | |||||||
| th_disable_share_media | bool | - | - |
Android (4.2k) iOS (4.4k) |
Yes | No | - |
| If set to true, saving and sharing media and other files outside of Threema Work is prevented. On Android, this only applies to images, videos, and voice messages (for OS-specific reasons). For technical reasons, saving and sharing media and other files using the desktop app and the web client is still possible (unless th_disable_web is set to true). | |||||||
| th_keep_messages_days | int | 7 | 3650 |
Android (5.2k) iOS (5.7k) |
Yes | No | 7 |
| Specify a time span (1 week to 10 years in days) after which old chat messages will be automatically deleted. Messages in note groups, open polls, and starred messages are excluded from this setting and will not be automatically deleted. | |||||||
| Communication | |||||||
| th_disable_create_group | bool | - | - |
Android (3.3k) iOS (3.0.4k) |
Yes | No | - |
| If set to true, the user cannot create groups. | |||||||
| th_disable_web | bool | - | - |
Android (3.551k) iOS (4.0.3k) |
Yes | No | - |
| If set to true, the desktop app, the web client (“Threema Web”), and the possibility to link devices are disabled. | |||||||
| th_disable_calls | bool | - | - |
Android (3.2k) iOS (3.0k) |
Yes | No | - |
| If set to true, all types of Threema calls (voice, video, and group calls) are disabled; joining a group call isn’t possible either. | |||||||
| th_disable_group_calls | bool | - | - |
Android (5.0k) iOS (5.6k) |
Yes | No | - |
| If set to true, all group calls are disabled. | |||||||
| th_disable_video_calls | bool | - | - |
Android (4.41k) iOS (4.6.1k) |
Yes | No | - |
| If set to true, the video functionality is deactivated for one-to-one calls, but not for group calls. If video transmission should be disabled for group calls, group calls need to be deactivated (set th_disable_group_calls to On and true). | |||||||
| th_web_hosts | string | - | - |
Android (4.1k) iOS (4.4k) |
Yes | No | - |
| If set, the desktop app and the web client can only connect to the defined servers. As value, a comma-separated list of hostnames is expected. If a hostname starts with *, suffix matching is applied; otherwise, the hostname must match completely. Example: signaling.threema.ch,*-signaling-test.threema.ch | |||||||
| Contacts | |||||||
| th_contact_sync | bool | - | - | All | Yes | No | - |
| If set to true, synchronization with the local address book is enabled. On Android and in earlier versions (<4.5k) of the iOS app, this setting is defined once when setting up the app. If the setting is adjusted at a later time, i.e., when the app is already in use, the changes will only become effective after the user reinstalls the app or generates a new ID. | |||||||
| th_hide_inactive_ids | bool | - | - |
Android (4.2k) iOS (4.4k) |
Yes | No | - |
| If set to true, inactive IDs (i.e., IDs that have not been in use for at least three months) and revoked IDs are hidden. | |||||||
| th_block_unknown | bool | - | - | All | Yes | No | - |
| If set to true, unknown contacts (i.e., contacts not contained in the device’s contact list) are blocked. | |||||||
| th_disable_add_contact | bool | - | - |
Android (2.82k) iOS (2.7.3k) |
Yes | No | - |
| If set to true, the user cannot manually add contacts. Contacts can only be added via contact synchronization (if not disabled; see th_contact_sync), via the company directory (if not disabled; see th_disable_work_directory), or by receiving messages from unknown contacts (if not disabled; see th_block_unknown). | |||||||
| th_disable_work_directory | bool | - | - |
Android (4.55k) iOS (4.6.9k) |
Yes | No | - |
| If set to true, access to the internal company directory is denied. | |||||||
| Backups | |||||||
| th_safe_enable | bool | - | - |
Android (3.62k) iOS (4.2.1k) |
Yes | No | - |
| If set to true, Threema Safe must be used; if set to false, Threema Safe cannot be used. (If not set at all, Threema Safe can be used.) | |||||||
| th_disable_backups | bool | - | - | All | Yes | No | - |
| If set to true, the user cannot create any kind of backup. This setting overrides th_safe_enable, th_disable_data_backups, th_disable_system_backups and th_disable_id_export. | |||||||
| th_disable_system_backups | bool | - | - | iOS (4.2.1k) | Yes | No | - |
| If set to true, Threema data is excluded from iTunes/iCloud backups. Not relevant for Android. | |||||||
| th_disable_data_backups | bool | - | - | Android (3.7k) | Yes | No | - |
| If set to true, the user cannot create data backups (only available on Android). | |||||||
| th_disable_id_export | bool | - | - |
Android (3.7k) iOS (4.2.1k) |
Yes | No | - |
| If set to true, the user cannot export their ID. | |||||||
| th_safe_restore_id | string | 8 | 8 |
Android (3.62k) iOS (4.2.1k) |
No | No | - |
| Threema ID to restore from Threema Safe if th_safe_restore_enable is true. If th_safe_password is also set, the ID is restored without user interaction. | |||||||
| th_safe_restore_enable | bool | - | - |
Android (3.62k) iOS (4.2.1k) |
No | No | - |
| If set to false, Threema Safe backups cannot be restored. If set to true, restoring a Threema Safe backup in the setup wizard is either optional (if th_safe_restore_id is not set) or mandatory (if th_safe_restore_id is set). | |||||||
| th_safe_password_message | string | - | - |
Android (4.2k) iOS (4.4k) |
Yes | No | - |
| Error message that is shown if the password that the user has chosen for Threema Safe does not match the pattern in th_safe_password_pattern. | |||||||
| th_safe_password_pattern | string | - | - |
Android (4.2k) iOS (4.4k) |
Yes | No | - |
| Regular expression (Regex) that defines the format of the password chosen by the user for Threema Safe. If not set, only a minimum length of 8 characters is enforced. The regular expression must be compatible with Java Pattern (Android) and NSRegularExpression (iOS). | |||||||
| th_safe_server_password | string | - | - |
Android (3.62k) iOS (4.2.1k) |
Yes | No | - |
| Password for HTTPS authentication of Threema Safe server defined in th_safe_server_url (if required) | |||||||
| th_safe_server_url | string | - | - |
Android (3.62k) iOS (4.2.1k) |
Yes | No | - |
| URL for custom Threema Safe server, e.g., examplecompany.com/threemasafe | |||||||
| th_safe_server_username | string | - | - |
Android (3.62k) iOS (4.2.1k) |
Yes | No | - |
| Username for HTTPS authentication of Threema Safe server defined in th_safe_server_url (if required) | |||||||
| th_id_backup | string | 99 | 99 | All | No | No | - |
| This setting is used to provide precalculated key pairs (Threema IDs) and restore ID backups (also called “ID exports” in newer app versions). Requires an external MDM system; not available in the app configuration. | |||||||
| th_id_backup_password | string | 8 | - | All | No | No | - |
| Password for ID backup/export in th_id_backup. Requires an external MDM system; not available in the app configuration. | |||||||
| th_safe_password | string | 8 | 4096 |
Android (3.62k) iOS (4.2.1k) |
Yes | No | - |
| Password to encrypt (or restore, cf. th_safe_restore_id) Threema Safe backup (requires an external MDM system and is not available in the app configuration) | |||||||
| Profile | |||||||
| th_license_username | string | 1 | 255 | All | No | No | - |
| Username required to activate the app (requires an external MDM system and is not available in the app configuration) | |||||||
| th_license_password | string | 1 | - | All | No | No | - |
| Password required to activate the app (requires an external MDM system and is not available in the app configuration) | |||||||
| th_lastname | string | - | 255 |
Android (3.43k) iOS (3.0.9k) |
Yes | No | - |
| Last name of the user; visible in management cockpit and API. | |||||||
| th_firstname | string | - | 255 |
Android (3.43k) iOS (3.0.9k) |
Yes | No | - |
| First name of the user; visible in management cockpit and API. | |||||||
| th_category | string | - | 255 |
Android (3.43k) iOS (3.0.9k) |
Yes | No | - |
| User category (e.g., group, department); visible in API and as tags in the user management of the management cockpit. | |||||||
| th_department | string | - | 255 |
Android (5.6k TODO) iOS (6.3k TODO) |
Yes | No | - |
| Department of the user; visible in management cockpit, contact list and API. | |||||||
| th_job_title | string | - | 255 |
Android (5.6k TODO) iOS (6.3k TODO) |
Yes | No | - |
| Job title of the user; visible in management cockpit, contact list and API. | |||||||
| th_nickname | string | 1 | 32 | All | Yes | Yes | - |
| The nickname appears in the contact details (as well as in push notifications). | |||||||
| th_linked_email | string | - | - | All | No | Yes | - |
| The email address linked to a Threema ID is used for contact synchronization. | |||||||
| th_linked_phone | string | - | - | All | No | Yes | - |
| The phone number linked to a Threema ID is used for contact synchronization; it must be specified in international format, e.g., +41555114900. | |||||||
| th_csi | string | - | 255 |
Android (3.43k) iOS (3.0.9k) |
Yes | No | - |
| CSI (Customer Specific Identifier) can be any value (e.g., an internal employee reference); this value is visible in the management cockpit’s user overview and when looking up users in the company directory of the app, and it facilitates clear identification of employees (e.g., in case of identical names). | |||||||
| th_readonly_profile | bool | - | - | All | Yes | No | - |
| If set to true, the user cannot change the following profile settings: nickname, profile picture, email address / phone number linked to the ID, export ID, delete ID, ID revocation password. The use of Threema Safe and the export of the Threema ID can be prevented using the settings th_safe_enable and th_disable_id_export, respectively. | |||||||
| th_skip_wizard | bool | - | - |
Android (3.2k) iOS (3.0.6k) |
Yes | No | - |
| If set to true, the setup wizard that would show up on the first app launch is skipped. (In the setup wizard, the settings th_linked_phone, th_linked_email, and th_contact_sync and settings for Threema Safe can be defined.) | |||||||
| th_disable_send_profile_picture | bool | - | - |
Android (3.14k) iOS (2.10.1k) |
Yes | No | - |
| If set to true, the user’s profile picture will not be shared with others. |
