Where Is the Install Unknown Apps Setting on Android? A Brand-by-Brand Guide
Android 8.0 changed the model: install permission is per-app, not global. Where the setting lives on Pixel, Xiaomi, Samsung, Huawei, OPPO and vivo — plus the second gates each vendor adds and when to turn it off again.
Almost everyone hits the same wall on their first sideload: install an APK and Android refuses with "for your security, your phone is not allowed to install unknown apps." Then you search the settings menu for ten minutes and find nothing.
The reason is concrete. Since Android 8.0 (API 26), this is no longer a single global switch. It is granted per app: you authorize which app may install APKs, not "whether APKs may be installed."
Once that model clicks, every vendor path makes sense.
Three rules that explain everything
- The permission belongs to the installer, not the package. Download in a browser, you authorize the browser. Open from a file manager, you authorize the file manager.
- Authorization is isolated per app. Enable it for Chrome and your file manager still cannot install.
- Systems revoke it automatically. Many devices turn the permission back off after a successful install. That is design, not a bug.
Which means the setting you are looking for is called "Install unknown apps," not "Unknown sources."
Brand-by-brand paths
| Brand / OS | Path |
|---|---|
| Stock Android / Pixel | Settings → Apps → Special app access → Install unknown apps → pick app |
| Xiaomi / Redmi (HyperOS, MIUI) | Settings → Apps → Manage apps → ⋮ → Special permissions → Install unknown apps |
| Samsung (One UI) | Settings → Apps → Special access → Install unknown apps |
| OPPO / OnePlus / realme (ColorOS) | Settings → App management → Special app permissions → Install unknown apps |
| vivo / iQOO (OriginOS) | Settings → More settings → Permission manager → Install unknown apps |
| Huawei / Honor (EMUI, HarmonyOS) | Settings → Security → More security settings → External source downloads |
If your device is not listed, use the universal method: search "unknown" in the Settings search bar. It lands you on the right screen in one step and works across every skin.
Second gates per vendor
Even with the permission on, several brands add a second layer. Knowing these saves a lot of confusion:
- Xiaomi / Redmi: a "security check" prompt appears; you can wait about 10 seconds to skip. Some builds also block sideloads while "Pure Mode" is enabled.
- Samsung: Auto Blocker blocks all sideloads regardless of the per-app permission.
- Huawei / Honor: you get "this app has not passed Huawei security checks" with a "Continue installation" option. Some builds also restrict installs to the AppGallery only.
- OPPO / OnePlus: may run an app safety scan; choose "Install anyway" afterward.
- vivo: some builds route through iManager's install interception, which needs a per-app whitelist entry.
These prompts are not errors. They are vendor safety notices. The decision rule is simple: if you deliberately want this app and its source is traceable, continue. If it arrived via an unsolicited popup or a random SMS link, cancel.
Should you leave the permission on?
This is the part most guides skip. My recommendation: leave it off by default and enable it only when needed.
The reason is scope. This permission is not just a one-time install approval — it grants that app the ongoing ability to install things onto your phone. For apps you use daily (browsers, messaging clients), holding that permission permanently significantly widens the blast radius if that app itself is compromised.
A safer routine:
- Enable the permission for the specific app right before you need it
- Turn it back off immediately after installing
- Delete the downloaded APK file
If you sideload frequently — developers, QA testers — pick one dedicated file manager as your installer and grant the permission only to it. Everything else stays off. Risk gets concentrated into one controllable point.
Three checks before you install
The permission is only part of the flow. The file itself determines safety:
First, verify the source. Official developer sites, Google Play, F-Droid, and APKMirror (which verifies signatures) carry meaningfully lower risk than forum attachments and cloud-drive links.
Second, sanity-check the file. Does the size make sense? A 300MB game is not 2MB. Do the version number and publisher match what the developer publishes?
Third, read the permission list. The install screen shows what the app requests. A flashlight app asking for contacts and SMS is a hard pass.
For high-security cases, compare signing certificates. apksigner verify --print-certs app.apk prints the certificate fingerprint; if it matches the developer's published fingerprint, the file has not been repackaged.
Common errors, decoded
- "There was a problem parsing the package" → corrupt or incomplete download, or the file is not actually an APK (a .xapk renamed to .apk). Re-download first.
- "App not installed" → usually a signature conflict with an existing copy. Uninstall the old version.
- "Not compatible with your device" → architecture (32-bit vs 64-bit) or minimum SDK mismatch. This is not a permission issue.
- "Installation blocked" with no detail → check Pure Mode, Auto Blocker, or an MDM policy.
Separating "permission problem" from "file problem" saves real time. Permission issues say not allowed to install. File issues say installation failed. Different symptoms, different fixes.
The short version
Three sentences: the permission is per-app, so search for "Install unknown apps" rather than "Unknown sources"; vendor paths vary, so use the Settings search box; turn it off when you are done.
Sideloading is a normal Android capability, not a dangerous act. What is dangerous is making it a reflex without knowing where the file came from. You can grab installation packages from gptoapk.