This error is easy to misdiagnose because the message itself does not say what is actually being restricted. Unlike INSTALL_FAILED_ALREADY_EXISTS or a signature mismatch error, INSTALL_FAILED_USER_RESTRICTED almost always traces back to a device-level policy blocking installs from unknown sources, rather than anything wrong with the APK file itself.
adb: failed to install app.apk: Failure [INSTALL_FAILED_USER_RESTRICTED: Install canceled by user]The "canceled by user" phrasing is misleading on most devices — no dialog was shown and no one clicked cancel. This is Android's generic wording for a policy-level block, not necessarily an interactive rejection.
Since Android 8.0, "Install from unknown sources" is granted per-app rather than as a single global toggle. When installing via ADB, the relevant "app" is effectively the shell/ADB itself, and some OEM skins require this be explicitly allowed. Check under:
Settings > Apps > Special app access > Install unknown appsLook for an entry representing shell or package installer access and confirm it is allowed. The exact menu wording varies noticeably by OEM skin, which is why this is easy to miss on a device that uses non-stock naming for this setting.
Play Protect can silently reject an install it flags as potentially harmful, even from ADB, on devices where Play Protect is active and enforcing. Check its current setting:
adb shell settings get global package_verifier_enableA value of 1 means verification is active. For a known-safe internal test build repeatedly triggering a false positive, this can be disabled temporarily:
adb shell settings put global package_verifier_enable 0Re-enable it afterward; leaving verification off is a real security tradeoff and should not be a permanent setting on a daily-driver device.
On a device enrolled in a company's Mobile Device Management (MDM) system, or one with an active Android Work Profile, this error frequently means exactly what it says: a device administrator policy has restricted app installs from sources other than a managed app store, and no local setting will override it. Check for a Work Profile:
adb shell pm list usersA second user profile listed alongside the primary one is a strong signal that a managed profile exists. If so, the fix is administrative, not technical — someone with access to the MDM console needs to adjust the install policy, or the APK needs to be installed to the personal profile instead of the work profile if the device separates the two.
On a tablet or phone set up with multiple user profiles, a restricted profile (as opposed to the primary owner account) can have app installation disabled entirely by the primary account holder. Confirm which user ADB is targeting and switch to the primary profile before installing:
adb shell pm install --user 0 app.apkExplicitly targeting user 0 (the primary owner on almost all consumer devices) sidesteps ambiguity about which profile ADB would otherwise default to.
Before spending more time on device settings, confirm the APK itself is not the problem by checking it installs on a second, differently configured device or a fresh emulator. If it installs cleanly elsewhere, the restriction is device-specific and the steps above apply; if it fails everywhere, the issue is more likely a signature or manifest problem in the APK itself, which is a completely different failure mode from USER_RESTRICTED.
A separate error, INSTALL_FAILED_UPDATE_INCOMPATIBLE, is sometimes confused with this one because both surface during a routine reinstall attempt. That error means a signing key mismatch between the currently installed app and the new APK, not a policy restriction, and the fix is to uninstall the existing app first rather than adjusting any install-source setting:
adb uninstall com.example.app
adb install app.apkConfirming which of the two errors is actually printed in the terminal output matters, since the two have completely different root causes and neither fix addresses the other's problem.
On Samsung devices with Knox-based enterprise features active, even a personal, non-work-profile device can have install restrictions enforced through Knox Guard or a carrier-preloaded MDM agent that was never explicitly set up by the current owner, often inherited from how the device was originally provisioned before resale. Checking for an unexpected device admin app under Settings > Biometrics and security > Other security settings > Device admin apps is worth doing on a Samsung phone specifically before assuming the restriction has no local fix at all.