Android Enterprise Customer Community

Hello, good afternoon everyone. I'm writing to this forum to ask for help. A few weeks ago, I applied for the EMM and Enterprise Android Partner program. My application was rejected without any explanation in the emails. I'd like to know the requirements to join the program. We are a development company based in Guatemala and the United States (and soon in Mexico and Colombia), as we currently have a client requesting an MDM system for their Android device retail store.This is our first time applying to this program so we can offer our services to this client and any future clients who might be interested. If you could send me the program requirements so I can apply correctly, I would be very grateful.  Have a good afternoon. Greetings from Guatemala.

I am experiencing inconsistent behavior with QR code provisioning for Android Enterprise and am seeking guidance from the community.The Issue:QR code provisioning works intermittently, but the failure pattern is inconsistent. A provisioning QR code generated from a specific APK build will work reliably. However, subsequent builds of the exact same source code from the same Android Studio project will sometimes fail. The device displays a generic "Contact your IT admin" error.What I've Verified:The APK is properly signed and the checksum in the QR code is correct.The server delivers the APK with the correct application/vnd.android.package-archive MIME type.The DeviceAdminReceiver is correctly declared in the manifest and the associated XML resource exists.The package name and component name in the QR code are 100% accurate.Comparing a "working" APK and a "failing" APK in APK Analyzer shows no differences in the core components (package name, receivers, reso

Hi We have a custom MDM app which was built to enroll android devices with Device Owner. We have a backend which serves the configuration requires to install/block apps and settings. We are not using Android official management APIs,  A few days ago we received a google play protect update on some of our devices and now whenever we try to enroll the devices using QR code enrollment it gets blocked by google play protect. Please help us understand what is required to bypass this so that we can continue to use our custom MDM app. thanks!

Hello Android Enterprise Community,I’m trying to set up my MDM, but I keep encountering the following error:"Someone at testmdm.xyz has already signed up."I have previously attempted to remove the Android Enterprise enrollment from my domain, unlinked the MDM, and followed all standard steps. However, I am unable to re-register the MDM, and my attempts to enroll devices fail.I would greatly appreciate guidance on:How to fully clear any previous Android Enterprise enrollment associated with my domainSteps to re-register an MDM successfullyAny best practices or troubleshooting tips to avoid this issue in the futureThank you in advance for your help. Any advice from experienced admins or Google support is highly welcome.@jasonbaytonBest regards,Khaled

Hello everyone, I’m reaching out from my company as we have encountered an issue with the installation and use of personal digital certificates issued by FNMT (Spain) on Android devices managed through Google Workspace MDM. The certificates install correctly, but apps that should use them (e.g., for Wi-Fi authentication or access to internal services) do not detect or recognize these certificates. We have tested on unmanaged Android devices, and the certificates work fine there, so it seems related to Google Workspace MDM management. We’ve confirmed with the certification authority (FNMT)  that their certificates comply with standards. Google mentioned that MDM should not block certificates unless there is a policy configured to do so. However, this problem seems to persist regardless. Additionally, other companies have reported similar issues with personal certificates issued by different certification authorities, which suggests a possible systemic incompatib

Hello, Since android 15, some characters are not taken into account correctly. For example the tilde character is showned on top if you use an external keyboard (Alt Gr + "é")  and is showned on the middle of the character if you use the onscreen keyboard. Example in android 16 (but 15 seems to be the same): On external keyboard: "˜"On onscreen keyboard: "~" In our barcodes we sometimes use this character and thus it is an issue after updating to Android 15 the devices in production. does other French people see this or any character change ? (It seems the "¨" also changed)@Lizzie , is there someone in your contacts we can discuss / exchange with on this topic ?  

We are developing a solution using Android Management. While enrolling a fully managed device, provisioning now fails with:- "Can't set up device"- "Since your organization reached its usage limits, this device can't be set up." This did not occur until yesterday. We are trying to determine whether this quota limit is enforced by the Android Management API (EMM side) or by Google Workspace when connecting to a third‑party EMM. If the limit is on the EMM side, is the quota granted per project? We have two Google Cloud projects using the Android Management API; the issue is only affecting the newer project. Questions:1) Where can we monitor quota usage for Android Management?2) If we have reached a quota, is there a way to remove previously enrolled test devices, and would that resolve the issue?3) Where can we find detailed information about quotas and currently enrolled devices?

Have a bit of an emergency where after the latest Gboard update, when users tap an input field, instead of Gboard just showing up as normal, a menu bubble is appearing instead where they have to tap it and select the "show on screen keyboard" option.  I haven't been able to locate Google's release notes for Gboard to see if there was something that changed.  Any ideas would be greatly appreciated!

Hi everyone,We're running into a certificate issue with our Android Enterprise deployment and hoping someone here has encountered something similar or can point us in the right direction. We're using Microsoft Intune as our MDM solution with COPE and COBO enrolled devices. This affects all Android devices regardless of manufacturer, including Google Pixel devices running Android 16 with the latest security patch. The devices use SCEP certificates for Wi-Fi authentication.In early September, we rolled out new Root CAs via Intune. These new Root CAs are used for creating SCEP profiles for Wi-Fi authentication. The devices now have both the old, still valid Root CA and the new Root CA installed. The problem occurs when a device tries to obtain a new SCEP certificate issued by the new Root CA. In this case, the Android device attempts to verify the certificate chain using the old Root CA, which fails because the certificate was issued by the new Root CA. As soon as the old Root CA is remov

Hey there, this is my first post here as I could not find a ticket system for Zero Touch.  Since a couple of weeks all new devices only getting the "Enterprise Default Profile" automatically assigned which I deleted during zero touch tenant setup in "Configurations".The default profile I created does not get automatically applied anymore. Unfortunately I can change the default assignment profile to whatever I want but newly added devices still are getting the "Enterprise Default Profile". Changing the device profile after the initial upload (including wrong DPC info) to the created target profile works in bulk. Once changed manually the devices apply the correct DPC. Multiple zero touch instances are affected. How to fix the default assignment profile for newly added devices? Any suggestions?

Even after switching from APK to AAB, I noticed longer build times and higher storage use. What strategies or Gradle tweaks have worked for you to optimize Android game bundles?

I am unable to create my work profile on Microsoft In tune. I have recently purchased OPPO A6 Pro

Hello,we built our Managed Google Play connector in Intune like three years ago with our company name as organization name.Meanwhile our company name as slightly changed and since the company name is shown on all corporate-owned android devices lock screen, we have a high interest in changing that to the correct name.Unfortunately I can not find any way to change that company name. I can only delete that organization. I do not find a way to contact Google directly for that issue, so that is why I ended up here. So here are the questions:What exactly happens to our devices, if we disconnect and delete the organization and reconnect to a new organization with correct name? All devices will reset? All apps will be gone?Are there other ways to configure what is shown on the lockscreen? Maybe it is possible to disable the display of the company name on the lockscreen completely?Or is there a way to contact Google to change that name for us? Any help appreciated. 😎&nbs

I have enrolled a device and want to use managed wifi on that device. I have used following configuration- "openNetworkConfiguration": {    "Type": "UnencryptedConfiguration",    "NetworkConfigurations": [      {        "GUID": "inovex_wifi",        "Name": "INovex-Dev",        "Type": "WiFi",        "WiFi": {          "SSID": "INovex-Dev",          "Security": "WPA-EAP",          "EAP": {            "Outer": "EAP-TLS",            "Identity": "faruk",            "DomainSuffixMatch": ["dms.mobi-manager.com"],            "ServerCARefs": ["ca_inovex"],            "ClientCertType": "Ref",            "ClientCertRef": "clie

Hey! We are currently testing a few apps in Work Profile, for which we need 2FA. The second factor is a FIDO2 token that can be used via NFC or USB. If you have a FIDO2 token with USB-C, everything is fine. But we also have some with USB-A. If you don't have an adapter, you're more likely to resort to NFC. Chrome supports FIDO2/NFC directly, which makes logging in quite easy. However, most web views cannot do this, and a passcode must be entered manually. The pure FIDO2 NFC tag basically contains a URL with the passcode. You open the webpage via NFC, copy the passcode, and enter it when logging in. So far, so good. However, we encountered a problem that prevents us from using the FIDO2 token via NFC in the Work Profile properly. There are default apps for different categories such as browser, wallet, caller ID, etc. If you need to launch one of the app categories and there are several apps available, you will be asked which app you want to use and just for once or always

Hello, since Android 15 we have encountered a huge problem with Corporate phones (enrolled in BYOD) for which users leave the company without deleting their account. We therefore found ourselves with locked phones that we cannot return to our reseller (who asks us for a large sum to unlock them) so I come to you to find a solution or a tool available to the technical teams to clean up. We are open to any advice or help

Hi All, My Intune environment is connected with an old-school gmail.com account - i access the managed store page by going to https://play.google.com/work to approved apps / etc. - This was an old solution that saw little to no use. We're now looking at requiring Intune enrollment on our android devices and it'll get a ton of use once we do that. I'd like to upgrade my account to an Android Enterprise account, but it looks like to do that I'll need to disconnect the Managed Google Play account from Intune. My understanding is that I will need to un-enroll all my android devices from the tenant before doing that.For personally owned devices with work profiles, that's not a problem - we only have 3 PoC users that I can unenroll. The only other two enrollment options we use are Device Administrator (For Yealink teams phones...) and AOSP (For.. newer.. Yealink teams phones).Will disconnecting Managed Google Play affect the enrollment of Device Administrator or AOSP?&nbs

I have implemented this following feature - 3.6. Managed configuration management. Everything understand but got stuck in point -3.6.3. The EMM's console must allow IT admins to set wildcards (such as $username$ or %emailAddress%) so that a single configuration for an app such as Gmail can be applied to multiple users. Not understand how to implement this wildcards in one policy for different devices and also let me know for gmail it is supported or not?Thanks in advance.

Hi everyone, We’re facing an issue with devices running Android 15 — after successfully enrolling them in our Android Enterprise setup (Device Owner / Fully Managed mode), the Google Services Framework (GSF) ID is not being generated. This issue did not occur on Android 13 or 14; the GSF ID was available immediately after enrollment. However, on Android 15, the GSF ID remains empty even after waiting and rebooting. We’ve already tried: Factory reset and re-enrollmentChecking Google Play Services versionEnsuring the device is connected to the internetWaiting for Play Store sync Despite that, the GSF ID is still missing. Could anyone confirm if there’s a known change in Android 15 related to GSF ID generation, or if additional permissions/configuration are required for enterprise-enrolled devices to obtain it? Any guidance or workaround would be greatly appreciated.

I'm developing a BYOD workplace profile, and one of the required features in the functional specification is as follows:"2.7.2. Debugging features must be blocked. This subfeature is supported by default."I'm trying to implement this feature, and in the REST Resource: enterprises.policies - AdvancedSecurityOverrides - DeveloperSettings, I'm configuring either DEVELOPER_SETTINGS_DISABLED or DEVELOPER_SETTINGS_ALLOWED. However, it seems that either option doesn't restrict the developer options on the device. I'm curious about the role of these options, whether they are functioning correctly, or if this feature is not implementable in a BYOD context.Sorry if I wrote this through a translator so the context may be incorrect.

We use a custom DPC to create work profiles. On certain devices, profile creation fails with errors like STORAGE_UNAVAILABLE or work profile already exists. From bug reports, we can confirm the failure cause, but is there a way to detect these conditions directly in our app and handle them gracefully?”

Hi all, I could use some help or guidance from someone who has experience with using Okta as IDP and Intune as MDM.  The problem:When going trough enrollment (COPE), the Intune login page shows up. When entering the email, it forwards to Okta as it should. But after verifying with Okta, you should get back to a Microsoft confirmation but instead it shows a page not found error.  It used to work, nothing has changed as far as we know and the issue is present on devices ranging from Android 13 to 15, different brands but mostly Samsung.  Apple and Windows enrollment work as expected, no issues there.  I can't find any related logging details in Intune and lack the knowledge of Okta (will add a support ticket there as well). So i'm kind of lost as to what is happening.  Where do I need to look for the return URL for example? There are multiple Azure enterprise apps but i'm not sure which one to check and don't want to mess to much wit

Our Provider (Vodafone Germany) is using a SMS shortcode number to be able to order an upgrade on dataplans by sms. Once the monthly contract plan (e.g. 1 GB) have been used users will receive a sms from 70997 to inform that you can answer the SMS with "1" or "2" to restore your data connectivity. We ran into the issue that the Google Messages app seems to have some sort of bug with sending SMS to this kind of shortcode number as it alway says "Not sent" in red error text. Provider tech support told me that the Google messages app is prefixing the number with "49" resulting in a wrong / unknown number (4970997). They cannot fix that from their side as the issue is within Google messages app and asked me to install a 3rd party messages app.... *ugly* Is this something I can request to investigate from here? I will also create a case with Samsung tech support as we are mainly using Samsung devices as our corp. device fleet.  Thank you! Kind RegardsDaniel

Hello, A client would like to define Adobe Reader as default pdf viewer on WPCOD devices or DO devices. I didn't find any informations about it in android enterprise documentation or Ivanti NMDM documentation. Is it even doable ?Has anyone ever had a similar request? Thank you,  

Hi everyone, I noticed that it is now possible to delete an application that has been unpublished for a long time, for example.When you click on delete application, you are asked for the transaction ID of the developer account and the package name.I have my transaction ID (which can be found on payments.google.com), but it is not in the same format as the examples givenand is not recognised. Have you ever tried to delete an application? Have you also encountered a problem with this ID? Best regards,NB : The ID I have is in the format xxx.registration-xxx-xxx-xxx-xxx-xxx