Android Enterprise Customer Community

Hi all, I'm running into a blocking issue provisioning brand-new (and factory-reset) Lenovo Tab M11 - TB311FU devices on Android 15 with Android Management API (fully managed / dedicated, kiosk).On Android 14 everything worked fine with the exact same policy and enrollment flow.The issue only started after updating to Android 15. (this is my test device, i constantly factory reset it) Expected behavior:Standard QR (6-tap) provisioning to proceed past the “Accept Google Services” screen, install Android Device Policy, enroll to my enterprise, and apply the kiosk policy, install app, and done.What happens instead:After Wi-Fi and scanning the AMAPI QR token, Setup Wizard reaches “Accept Google Services”.Tapping Accept shows a spinner, then it returns to the same screen (loop). I simply can

We're building an Emm solution so while testing I enabled FRP and thought of giving it a shot.So, after factory resetting all i can see is a google window asking me to verify with the account that was previously in the device. What I cannot understand is there was no account signed in except the one google created ( the managed account with the briefcase thingy ).I'd like to understand how can i recover it now? i do have some of the device details on enterprise.devices.get endpoint.Any help would be much appreciated!Rino. 

So, we were developing our EMM solution (almost done), and now for deployment purposes, we had to apply for an initial quota via the form.apparently we got a rejection email, stating the use case violates the permissible usages which i've ready and doesnt look like we do.I'd like to reach out to those folks (or if someone can help me connect to them) and try to understand their POV and clarify in case of any mis-phrasing from my side (since english isn't my first language)Regards, Rino James

Hi, I have a situation similar to this older discussion - situation as follows:My EMM is MS Intune.Managed Goole Play Store was set up in April 2024 before the new method of creating Android Enterprise admin accounts on a managed Google domain - using a normal Gmail accountThis Gmail/Google account was forcibly deleted in the last month, presumably for inactivity, as the first linked discussion describes.Only the final termination email was ever sent to the

Friends!Lately Im getting lots of cases regarding apps not starting on our dedicated devices managed in Intune. Edge is the most common problem.If I start Google Play on an effected device I see that the app is disabled. Pressing the Enable button does nothing at all. The version of Edge installed is quite old, which is also strange since it should update automatically.Only way to fix it is to reinstall the app.Any ideas what the root cause can be and how to mitigate it?

Hello,Our users' Samsung smartphones are enrolled in Intune in COPE mode. We have a configuration profile that requires a device unlock code with an expiration time. We haven't configured a code for the work profile, so the One Lock setting is enabled by default.In Android 15, following the expiration of the unlock code, the user is now required to change the unlock code. However, once they do so, when they launch an app in the work profile, the smartphone also asks them to change the work profile code.I don't understand why the smartphone is asking to change the work profile code when the One Lock setting is enabled. Is anyone else having the same problem? Benjamin

Hi, We own and manage an asset management solution used by various clients. Recently (in the last 12 months) we have implemented an MDM/EMM type of solution that uses the Android Management API to enrol/register devices and assist clients with their asset management processes and managing risk through the Android Management API. Now, from an Android Management API perspective, we understand the permissible usage policies and believe we do comply with the requirement. When we originally started the endeavour, the quota on how many device can be registered was a default of 500 devices. We recently noted when some clients try to enrol/register devices, that during the set up process on their devices, that it states that they have reached the usage capacity limits. When we checked the project(s) associated with the clients, most have between 200 - 380 devices enrolled/registered which is below the 500 device qouta. 

During a recent review, we noticed that some of the Android Enterprise dependencies we use — specifically opencensus-api and opencensus-contrib-http-util — have not been updated for several years. --> Last release: 0.31.1 (April 29, 2022)These libraries are currently required as dependencies for google-http-client.jar, which we use to initialize HTTP clients for API calls.If we exclude the OpenCensus jars, the application fails at runtime with missing class errors. Therefore, these jars are currently mandatory for successful execution.However, from a security perspective, our central security team does not allow bundling outdated or unsupported dependencies.We would appreciate your guidance on the following points:Are there any plans to update or refactor google-http-client.jar to remove or upgrade its dependency on the legacy OpenCensus libraries?Is there an alternative ap

Hey everyone,   Episode 3 of The Secure Element went live last month!    @Bigdogburr  (our go-to security expert) sat down with Brian Wood from Google’s Device Security and Privacy team to unpack how devices get approved for use in the US federal government.   Spoiler: it’s not simple!    From government-approved labs running tests, to annual re-certifications, to the role of NIAP (National Information Assurance Partnership) — there’s a lot going on behind the scenes to make sure devices are truly secure and trustworthy.   When you’re looking at ne

Hello community, I am trying to install a client certificate on fully managed Android devices. The devices have been enrolled via Android Management API. The docs show that there is a OncCertificateProvider policy, but it says it is "not generally available". What does that mean? Will it be available in the future? Where can I apply for using this policy? The specific thing I want to achieve is configuring Cisco AnyConnect/SecureClient with cert authentication. The managed config of the Cisco app allows me to set a "KeyChain Certificate Alias", but I first need to get the cert into the Android

Hi there! I am implementing Zero Touch enrollment for our newly purchased Android devices. It is working well and our testing devices end up in "Fully Managed" state after enrollment. I have been wondering if the enrollment could be adjusted so the device ends up in "Work profile on corporate-owned" (WPCO) state instead. I have done a little research and Android spec should allow a device to end up in WPCO state after it is enrolled via Zero Touch. Is this end result achievable with following combination?Device: Samsung with Android 14Enrollment: Zero Touch during device setupEMM: Google WorkspaceGoogle Workspace AFAIK does not have any switch for this in UI.Could the management mode be configured during Zero Touch by using DPC extras set in Zero Touch portal? Developer oriented documentation suggests this is govern

Hello, good afternoon everyone. I'm writing to this forum to ask for help. A few weeks ago, I applied for the EMM and Enterprise Android Partner program. My application was rejected without any explanation in the emails. I'd like to know the requirements to join the program. We are a development company based in Guatemala and the United States (and soon in Mexico and Colombia), as we currently have a client requesting an MDM system for their Android device retail store.This is our first time applying to this program so we can offer our services to this client and any future clients who might be interested. If you could send me the program requirements so I can apply correctly, I would be very grateful.  Have a good afternoon. Greetings from Guatemala.

Hi, we have a few Zebra devices registered for zero-touch and plan to use zero-touch for all regular mobile devices. the registration and all existing accounts linked to it was created by team members that are unfortunately no longer with us.i do have access to one account with administrator permissions but the account with the "owner" permission was not handed over and credentials are basically lost. which steps are necessary to recover ownership?

I am experiencing inconsistent behavior with QR code provisioning for Android Enterprise and am seeking guidance from the community.The Issue:QR code provisioning works intermittently, but the failure pattern is inconsistent. A provisioning QR code generated from a specific APK build will work reliably. However, subsequent builds of the exact same source code from the same Android Studio project will sometimes fail. The device displays a generic "Contact your IT admin" error.What I've Verified:The APK is properly signed and the checksum in the QR code is correct.The server delivers the APK with the correct application/vnd.android.package-archive MIME type.The DeviceAdminReceiver is correctly declared in the manifest and the associated XML resource exists.The package name and component name in the QR code are 100% accurate.Compa

Hi We have a custom MDM app which was built to enroll android devices with Device Owner. We have a backend which serves the configuration requires to install/block apps and settings. We are not using Android official management APIs,  A few days ago we received a google play protect update on some of our devices and now whenever we try to enroll the devices using QR code enrollment it gets blocked by google play protect. Please help us understand what is required to bypass this so that we can continue to use our custom MDM app. thanks!

Hello Android Enterprise Community,I’m trying to set up my MDM, but I keep encountering the following error:"Someone at testmdm.xyz has already signed up."I have previously attempted to remove the Android Enterprise enrollment from my domain, unlinked the MDM, and followed all standard steps. However, I am unable to re-register the MDM, and my attempts to enroll devices fail.I would greatly appreciate guidance on:How to fully clear any previous Android Enterprise enrollment associated with my domainSteps to re-register an MDM successfullyAny best practices or troubleshooting tips to avoid this issue in the futureThank you in advance for your help. Any advice from experienced admins or Google support is highly welcome.@jasonbaytonBest regards,Khaled

Hello everyone, I’m reaching out from my company as we have encountered an issue with the installation and use of personal digital certificates issued by FNMT (Spain) on Android devices managed through Google Workspace MDM. The certificates install correctly, but apps that should use them (e.g., for Wi-Fi authentication or access to internal services) do not detect or recognize these certificates. We have tested on unmanaged Android devices, and the certificates work fine there, so it seems related to Google Workspace MDM management. We’ve confirmed with the certification authority (FNMT)  that their certificates comply with standards. Google mentioned that MDM should not block certificates unless there is a policy configured to do so. However, this problem seems to persist regardless. Additionally, other companies have reported similar issues with personal certificates issued by different certification

Hello, Since android 15, some characters are not taken into account correctly. For example the tilde character is showned on top if you use an external keyboard (Alt Gr + "é")  and is showned on the middle of the character if you use the onscreen keyboard. Example in android 16 (but 15 seems to be the same): On external keyboard: "˜"On onscreen keyboard: "~" In our barcodes we sometimes use this character and thus it is an issue after updating to Android 15 the devices in production. does other French people see this or any character change ? (It seems the "¨" also changed)@Lizzie , is there someone in your contacts we can discuss / exchange with on this topic ?  

We are developing a solution using Android Management. While enrolling a fully managed device, provisioning now fails with:- "Can't set up device"- "Since your organization reached its usage limits, this device can't be set up." This did not occur until yesterday. We are trying to determine whether this quota limit is enforced by the Android Management API (EMM side) or by Google Workspace when connecting to a third‑party EMM. If the limit is on the EMM side, is the quota granted per project? We have two Google Cloud projects using the Android Management API; the issue is only affecting the newer project. Questions:1) Where can we monitor quota usage for Android Management?2) If we have reached a quota, is there a way to remove previously enrolled test devices, and would that resolve the issue?3) Where can we find detailed information about quotas and currently enrolled devices?

Hey,Unfortunately there are no settings and/or no chance configure Widgets on COPE in MS Intune. There is specific setting in Intune restrictions config profile to allow/disallow Widgets for BYOD method.Is this problem tied only MS Intune or is this something for Google? Majority of our 10k fleet enrolled as  COPE and it's a big gap not having widgets available for Work Apps.ThanksJarmo 

Have a bit of an emergency where after the latest Gboard update, when users tap an input field, instead of Gboard just showing up as normal, a menu bubble is appearing instead where they have to tap it and select the "show on screen keyboard" option.  I haven't been able to locate Google's release notes for Gboard to see if there was something that changed.  Any ideas would be greatly appreciated!

Hi everyone,We're running into a certificate issue with our Android Enterprise deployment and hoping someone here has encountered something similar or can point us in the right direction. We're using Microsoft Intune as our MDM solution with COPE and COBO enrolled devices. This affects all Android devices regardless of manufacturer, including Google Pixel devices running Android 16 with the latest security patch. The devices use SCEP certificates for Wi-Fi authentication.In early September, we rolled out new Root CAs via Intune. These new Root CAs are used for creating SCEP profiles for Wi-Fi authentication. The devices now have both the old, still valid Root CA and the new Root CA installed. The problem occurs when a device tries to obtain a new SCEP certificate issued by the new Root CA. In this case, the Android device attempts to verify the certificate chain using the old Root CA, which fails because the certificate was issued by the new Root CA. As soon as the old

Hey there, this is my first post here as I could not find a ticket system for Zero Touch.  Since a couple of weeks all new devices only getting the "Enterprise Default Profile" automatically assigned which I deleted during zero touch tenant setup in "Configurations".The default profile I created does not get automatically applied anymore. Unfortunately I can change the default assignment profile to whatever I want but newly added devices still are getting the "Enterprise Default Profile". Changing the device profile after the initial upload (including wrong DPC info) to the created target profile works in bulk. Once changed manually the devices apply the correct DPC. Multiple zero touch instances are affected. How to fix the default assignment profile for newly added devices? Any suggestions?

Even after switching from APK to AAB, I noticed longer build times and higher storage use. What strategies or Gradle tweaks have worked for you to optimize Android game bundles?

I am unable to create my work profile on Microsoft In tune. I have recently purchased OPPO A6 Pro