Android Enterprise General Discussions

Hello,On our Ivanti Neurons MDM, we use this API to retrieve IMEIs:getImei() in TelephonyManager is equivalent to:getImei(getDefaultSim());So when the only sim is inserted in the second slot:getImei() is the same as getImei(1) causing duplication in the report.Ref:https://android.googlesource.com/platform/frameworks/base/+/b6587ea/telephony/java/android/telephony/TelephonyManager.java#843 The API used to retrieve IMEIs seems to target getImei(getDefaultSim()), which causes problems with eSIMs that use IMEI2.It therefore retrieves IMEI2 as the default IMEI, which can cause problems with registration console

Hi, we are using MS Intune and Google Zero Touch Portal, and a large number of Zebra scanners.We created several profiles in ZTP with DPC extras (JSON) to link the devices to the corresponding Intune enrollment profiles.However, when the scanners are set up and connected to wifi, they will not identify as company devices, but continue setup in "private" mode.I assume there is a problem in our JSON config, but I could not find it. I already checked some other discussions in this forum, but could not yet find a solution. Apologies, if this problem should already be resolved, then I am happy if you point me in the right direction. :) Thanks very much and best regardsTobias

First, do Android support using Fido2 keys on Android?Yes, it does support both using bluetooth, NFC and USB authentication.For reference: https://developers.google.com/identity/fido/android/native-apps But does it mean that it is straight forward to use it in a enterprise environment without hiccups?No, the support lacks many features that both Windows and iOS has supported for long time. If I buy a modern Fido2 with OTP support, will it work straight out of the box for using the USB?No, you need to disable the OTP support first. Here is how you can do that from yubikey manager, this works for Yubikey.Other vendors might have something similar. But for Fido2 keys without OTP support, it should work out of the box for USB-C, like

 Hello, We have observed a significant change in S-Pen behavior following the integration of Google Scribe into Android 15 / 16 on our Galaxy Tab Active 5. Previously, the stylus allowed cursor movement (or select an write area) within text fields without triggering handwriting input. This was essential for our use case. Our technicians are working in proximity to high-voltage electricity and must wear protective gloves. The stylus is their only means of interacting with the tablet during operations. With the recent change, the stylus now immediately writes in text areas instead of moving the cursor, making it impossible to position the cursor without touching the screen with a finger (which is not feasible in our environment). Before with old firmware (Android 14): https://youtube.com/shorts/RXaPRRXaNcs?feature=

Basic set up: Managed Google Play + Intune Devices all set up as "Corporate-owned, fully managed user devices" Policies are set to allow all apps from store and to allow other accounts to be installed on devices. GSuite individual Google accounts with corporate email addresses signed in to all devices to allow for things like Photos backup.  Problem: When migrating a user to a new device, some apps cannot be installed. When a user is signed into Google Play with their Google Account, any app that is already linked to their Google Account from their previous device (for example: WhatsApp, Samsung Notes, Translate), cannot be installed with the error "Your administrator has not given you access to this item". If I sign the user out from their Google account, install the app and then sign them in again, it all works fine, bu

Hello everyone,We are currently facing an issue where Google Play Protect is blocking our Android application during device provisioning.Context: - It is not distributed via Google Play (but is already published); it is hosted externally and installed during provisioning via QR code.- The app is properly signed, and provisioning works at the system level, but Play Protect blocks the app with the message “App blocked to protect your device.”- This started happening recently on new devices / factory reset devices. We have already submitted the official Play Protect appeal form as recommended in the documentation:The form was completed with all required information (APK, package name, signing certificate, use case, etc.).At this point, we are looking for guidance from the community: - How long does it usually take for the Play Protect appeal form to receive a response or decision?-

Hi everyone, I’m from ManageEngine MDM, and we’ve observed that Picture-in-Picture (PiP) mode does not work when a device is in Lock Task (Kiosk) mode. In our deployments, the device is configured as Device Owner, and we use DevicePolicyManager#setLockTaskPackages() to enable kiosk mode. However, when an app attempts to enter PiP using enterPictureInPictureMode(), it does not function while Lock Task mode is active. We are receiving multiple customer requests for this capability, particularly for use cases such as:Video conferencing apps running in PiP while a primary kiosk app remains in the foregroundMonitoring/streaming apps that require PiP overlay within a controlled kiosk environmentEnterprise-dedicated devices that require limited multitaskingWe would appreciate clarification on the following:Is PiP intentionally re

I am the IT admin/owner of our Android Zero Touch instance, and I am trying to log into the portal to view and interact with devices associated with our organization. Our zero touch instance is linked with our Intune tenant, and is working correctly.  I keep getting the error that my sign in was rejected because it doesn't meet my organization's 2 step verification policy and to contact my IT admin for more information. I am that IT admin, and I can't login. My login information is correct, I have our account ID, and I'm just trying to get in touch with someone to help with the login. I can't even login to support portal to get help, so I had to use my personal Google account to post this.

After correctly completing the configuration of my MDM with the ZTE account, getting this error while registering the device:"Cant finish setup. Zero touch enrollment isn't available. Check your internet connection and try again." Things already cross verified:The internet connection is stable. The EMM setup contains the correct signin url and the zte account contains the correct extra enrollment token in configuration. The device is assigned the correct configuration. The service account allowlisting google form is also approved.  The signin url api never got hit during the enrollment of the device and just got this error message. 

Hello, I have built a device management system using Android Management API. Devices are enrolled in Device Owner mode. After enrolling Samsung devices (especially newer models like Samsung A07), I noticed that Samsung Smart Switch does not work anymore. On older Samsung devices, Smart Switch works even after enrollment. But on newer Samsung devices, Smart Switch does not work once the device is enrolled as Device Owner. I am not using any third-party MDM solutions only Android Management API. My questions:Is Samsung Smart Switch blocked automatically when a device is enrolled in Device Owner mode?Is this expected behavior on newer Samsung devices?Is there any policy configuration that allows Smart Switch to function while still using Device Owner mode?Is this a Samsung restriction or an Android Enterprise restriction? I would appreciate any clarification on this behavior.Thank you.

Hello,I have built a device management system using Android Management API. Devices are enrolled in Device Owner mode. After enrolling Samsung devices (especially newer models like Samsung A07), I noticed that Samsung Smart Switch does not work anymore. On older Samsung devices, Smart Switch works even after enrollment. But on newer Samsung devices, Smart Switch does not work once the device is enrolled as Device Owner. I am not using any third-party MDM solutions  only Android Management API. My questions: Is Samsung Smart Switch blocked automatically when a device is enrolled in Device Owner mode? Is this expected behavior on newer Samsung devices? Is there any policy configuration that allows Smart Switch to function while still using Device Owner mode?Is this a Samsung restriction or an Android Enterprise restriction?warning screen shot is

Hi All, just wondering if Android Auto will work for fully-managed (COBO) Samsung devices enrolled into Intune, or COPE for that matter?  Is there anything official from Google on this?  Does anyone have any advice on getting it to work or any gotchas along the way?

Hi, I have 2 configurations in my zero touch portal and our vendors have been adding devices.  For some reason, the configuration I have set as default is not applying and I don't see anywhere else to make changes.  Any help would be appreciated. Thanks! JT

We got all our new company Samsung phones added into Samsung Knox. None of the distributors we work with are Android Zero Touch partners; we've asked them to join and they probably won't any time soon.  I read that there's been some effort to unify Samsung Knox and Android Zero Touch, although in many cases it still seems like EMMs have better support for Android Zero Touch whereas Samsung would prefer you use their in-house EMM. We would like to try using the Android Zero Touch enrollment as well. Unlike Samsung, it seems like I can't even register my own customer account. So my questions: is there any possible way to get just a Zero Touch customer account set up, with no devices added, when none of the resellers I actually bought a device from are Android partners?  Also, is there some way I could get some of our Knox enrolled devices to use Zero Touch?

We are a company specializing in providing financial services to low-income clients in buying all type of phones. Recently came across this app on Google Device Lock Controller and we understood this would help us a lot. I searched for how to apply to be a financial partner to be able to integrate it within our systems but maybe I am missing something. Can anyone suggest how I should conntact google for this service?

Based on the SecurityRisk value of the device, different policy responses are set. What interface should my EMM call, or which field in the policy should I use? Currently, my EMM is using AMAPI. I am confused about how to operate in response to this requirement

Hello,We use WorkspaceONE UEM as our MDM. We sometimes use provisioning profiles to deploy commands to devices run-intents, but I'm not an expert on this subject by any means. I am curious if it is possible to use our MDM to deploy an API command to disable Factory Reset Protection. The command information is here: https://developer.android.com/reference/android/app/admin/FactoryResetProtectionPolicy I realize what a specific question this is. If I can provide more information, please let me know. Thanks in advance!

Dear Team, Greetings,I would like to better understand the management capabilities available for Samsung Android devices, with Intune . Specifically, I am looking for clarity on whether these devices can be fully managed through Intune instead of relying on the Samsung Knox management tool, including support for application deployment, patch distribution, firmware updates, and other administrative functions.Any slides reference would be good for my internal discussion ?.

Good Morning Everyone 🕵️   Deep within the digital infrastructure, a high-stakes mission is being prepped. Five mobility experts have been deployed to solve a massive puzzle: migrating tens of thousands of smartphones to Microsoft Intune.   The Goal: Ensure a fluid, secure, and uninterrupted transition for thousands of users.    The Battlefront: A complex landscape filled with legacy policies, mixed configurations, and strict deadlines.   It’s a race against the clock where one wrong move could start a domino effect. From scripts to security protocols—nothing is left to chance.   Failure is not an option.   Following Broadcom’s acquisition of VMware in 2023, the Workspace ONE product is now owned by Omniss

Hello, Recently our COPE profile in ZT is not functioning.The device will go through the enrollment, it gets registered correctly in our tenant (Entra/Intune) and we can get to the home screen just fine. However, after some time the device will receive the following notification:“Your organization has set up this device to be managed by your organization. If this is an error, contact your device’s provider. All data on the device will be deleted. Your device will automatically reset in 2 hour.” The config in ZT and the one in Intune match (token is correct and the DPC extras are fine). This profile was working up until 2 weeks ago.We’re stumped. We recreated a different COPE profiles with the required DPC extras as per Microsoft’s documentation, tried removing compliance policies and device configurations to make it a plain profile. No luck, still receives the reset notificat

Regarding the function of configuring the login URL, I have configured the signUrl for the enterprise, and then obtained the signinEnrollmentToken of the enterprise through get, and placed its qrcode into the QR code. When I configure the device, my device redirects to the configured signUrl page, and then after successfully logging in by entering the account and password, I need to call enrollmentTokens.create. However, how can I obtain my enterprise id? Is there any good suggestion

***This survey is now closed***     Hello everyone,   As 2025 comes to a close and we look toward a new year, this is often an excellent time for reflection.   It has been a busy year, and we've so enjoyed speaking with you and seeing the interact with other community members.   The Android Enterprise Customer Success team is dedicated to ensuring that our programs and resources—including the Customer Community, The CAFE, and Advisory Services—are useful, enjoyable, and impactful for you and your teams. As we head into 2026, we’d love to hear directly from you!   Would you mind sparing less than 5 minutes (I’ve been assured it won’t take a minute more 😀) to complete our Customer Success Products CSAT survey and share your overall experience please?   The survey contains multiple sections for each custome

Hi all, For Apple (iOS/MacOS ) we use the macos security compliance project tooling (https://github.com/usnistgov/macos_security#readme) for mapping compliance guidelines. A short summary: The macOS Security Compliance Project (mSCP) is an open‑source framework that provides automated, customizable security guidance and baselines for macOS, producing documentation, audit checklists, configuration profiles, and remediation scripts. It supports major security standards, including NIST SP 800‑53, NIST SP 800‑171, DISA STIG, CNSSI 1253, CIS Benchmarks, CIS Critical Security Controls v8, CMMC 2.0 Levels 1–2, and the Netherlands BIO baseline. I haven't found such a project for Android, as anyone aware of such a project that maps security guidelines to available API's for Android Enterprise?  Michel

I'm developing a custom MDM solution using Google Android Management API. Successfully created enterprise enterprises/LC02x32bm6 with work email domain, but getting:"Can't set up device. Your organization has reached its usage limits."Key Details:Enterprise created successfully via APIEnrollment token generated successfully0 devices currently enrolledCloud Console shows 0% API quota usageBilling account linked to projectGET /api/enterprise/callback → Returns enterpriseNamePOST /api/enterprise/enrollment-token → Returns enrollment tokenDevice enrollment → ❌ "Usage limits" errorHas anyone encountered this "usage limits" error with 0 devices?Android Management API usage is 0%. Any insights appreciated! Happy to share code snippets or AP

Combining zero-touch with the login URL, I'm not sure how to complete this process for my EMM. Regarding the login URL, I'm not sure how to configure it. I'm not quite clear on how these two should be combined