Changss to contacts permissions in Android 18 & enterprise contacts sync

Hello!

Looking at the announced contacts changes, coming with 18, could the Android Enterprise team clarify the deployment path for enterprise contacts sync apps?

My contacts app generator, like other enterprise directory tools, supports background synchronisation into a dedicated enterprise account. The intended deployment is straightforward: IT deploys and configures the app through EMM, grants the required permissions, and contacts become available without the user needing to configure anything.

The announcement recognises enterprise background sync as a use case for MANAGE_CONTACTS, which is helpful. However, eligibility to use the permission and actually granting it on managed devices are two distinct steps, the latter unclarified.

If users must manually enable access through Settings > Special app access, that introduces a dependency on user action into an otherwise unattended deployment. Even with Play approval, the directory cannot be populated until that step is completed.

We already encounter similar friction when users need to enable other special permissions like accessibility for remote support, or usage access for things like data/app usage reporting. Some need assistance, some never complete the process, and some managed environments restrict access to Settings. For contacts, that could leave users without their corporate directory or with an existing directory that stops receiving updates.

Could Google clarify:

1. Will device owners and profile owners have a supported way to grant MANAGE_CONTACTS without user interaction, including on fully managed devices, dedicated devices and within work profiles?
2. Will existing deployments with administrator-granted WRITE_CONTACTS receive any migration treatment, or will users need to enable special access when the app adopts the new target SDK?
3. Does eligibility explicitly include one-way enterprise directory sync into an app-owned account? The announcement specifically describes continuous, two-way synchronisation.
4. How will this work for private managed Google Play apps and apps distributed directly through an EMM?
5. If an enterprise grant mechanism is planned, will it be available and documented before enforcement?

I am all for reducing unnecessary access to contacts. My concern is preserving reliable, administrator-authorised directory provisioning.

If manual user approval is the only supported route, this would be a deployment regression for enterprise contacts sync. A supported policy grant, ideally scoped to the managed profile or the app’s own account where appropriate, would address that concern.

​@Lizzie ​@Kirk could I kindly request some eyeballs on this please? 👀