Level 1.6: Donut

Question

Google Photos not showing on Managed Home Screen allow-list on Samsung Galaxy A25 5G (Android 15) - Confirmed system app issue

Forum|Forum|9 days ago
July 8, 2026
8 replies
195 views

Hello Android Enterprise Community,

I am experiencing an issue where Google Photos does not appear on the Managed Home Screen (MHS) home screen, despite being correctly configured in the allow-list. I have already contacted both Microsoft Intune Support and Samsung Support, and I would like to share their responses and seek further guidance.

Environment

Device: Samsung Galaxy A25 5G (Model: SCG33)
OS: Android 15
Enrollment: Android Enterprise - Corporate-owned Dedicated Device (Fully Managed, Dedicated)
Kiosk Mode: Multi-app kiosk (Managed Home Screen)
MDM: Microsoft Intune

Symptom

Google Photos (com.google.android.apps.photos) does not appear as an icon on the MHS home screen, even though it is correctly listed in the applications allow-list in the app configuration policy.

All other apps (Google Maps, LINE WORKS, Samsung Camera, Phone, etc.) are displayed and working correctly on the same MHS configuration.

What I have already verified

Google Photos is assigned as Required to All Devices via Managed Google Play
Device install status shows "Installed"
Android Device Policy app confirms Google Photos is listed under "Work apps that can't be uninstalled"
The applications allow-list JSON is syntactically correct and verified:

json{
"key": "applications",
"valueBundleArray": [
{
"managedProperty": [
{
"key": "package",
"valueString": "com.google.android.apps.photos"
},
{
"key": "app_available_prior_to_sign_in",
"valueBool": true
}
]
}
]
}

Device sync, reboot, and MHS pause/resume have been tried multiple times — no change
Attempted to register com.google.android.apps.photos as an Android Enterprise System App in Intune → Error: "An Android Enterprise app with package name com.google.android.apps.photos already exists"
The same MHS configuration works correctly on Google Pixel and Xiaomi devices

Responses from Microsoft and Samsung Support

Microsoft Intune Support (Case #2606190030006230)

No issues found with the app configuration policy or assignment
Noted: "If the same app exists in Managed Google Play, you cannot create an Android Enterprise System App"
Suggested contacting the device OEM (Samsung) for confirmation of the package name and system app status

Samsung Support Response

Confirmed: Google Photos is configured as a system app on Galaxy A25 5G
Confirmed: Package name is com.google.android.apps.photos — no Samsung customization
Noted: Package name management is handled by Google (the developer)
Noted: No restrictions are applied on Samsung's side for package name-based app control

Root Cause Hypothesis

Based on the above findings, the issue appears to be:

Google Photos exists as a system app (pre-installed) on the Samsung device
The same package name also exists in Managed Google Play
Due to this dual existence, Intune cannot register it as an Android Enterprise System App
The MHS allow-list mechanism may not correctly recognize/display apps that are system apps on the device, even when the package name matches

This creates a situation where:

The app is installed ✅
The package name is correct ✅
The assignment is correct ✅
But MHS still does not display the icon ❌

Questions

Is there a known compatibility issue or limitation with the MHS allow-list and pre-installed system apps on Samsung devices running Android 15?
Is there any difference in how MHS identifies a system app version vs. a Managed Google Play version of the same package?
Is there a known workaround for this specific scenario?
Has this issue been reported or tracked as a bug in Android Enterprise or MHS?

Any insight from the community or Google team members would be greatly appreciated.

Thank you.

weberda

Level 2.2: Froyo

Hi @AKiko Nagata

during Android Enterprise setup do you remove system apps or keep them with the DPC extras?

Enrollment payload “android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED” true/false

Do you have this in the MHS app config?

{
"key": "app_order_enabled",
"valueBool": true
},

You may have to set this accordingly to show the icon on the locked launcher:

{
"key": "app_orders",
"valueBundleArray": [
{
"managedProperty": [
{
"key": "package",
"valueString": "com.google.android.apps.photos"
},
{
"key": "type",
"valueString": "application"
},
{
"key": "container",
"valueInteger": 1
},
{
"key": "position",
"valueInteger": 1
}
]
},

We do deploy the Google Photos app from Google Play and do not see any issues. However you may have only unlocked the app for MHS in your app config but not placed it into your “container”

https://learn.microsoft.com/en-us/intune/app-management/configuration/configure-managed-home-screen#enter-json-data

Br

Daniel

AKiko NagataAuthor

Level 1.6: Donut

Hi Daniel-san,

Thank you for your suggestions!

1. Regarding PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED:
I checked our enrollment profile (Android-Kiosk token)
properties in Intune, but there is no setting for
PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED available
in the GUI.

Our enrollment profile settings are:
- Token type: Corporate-owned dedicated device (default)
- No device name template applied

Is there another way to configure this setting in Intune?

2. Regarding app_orders:
I tried your suggestion and added app_order_enabled: true
and app_orders with Google Photos, but it still does not
appear on the MHS home screen.

Additional information:
- Samsung confirmed that Google Photos is configured
as a system app on Galaxy A25 5G (SCG33, Android 15)
- Google Photos shows as "Installed" in Intune device
install status
- Android Device Policy confirms Google Photos is listed
under "Work apps that can't be uninstalled"
- The same MHS configuration works correctly on
Google Pixel and Xiaomi devices
- Microsoft Intune support confirmed no issues with
our app configuration policy

Do you have any other suggestions?

Best regards,
Akiko

weberda

Level 2.2: Froyo

Hi @AKiko Nagata

hm okay… How do you know whether the new settings from Intune are applied on the device? Sometimes it takes hours… It’s always hard for me, so I im curios how you do it.

No you cannot configure this within the UI of Intune. We do use KME/Zero Touch for device enrollments and provide the specific details there if needed.

If you do not use either of these enrollment methods and use the QR Code enrollment method you can use https://bayton.org/qr-generator-dpc/

(Credits to @jasonbayton !)

In fact this would be the content for a QR Code. You have to set the enrollment token from the enrollment profile in Intune into the JSON to create the correct image.

{
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "I5YvS0O5hXY46mb01BlRjq4oJJGs2kuUcHvVkAPEXlg",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://play.google.com/managed/downloadManagingApp?identifier=setup",
  "android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED": true,
"com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "PLACEYOURENROLLMENTTOKENHERE" 
}

weberda

Level 2.2: Froyo

Did you see this workaround? (Clearing data & cache for MHS)

https://www.reddit.com/r/Intune/comments/z2l811/google_photos_disappearing_from_managed_home/

AKiko NagataAuthor

Level 1.6: Donut

Hi Daniel-san,

Thank you for sharing the Reddit workaround!

We found the solution described by mgrb1337:
"Go to Android Settings → Apps → Managed Home Screen
→ Storage → Delete Data"

We will try this by:
1. Setting exit_lock_task_mode_code in our MHS config JSON
2. Exiting kiosk mode using the PIN
3. Clearing MHS data in Settings
4. Checking if Google Photos appears

We will report back with the results!

Best regards,
Akiko

jasonbayton

Level: 4.1: Jelly bean

Something to consider - on Pixel and other devices Google Photos is _the_ gallery app, while Samsung uses their own version. This can explain why some devices have it enabled by default while others show installed but inaccessible.

So you’ve got Google Photos deployed as a Public app from within intune, that should remove any other obstacles I can think of.. do you have the ability to pull a bug report? Perhaps MHS itself is falling over for some reason.

If you’re only using MHS for kiosk (no SSO, intune features) you can try your kiosk experience through my kiosk app generator here - https://gen.bayton.org - you can build a kiosk experience from scratch and deploy it as a private google play app. If that works as intended, you’ll know it’s something with MHS.

AKiko NagataAuthor

Level 1.6: Donut

Hi Jason-san,

Thank you so much for your insight!

Your explanation about Samsung using their own gallery app makes a lot of sense.

Regarding the bug report - we are using the standard dedicated device enrollment with MHS for kiosk mode (no SSO, no Intune-specific features).

We would like to try your kiosk app generator at gen.bayton.org as you suggested. Could you advise:

1. How do we deploy the generated app as a private Google Play app
through Intune?
2. Will this kiosk app support the same allow-list functionality
as MHS (showing specific apps like Maps, LINE WORKS, Camera,
Phone, and Google Photos)?

We will try this approach and report back.

Best regards,
Akiko

weberda

Level 2.2: Froyo

I tested a Kiosk config with Intune on a Galaxy A54 (Android 16 / One UI 8.5) which we have up and running for production use. The config is intended for devices other than Samsung but I was curious whether the Google Photos app will show up on the device after enrollment.

I noticed the following:

My enrollment QR code does include the setting android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED = true

After enrollment the Google Photos app was (still) present on the device.

The Google Photos app is shown in the Play Store app as “Mandatory installation”

And voila, the MHS launcher shows the app icon and let me use the app as expected:

AKiko NagataAuthor

Level 1.6: Donut

Hi Daniel-san,

Thank you for your continued support!

I have an update on our situation:

1. After re-enrolling with PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED: true,
Chrome and Gmail now appear on MHS (but cannot be launched -
they need to be added as Android Enterprise System Apps in Intune).
However, Google Photos still does not appear at all.

2. I tried to check the Play Store status of Google Photos by using
"Pause Managed Home Screen" in Intune, but on our SCG33 (Android 15),
the device screen does not switch to the normal Android launcher
even after pausing MHS. So I cannot access the Play Store directly.

3. The key difference I noticed compared to your Galaxy A54:
- Your device: Google Photos shows as "Mandatory installation" in Play Store
- Our device: We cannot confirm this as Play Store is not accessible

Could you advise:
1. What Android OS version and One UI version is your Galaxy A54 running?
(Our SCG33 is running Android 15)
2. Is there any difference in how Google Photos is assigned in Intune
between your setup and ours that could explain why it shows as
"Mandatory installation" on your device?
3. Any suggestions for how to check Play Store status on a device
where MHS pause doesn't switch to the normal launcher?

Best regards,
Akiko

Kirk

Community Manager

Just wanted to extend my thanks to @weberda and @jasonbayton for your help with this issue, you guys are awesome and it’s much appreciated!

AKiko NagataAuthor

Level 1.6: Donut

Hi Daniel-san and Jason-san,

We have a new important finding!

After exiting kiosk mode (using PIN), we checked the Play Store on the SCG33 (Android 15) and found:

Google Photos shows the message:
"This app cannot be installed due to administrator settings"

This is completely different from Daniel's Galaxy A54 where Google Photos showed as "Mandatory installation".

Our Intune assignment for Google Photos is:
- Required: All Devices + All Users ✅
- Uninstall: None ✅

We believe this confirms the conflict between:
1. Google Photos as a system app (pre-installed by Samsung)
2. Google Photos as a Managed Google Play app (deployed by Intune)

These two versions seem to be conflicting, preventing MHS
from recognizing and displaying the app icon.

Do you have any suggestions on how to resolve this conflict?

Best regards,
Akiko

weberda

Level 2.2: Froyo

Hi @AKiko Nagata

honestly, I don’t believe in a conflict about system-app and Managed Google Play. I have the same setup for many apps and never saw any issue with it. Especially Google Photos is assigned to the Kiosk-Device by whitelisting it.

I believe there is some other device configuration applied to the device which may block the app from being available.

You have this, right?

Look into this:

and maybe even into this:

Could you change the app assignment of Google Photos app to a specific Entra ID Group where the kiosk devices are member (either by dynamic rules or manual adding the device instance)? Instead of the “All Devices + All Users” setting. Just so make sure there is no conflict for Google Play in the assignment.

Do you mind to send me your enrollment QR code via PM? I could enroll my A55 device and look at the outcome. Maybe I can spot something.

Br,

Daniel

weberda

Level 2.2: Froyo

You can assign a device group in the enrollment profile.

Create a Entra ID security group, something like “Devices_Android_KioskMode”
Add the Intune AutoPilot ServicePrincipal as a group owner
Go to the enrollment config and assign the group of step 1 into the “Device groups” section
Change the assignment of “Google Photos” to have the “Required” assignment for the group of step 1 above. If you can, remove the All users + All devices or change it for your needs.

Sign up

Login with SSO

Login to the community

Login with SSO