Android Enterprise General Discussions

We're experiencing an intermittent issue with Managed App Configuration on Android Enterprise devices and are looking to understand whether others have seen similar behaviour.Environment:Android Enterprise Dedicated/Fully Managed devices Honeywell devices (CT32 and EDA series) MDM: Hexnode Application: UKG Pro Mobile App configuration deployed via Managed App Configuration through Android EnterpriseIssue:From time to time, and without any obvious trigger, the UKG application appears to lose its managed configuration (tenant URL and related settings). Users are then unable to access the application as expected.What we've observed:The device remains enrolled and managed. The policy is still present within Hexnode. Other device management functions continue to work normally. Re-syncing the policy from Hexnode immediately restores the configuration and resolves the issue.The behaviour appears random, and we have not yet been able to identify a clear pattern related to device model, Android

Hello,We are looking to implement the functionality to provision eSIM profiles on devices with Android 15+. However, we encountered a telecom provider that requires the EID of the devices before providing us with the eSIM activation code.In this initial stage, we are simply trying to obtain the EIDs of all devices so that we can send them to the telecom provider and receive the eSIM activation code in return. To obtain the EID, we are using the following approach: `euiccManager.createForCardId(slot).eid` However, we are encountering this issue as noted here:*Must have carrier privileges on subscription to read EID for cardId=0 [java.lang.SecurityException: Must have carrier privileges on subscription to read EID for cardId=0]* The same issue occurs with `euiccManager.eid`.According to the documentation mentioned above, Android 15 introduced the possibility of managing eSIM profiles without requiring carrier privileges. However, it seems that the same should also app

I know that some new Google Play Console accounts are able to publish apps without completing the testing requirement. However, I don't know exactly how they are doing it. I would like to understand the process and the conditions under which a new Play Console account can publish an app directly to production without going through the testing phase. in individual account

I am using Android Management API to build my own device management system. I am not an Android partner, but I integrated Android Management API into my platform.I successfully enrolled a device, and on the device side it shows as enrolled correctly. Also, in the enrollment history/logs, I can see that the device enrollment was successful.However, the problem is that the device does not appear in the active devices list/system dashboard after enrollment.So currently: The device shows as enrolled on the physical device Enrollment history/logs show successful enrollment But the device is missing from the active/managed devices list Could you please help me understand why this happens and how to resolve it?

Hi @Lizzie,We have Microsoft Intune connected to Managed Google Play since 24/06/2020 using a Gmail account. We have 468 Android devices enrolled and cannot disconnect.When we try to use the Upgrade option in Intune to migrate to a corporate domain account (*hidden), Google returns the error: "Someone at xxx.com.br has already signed up."We cannot identify who originally registered the domain on Android Enterprise side. We need Google support to either:Release/migrate the domain binding so we can reconnect properly through IntuneMicrosoft support confirmed this must be resolved on Google's side. Can you help escalate this? *Email domain hidden in line with Community Guidelines

I am very concerned about the Enhanced GPP features coming soon that are currently being piloted in other regions. https://security.googleblog.com/2023/10/enhanced-google-play-protect-real-time.html This is not a welcome feature whatsoever for the fully managed space where we have business apps written internally that are being installed on business devices, owned by that business. In no way do we want Google sitting in between deciding whether a very legitimate app written internally for an organization should be installed on devices that are purchased and owned by the same organization on fully managed devices. I would like a way to disable GPP completely, or at a minimum whitelist applications from scanning as we don't want Google interfering in the business operations.  GPP is a helpful consumer protection features but fully managed devices should have the ability to be opted in or out of the program. Otherwise GPP can incorrectly flag a mission critical app and

Hi everyone I am struggling to create an AE policy for COPE devices (in our case Samsung) to allow developers to sideload apps into the work profile for testing and debugging purposes. We are using Intune and the only policy (beside enable Development mode) which should affect this behavior is enabled: Is there anyone else who tried this already? In our scenario the app is installed via adb install into the personal and work profile. After a few seconds DPC is removing the app from the work profile… 03-17 09:56:09.195 1010307 4220 32308 I clouddpc: [PackageChangeHandlerImpl.kt:handlePackageInstalled:349] CloudDPC didn't request play to install the package com.company.staff.android.debug, and it wasn't sideloaded by CloudDPC.03-17 09:56:09.195 1010307 4220 32308 I clouddpc: [PackageChangeHandlerImpl.kt:resetReapplySchedule:457] About to schedule policy re-apply for : [blockApplicationsEnabled, playStoreMode, crossProfilePolicies, applications]03-17 09:56:09.196 10316 6724 6724 I BudsCon

We’re currently using a mix of Android 13 and 14 devices (specifically Zebra mobile computers). With some recent update, across all applications users see popups to perform autofill on form inputs. We’re currently using SOTI’s Mobicontrol EMM along with SOTI’s Surf browser. So this isn’t limited to Chrome.This also occurs on the Search Apps input field.Is there any way to completely disable this? It’s causing significant impact.

Looking for input from other AMAPI customers / EMM operators.We run a small managed Android fleet using Android Management API +Android Device Policy. The workflow is dedicated-device, kiosk-modeas default state, with periodic supervisor-driven transitions in andout of kiosk for short operational windows.Our pain point is latency on routine kiosk transitions. When we PATCH adevice's policyName from a non_kiosk variant to a kiosk variant, timefrom API call to device-side behaviour change varies enormously:  - Best case:  ~30 seconds (Cloud DPC awake)  - Typical:    3 to 8 minutes  - Worst seen: >4 hours (Cloud DPC asleep on idle devices, especially                on certain Vivo Funtouch builds)Verified via device.lastStatusReportTime. Cloud DPC on idle devicessimply doesn't check in often. Our own WebSocket channel delivers in<300 ms RTT, so the latency is in the Cloud DPC poll cadence, not inour code or network.What we've already done:  - Play Integrity attestation  - Stable app

Hi Community,we're running shared Android devices (1,000+) with Microsoft Managed Home Screen (MHS) enrolled via Intune in Dedicated Device mode.The Problem: Users couldn't open PDFs from within apps – the "Open with…" picker dialog never appeared, so files simply didn't open.Microsoft's suggested fix: Add the system app with package ID android to the allowed apps list in MHS and include it in the Device Restrictions policy. After deploying this app, the "Open with…" dialog started appearing correctly and PDF opening works as expected.Before we roll this out to 1,000+ devices, we have two questions:1. What exactly does enabling the android system app unlock? The package android is essentially the Android framework / core OS package. We're not sure what capabilities or UI surfaces get exposed by whitelisting it in MHS beyond the intent picker. Does it give users access to any system settings, dialogs, or functionality they shouldn't have on a kiosk/dedicated device?2. Is there a safer o

Looking for input from other AMAPI customers / EMM operators.We run a small managed Android fleet using Android Management API +Android Device Policy. The workflow is dedicated-device, kiosk-modeas default state, with periodic supervisor-driven transitions in andout of kiosk for short operational windows.Our pain point is latency on routine kiosk transitions. When we PATCH adevice's policyName from a non_kiosk variant to a kiosk variant, timefrom API call to device-side behaviour change varies enormously:  - Best case:  ~30 seconds (Cloud DPC awake)  - Typical:    3 to 8 minutes  - Worst seen: >4 hours (Cloud DPC asleep on idle devices, especially                on certain Vivo Funtouch builds)Verified via device.lastStatusReportTime. Cloud DPC on idle devicessimply doesn't check in often. Our own WebSocket channel delivers in<300 ms RTT, so the latency is in the Cloud DPC poll cadence, not inour code or network.What we've already done:  - Play Integrity attestation  - Stable app

I recently updated Android Studio to the latest version, and since the update I am unable to install any plugins from the Marketplace or from disk. Every attempt results in an error saying the plugin cannot be installed or downloaded.Here is what I have already checked: My internet connection is working normally Firewall settings are fully open for Android Studio Proxy settings are configured correctly and match Android’s recommended configuration I also tested the same process on my MacBook, and I get the exact same error I tried restarting Android Studio, invalidating caches, and reinstalling plugins manually — nothing works The issue started only after updating Android Studio   It seems like Android Studio is unable to reach the plugin repository even though the network is fine.Question: What could be causing Android Studio (on both Windows and macOS) to fail when installing plugins after an update, and what steps can I take to fix this?

We are observing an issue with Android Management API Lost Mode state synchronization.Issue Summary: When Lost Mode is exited manually by the user on the device (by entering the correct device password/PIN), the device successfully exits Lost Mode locally. However, the Android Management API device resource continues to report the device state as LOST.Environment:Android Management API Android Device Policy Lost Mode initiated using START_LOST_MODE command Device owner / fully managed deviceSteps to Reproduce:Issue START_LOST_MODE command using Android Management API. Device successfully enters Lost Mode. Verify device resource state changes to: "state": "LOST" On the device, manually unlock Lost Mode using the correct device password/PIN. Device exits Lost Mode successfully on the device UI. Fetch device resource again using: enterprises.devices.getObserved Behavior:Device UI exits Lost Mode successfully. However, API response still returns: "appliedState": "LOST" Issuing STOP_LOST_MO

Android Enterprise managed Play application deployment issue observed recently:In multiple deployments, managed applications are correctly approved, assigned, and synced to devices, but installation intermittently fails on select devices with errors related to missing or invalid install IDs (“No install ID found”).Behavior observed: Same application installs successfully on some devices within the same policy/group Affected devices remain stuck in pending/not installed state Policies, compliance, and Play configuration appear correct Issue appears intermittent and difficult to reproduce consistently Troubleshooting already performed: Clearing Google Play Store and Google Play Services data Republishing applications Re-adding apps from Managed Google Play Refreshing/re-syncing devices Reprovisioning affected devices Android bug reports have now been collected from impacted devices for deeper analysis.Interesting edge case because the deployment request successfully reaches

I created a custom dpc and was testing it . In order to validate the frp i did a factory reset on my device from the boot menu . I got a lock at the top asking for the device owner's mail id . It entered it.But it kept on saying " please sign in with on of the owner's account for this device"I mean how can it be wrong it is hard coded in my dpc code. I am really annoyed would really appreciate some help . P.S. -> The phone was mint stock didnt had any mail id set, before installing the dpc.

I am currently developing an EMM using the official AMAPI. For the requirement of "eSIM silently (without user interaction) downloaded to the device and successfully activated", it is required to directly call the interface to download EISM without using an activation code. However, the activation code field in the AddEsimParams field of the AMAPI interface is a mandatory item. How can I implement this feature

I'm hoping a Google person can help check the status of our quota request, as we've submitted the Android Enterprise Response Form twice with no response.We are Childsafe, a UK-based company developing Simple MDM — a commercial EMM solution for small businesses that manage company-owned Android phones and tablets. Our GCP project ID is simplemdm-production.Our project has the default Safety Quota of 0 devices, so we are completely unable to enrol any devices for testing or deployment. We submitted the quota request form twice:- First submission: 7 April 2026- Second submission: 1 May 2026Both submissions included a full business justification, DUNS number, company website, and supporting documentation. We selected "Apply for initial quota on new AM API project code."We have received no response — no approval, no rejection, no request for further information.Could anyone  confirm whether these submissions were received, or advise on how to get them reviewed?

I have built my parental control and safeguarding app and it is now tamper proof which means children cannot uninstall or bypass it.  I have overlayed an educational AI chat bot, provided controls for doom scrolling, provided controls to monitor apps for key words and phrases to immediatly inform parents if their child is having inappropriate discussions.  This is along with the usual screen time, app controls and location tracking.  Imagine my fustration when I applied for more that 500 amapi devices to be told that Google does not see parental controls as a valid business case for amapi.  Why is Google not allowing its technology to be used to address one of the most pressing issues in the world?  I am at a loss as to why when Google has provoided this technology to all major corporations that it is saying it cannot be used by parents?  I have built an MDM explictly for parents and Google is saying it cannot be used.  Does anybody have any idea as to why Google refuses amapi to be us

I’m building a parental control app that relies on Device Owner mode. This worked fine on older devices (e.g. Samsung Galaxy S8 running Android 8/9), but it fails on a Pixel 10 Pro running Android 16.Process:I factory reset the Pixel.At the welcome screen, I scan a QR provisioning code.The QR downloads my signed APK, installs it, and should activate it as the Device Owner.Problem:On Android 16, the app is installed but Device Owner is not activated.In Settings > Device Admin, my app is listed, but the toggle is off.My MyDeviceAdminReceiver never fires — I see no provisioning broadcast (PROVISIONING_COMPLETE or PROVISIONING_SUCCESSFUL) and no debug logs.Here is my provisioning json as a starter - juyst in case I am doing something stupid!!{ "android.app.extra.PROVISIONING_MODE": "device_owner", "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.xxxx.yyyy/.MyDeviceAdminReceiver", "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://test.app

Our very own ​@jasonbayton has an article on this topic that is a few years old, but has recently been updated.https://bayton.org/android/gpsu-system-updateJason is often ahead of the pack when it comes to understanding what new versions of Android bring, and I am incredibly thankful for the research he does and the education he provides to the community. In this case, an article he wrote several years ago is only just hitting my doorstep now. This is largely driven by the fact that new versions of Android, thankfully, do not propagate immediately into the production world of dedicated enterprise use. We are only really starting to see Android 14 show up in any material way now.With that, we are now being exposed to the fact that even more components and modules have been included in the Mainline system through Google Play System Updates. One of these modules appears to be the cert store containing the system certs. Recently, we encountered a major production outage caused by a root ce

First, do Android support using Fido2 keys on Android?Yes, it does support both using bluetooth, NFC and USB authentication.For reference: https://developers.google.com/identity/fido/android/native-apps But does it mean that it is straight forward to use it in a enterprise environment without hiccups?No, the support lacks many features that both Windows and iOS has supported for long time. If I buy a modern Fido2 with OTP support, will it work straight out of the box for using the USB?No, you need to disable the OTP support first. Here is how you can do that from yubikey manager, this works for Yubikey.Other vendors might have something similar. But for Fido2 keys without OTP support, it should work out of the box for USB-C, like Google titan.  Why this happens, dont know.Can we use NFC for Entra ID authentication like we can on Windows and iOS?No. Android does not currently support CTAP2 for NFC, only for USB-C input. CTAP1 (FIDO U2F) supports certificate based authenti

Hello, We are a large corporate and mostly use Samsung phones as Android devices. Enrolment is being done via ZT portal to a default profile which is Corporate Owned Work Profile provided via Microsoft Intune. We are noticing an increased amount of cases where users set up their phones (no QR code, no text token) with default configuration added using DPC extras and within first few hours they would reset to a factory default state without any notice. This has become a real issue as it is affecting more and more people. Devices enrolled without ZT do not suffer from this issue, even though they are using the exact same enrolment profile. I saw many posts like this here and elsewhere on the internet, but no actual solution. What is the problem here and is it being actively looked by Google?

We are device owner app. We use DevicePolicyManager.addUserRestriction with UserManager.DISALLOW_MODIFY_ACCOUNTS and DevicePolicyManager.setAccountManagementDisabled(..., true) for all account types listed by AccountManager. In the settings the user can't add or delete accounts, or sign in to new account gmail. But the user can sign in i.e. in OneDrive, and when he does, the account appears in the settings. Is this alright by design? Or is there some other ways to block adding accounts to the system by other apps?

Hi there to the community.I am setting up data sharing across the personal Google Calendar app, and the work profile Google Calendar app. Currently, I am testing the solution with the Test DPC app, just to understand behaviour and settings of the split environment.I connected Google Calendar apps, so I can view events from the personal calendar in the work profile app, together with work events.However I can't get the opposite, so work events are not visible from the personal app, despite apps connection. Of course, this is very confusing.How can I fix the issue?Thanks a lot.