Intermittent Loss of Managed App Configuration on Android Enterprise Devices

Thanks for the suggestion.

I don't currently have a script to clear the application cache or storage. For testing, I manually go to:

Settings -> Apps -> UKG > Storage

and clear the cache/storage from there.

One observation from my testing is that on a healthy device, even after clearing the UKG app cache/storage, the managed configuration appears to remain intact. When I reopen the app, the tenant information and other configuration values are automatically populated again.

However, on an affected device, after reopening the app, those configuration values are not automatically populated and the application behaves as though it no longer has access to the managed configuration. Re-syncing the policy from the MDM immediately restores the configuration and functionality.

This is why I'm currently trying to determine whether the issue is occurring within the Android Enterprise managed configuration delivery mechanism or whether the UKG application is intermittently failing to consume the managed configuration that Android Enterprise provides.

Thanks for the detailed response.

1. From what I've investigated so far, the AppConfig in the MDM is a clear and dedicated assignment. I also created a separate test policy containing only the UKG AppConfig and assigned it to a test device, which worked as expected. I haven't found any evidence yet that affected devices are being moved into another group or receiving another policy that would remove or overwrite the configuration, but I'm continuing to investigate that possibility.

2. We have already tested reinstalling the application, and unfortunately that did not resolve the issue. The app still launched without the required configuration. The only reliable workaround we've found so far is re-syncing the MDM policy, which re-applies the AppConfig and immediately restores functionality.

3. At this stage, we have only observed the issue with the UKG Pro Mobile app. We have a number of other applications deployed through the same MDM environment using Android Enterprise, but we haven't seen similar reports from those apps.

One interesting observation is that UKG released a new app version around 16 May. Roughly 7-8 days later we started seeing reports of missing configuration and the Punch In/Out button not loading. I don't have enough evidence yet to confirm a direct relationship, but the timing is something I'm looking into.

We're no longer using the legacy EMM API/Custom DPC or an on-premises deployment. Everything is running through Android Enterprise with Hexnode cloud management.

Your last point is actually one of the key questions I'm discussing with Hexnode Support. If they can determine whether the AppConfig is still present within Managed Google Play / Android Enterprise for an affected device before a policy re-sync is performed, that would help narrow the issue down significantly. It would tell us whether the configuration is being lost somewhere in the Android Enterprise delivery chain or whether the UKG app is failing to consume a configuration that is still present.

Thanks for sharing your experience with this ​@Yann_ROLAND, very helpful!

I just realised something, on the device that works, when I send the request : 

https://www.googleapis.com/androidenterprise/v1/enterprises/enterpriseId/users/userId/devices/deviceId/managedConfigurationsForDevice/managedConfigurationForDeviceId/app:com.application.test

I’m getting a 404 error:

{
    "error": {
        "code": 404,
        "message": "No managed configuration was found for the given id.",
        "errors": [
            {
                "message": "No managed configuration was found for the given id.",
                "domain": "global",
                "reason": "notFound",
                "location": "managedConfigurationForDeviceId",
                "locationType": "parameter"
            }
        ]
    }
}

And if I send the request that lists all the configs:

https://www.googleapis.com/androidenterprise/v1/enterprises/enterpriseId/users/userId/devices/deviceId

I’m getting the configuration correctly :

{
    "androidId": "...",
    "managementType": "managedDevice",
    "policy": {
        "autoUpdatePolicy": "always",
        "productAvailabilityPolicy": "whitelist",
        "productPolicy": [
            {
                "productId": "app:com.adobe.reader",
                "managedConfiguration": {
                    "managedProperty": [
                        {
                            "key": "enable_printing",
                            "valueBool": true
                        },
                        {
                            "key": "enable_copying",
                            "valueBool": true
                        },
                        {
                            "key": "enable_optional_sign_in_screen",
                            "valueBool": true
                        },
                        {
                            "key": "allow_document_cloud",
                            "valueBool": true
                        },
                        {
                            "key": "allow_dropbox",
                            "valueBool": false
                        },
                        {
                            "key": "allow_google_drive",
                            "valueBool": false
                        },
                        {
                            "key": "allow_one_drive",
                            "valueBool": false
                        },
                        {
                            "key": "allow_apple_sign_in",
                            "valueBool": false
                        },
                        {
                            "key": "allow_google_sign_in",
                            "valueBool": false
                        },
                        {
                            "key": "allow_facebook_sign_in",
                            "valueBool": false
                        },
                        {
                            "key": "enable_in_app_purchases",
                            "valueBool": false
                        }
                    ],
                    "kind": "androidenterprise#managedConfiguration"
                },
                "autoInstallPolicy": {
                    "autoInstallMode": "forceAutoInstall"
                },
                "trackIds": [
                    "production"
                ]
            }

…..

If I do the same requests on the device with the random issue, the first request is also sending me a configuration but that is not the right one instead of a 404 error:( I’ll not tell why it is not the right one, I just put a part of the result here for the example)

{
    "productId": "app:com.airwatch.tunnel",
    "managedProperty": [
        {
            "key": "PrivacyPolicyLink",
            "valueString": "http://www.vmware.com/help/privacy.html"
        },
        {
            "key": "DisplayPrivacyDialog",
            "valueBool": false
        },
        {
            "key": "PolicyAllowFeatureAnalytics",
            "valueString": "0"
        }
…..
    "kind": "androidenterprise#managedConfiguration"
}

And if I use the request sending all configurations:

https://www.googleapis.com/androidenterprise/v1/enterprises/enterpriseId/users/userId/devices/deviceId

I’m getting another configuration for the same app which is the right one (will not put it there but similar to the example for adobe reader).

This part has only one config for the app meaning that depending on the request I send, I’ll get configuration 1 or configuration 2. 

If I check the references:

https://www.googleapis.com/androidenterprise/v1/enterprises/enterpriseId/users/userId/devices/deviceId is meant to “ Retrieves the details of a device. “ 

https://developers.google.com/android/work/play/emm-api/v1/devices/get

and the other request is to “ Retrieves details of a per-device managed configuration."

https://developers.google.com/android/work/play/emm-api/v1/managedconfigurationsfordevice/get”

Why I’m getting 2 different answers for the same app is not clear to me, ​@Kirk , ​@Moombas , ​@Alex_Muc ​@kaartiks ​@mattdermody , any help is welcome :). Maybe the thing I see is normal but I’d like to understand.

Hey, ​@Yann_ROLAND 

Have you seen my post here?

I'm not entirely sure what you're comparing when you mention the “duplicate configs”, but September 2025, in particular, was a major deadline for the shutdown of some EMM API endpoints: https://developers.google.com/android/work/deprecations