Android Enterprise General Discussions

Since 19 Sep 2026, QR (6-tap) provisioning of Test DPC on a factory-reset device fails. After "Getting ready for work", Play Protect shows "App blocked to protect your device - Test DPC" with only an OK button, so provisioning cannot continue. The same flow worked before that date and nothing changed on our side.Setup: provisioning QR with PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME com.afwsamples.testdpc/com.afwsamples.testdpc.DeviceAdminReceiver, an HTTPS download location for the APK, and the signature checksum.APK: com.afwsamples.testdpc 9.0.12 (versionCode 9012), unmodified, signed by CN=testdpc, O=Google Inc. Signing certificate SHA-256: 8090f6630b4e8962479123249087cb4658feaae36a1b57dbeafd74d109b333dc. File SHA-256: aad38c1f608b1c7289405c4e866977f5d231502643ce2e2401a7c305808f9c00 (on VirusTotal, 1/67, a generic AdLibrary heuristic).I found the approved-DPC allowlist page (https://support.google.com/work/android/answer/16694822) and other threads about custom DPCs being blocked, but

Our corporate domain is locked by an unknown legacy Android Enterprise binding, and we need to free it to link to Microsoft Intune. We are unable to register and setup a managed google playstore binding in our new intune instance that we are now starting to leverage, as our company domain (bmc.com) is already in use. We know it was a previous IT employee who created the binding, but we have no way to break it / reregister with a new bmc email address (current one ends with .gmail). We found a support article that lead us here to “submit a support request”, but that does not appear to be an option, only posting discussions. Any assistance is greatly appreciated. 

Hi all,We manage fully managed Android devices (company-owned) used as POS/KDS terminals in retail stores, via an EMM that uses the Android Management API.Our requirement: app auto-updates (especially Android System WebView, com.google.android.webview) must not happen during store business hours, because a WebView update restarts our WebView-based app and can interrupt operations.The AMAPI reference for systemUpdate says:"If the update type is WINDOWED, the update window will automatically apply to Play app updates as well."Questions:If we set systemUpdate to WINDOWED (e.g., 02:00–05:00), will Google Play auto-updates of Android System WebView also be restricted to that window? Are there any conditions or exceptions (e.g., Android version, Play Store version, high-priority/security updates, autoUpdateMode settings) where apps are updated outside the window? Is there any other recommended way to prevent WebView auto-updates during specific hours on fully managed devices?Reference: https

We're experiencing an intermittent issue with Managed App Configuration on Android Enterprise devices and are looking to understand whether others have seen similar behaviour.Environment:Android Enterprise Dedicated/Fully Managed devices Honeywell devices (CT32 and EDA series) MDM: Hexnode Application: UKG Pro Mobile App configuration deployed via Managed App Configuration through Android EnterpriseIssue:From time to time, and without any obvious trigger, the UKG application appears to lose its managed configuration (tenant URL and related settings). Users are then unable to access the application as expected.What we've observed:The device remains enrolled and managed. The policy is still present within Hexnode. Other device management functions continue to work normally. Re-syncing the policy from Hexnode immediately restores the configuration and resolves the issue.The behaviour appears random, and we have not yet been able to identify a clear pattern related to device model, Android

I keep getting this error while trying to register, I had ae-community@google.com, but I got a reply saying “Thank you for your interest. Unfortunately, we don't provide specific feedback or details regarding application decisions.”.  I need guidance as to what the next steps are? Is there any issue with my DUNS number?

Basic set up: Managed Google Play + Intune Devices all set up as "Corporate-owned, fully managed user devices" Policies are set to allow all apps from store and to allow other accounts to be installed on devices. GSuite individual Google accounts with corporate email addresses signed in to all devices to allow for things like Photos backup.  Problem: When migrating a user to a new device, some apps cannot be installed. When a user is signed into Google Play with their Google Account, any app that is already linked to their Google Account from their previous device (for example: WhatsApp, Samsung Notes, Translate), cannot be installed with the error "Your administrator has not given you access to this item". If I sign the user out from their Google account, install the app and then sign them in again, it all works fine, but this should not be necessary. It seems like the problem is stemming from the Play Store not liking the fact that th

Hi everyone,We are building Acadhub, an education-focused Android device management solution for schools and educational institutions.Our current solution is a custom Android Device Owner / DPC-based MDM. We manage institution-owned student tablets and have built our own device-management backend and DPC.We are now trying to move toward the Android Enterprise / AMAPI ecosystem so that our solution can integrate with Google's Android Enterprise management APIs and operate as an EMM solution.We submitted an application for Android Enterprise / AMAPI access, but the application was rejected with the following reason:“Business use case not compatible with permissible usage policies.”We are trying to understand what specifically about our use case may not meet Google's requirements.Our current use caseB2B device management for schools and educational institutions Institution-owned Android tablets Student devices managed as fully managed / dedicated devices Device Owner provisioning Applicat

've noticed that the OnePlus 13 is not included in the Android Enterprise Recommended (AER) devices list, which can be found here: https://androidenterprisepartners.withgoogle.com/devices/#!?search=Oneplus.  Could someone provide insight into whether the OnePlus 10R will be added to the AER list in the near future? Your guidance would be greatly appreciated.

Hello,We use QR code provisioning to install our custom Device Policy Controller (DPC) app from a custom download URL (not Google Play).The exact same APK + QR configuration:Works on:Samsung Galaxy S20 — Android 13 / One UI 5.0Blocked on:Samsung Galaxy S21 — Android 14 / One UI 6.1Play Protect stops installation with the message:"App blocked to protect your device. This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud."Provisioning QR:{"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "<DeviceAdmin component>","android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM": "<Package checksum>","android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "<S3 bucket url>","android.app.extra.PROVISIONING_LOCALE": "en_US","android.app.extra.PROVISIONING_TIME_ZONE": "Europe/Helsinki","android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED": false,"android.app.extra.PROVISIONING_DEVICE_A

Device: Honeywell EDA52 (Android 11/13, build TKQ1.230420.001)Browser: Reproduced on both Chrome (151.0.7922.139) and Microsoft Edge, same symptom on bothNot affected: Honeywell CT32 devices on the same network/site; EDA52 devices in other locations running the same MDM profileProblemOn a subset of our Android 11/13 handheld scanners, the browser randomly stops accepting any text input, both from the physical/on-screen keyboard and from an attached barcode scanner that injects input as keystrokes. This happens intermittently during normal use of a web-based app (not site-specific, happens on any input field in any website, including a plain Google search box).Symptoms when it occurs:Tapping a key on the on-screen keyboard shows the normal "key press" visual highlight, but no character appears in the field. A connected barcode scanner still fires (beep and aiming light activate normally), but again nothing populates the field. Copy/paste into the same field still works, so the field its

Hi all, We have a customer who is trying to enable a preloaded app on our tablet running Android 16 (basic notes taking app). The tablets are enrolled in Intune in COBO or COSU mode. The package name is correct and added in the app enablement list on Intune, but they see the app stuck on “pending install” state, while it works for other apps such as our camera app. We are unsure what’s causing this, does anyone experienced a similar case and has any advice please? Thanks!

I’m trying to determine whether the https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#assistcontentpolicyis available for BYOD devices?I’m unable to determine what management types it’s available for, usually most settings state they are only available for Corporate Owned work profile devices or fully managed devices  for example. I’m trying to get support from Microsoft (Who are insistent it’s not available for BYOD) to ensure this is available for BYOD devices as we currently have an issue where privileged apps (Assistant apps i.e. Gemini) can grab the screen content from a work profile device.Thanks for your help!

We have a google account where it broke our intune connection this week. We tried to unbind then rebind and we cannot because the domain already exists and the primary account was the only admin account. That account was removed as the only admin with out our knowledge. We cannot seem to get any support on this issue and this a last ditch effort for help. Please help us!!

Hi,We run a retail fleet of Android Enterprise dedicated (COSU) devices managed by Intune, with Entra shared device mode and no Managed Home Screen. Devices are Samsung Galaxy XCover6 Pro (SM-G736B), Android 15, build G736BXXSAFYJ3, enrolled via KME, with KSP Premium, KAI and E-FOTA. All our apps are on the KSP battery optimization allowlist.This is the same environment as these two earlier threads, but the symptoms this time are different, so I'm posting it separately:"Disabled apps" (Feb 2025): https://www.androidenterprise.community/android-enterprise-general-discussions-3/disabled-apps-1156 "Intune app disabled" (May 2026): https://www.androidenterprise.community/android-enterprise-general-discussions-3/intune-app-disabled-2570What happened this time (Aug 31, ~12:00 UTC+2, one device so far):Every Intune-managed app was disabled simultaneously: Intune app, Authenticator, Remote Help, Knox Remote Help, Knox Asset Intelligence, our POS app, our own settings app. Icons were greyed out

Hello,We have some troubles in Chrome when trying to read pdf file on android. In EDGE it works perfectly. Is there someone who can explain how it works and which app (system or not) is rendering the file ? It seems that sometimes it is the device, sometimes it is the website. The behaviour also doesn’t seem to be the same in Android 16 / 17.In the Android drop last year I find : PDF in Chrome on Android: Revamp workflows with in-browser viewing of linked PDFs, which now open directly within a new Chrome tab. I’d like to attach a little video but unfortunetly it seems we can’t in the forum (or I don’t find the button :)).Steps to reproduce (I’m on a Samsung S25 in Android 17 beta)1 - Drag and drop a pdf file from the “file” app to the “EDGE Browser app”. ==> Sometimes it works, sometimes EDGE is telling it cannot access the file. ==> something not yet “production ready” ?2 - Right click on the pdf file in the “file” app and select “open with”. A window opens to propose some apps,

i got stuck with one situation and need your guidance in solving it. We have our own .apk file for android devices, these are custom in-house developed applications, i want to deploy the application to Android Fully Managed devices (Since the device belongs to company). I did it before with publishing them to google play store as a private app but now the size is the problem as it exceed 200MB, so i cannot use this option. I tried with deploying them as Line of Business application but its been 2 days nothing shows on device and even in intune portal it neither failed or success.  Question: How to deploy your custom .apk files to android fully managed devices if the file size se more than 200MB?

We use Google Chrome on Android Enterprise Fully Managed shared devices. Chrome is required for several business use cases including Chrome Custom Tabs (CCT) authentication flows and PWA/web applications.Our environment follows a shared-device model where associates check devices in and out throughout the day. While Chrome is needed for business workflows, users can sometimes reach the full Chrome browser through links opened from applications, authentication flows, PWAs, or other navigation paths.Unless I'm missing something, I have not found a supported Chrome Enterprise app configuration that allows administrators to disable or hide the Chrome address/search bar (omnibox) on Android managed devices. Current options appear to be URL allowlists and blocklists. The challenge with URL-based controls is that they can become difficult to maintain at scale. Business applications often introduce new URLs, redirects, and endpoints over time, which can create ongoing administrative overhead a

Hi i´m looking for an option to disable/clear the Advertising-ID (AD-ID) on a fully managed Device, i found the KBhttps://support.google.com/googleplay/android-developer/answer/6048248?hl=enIs there any option to remove or clear the AD-ID from EMM/MDM side without a User action? and is there any more detail information how AD-ID is working on an managed Device? Appreciate your feedbackBjoern     

Hello,We are experiencing an issue with our Android Zero-touch Enrollment account.The TD SYNNEX partner, which was previously associated with our Zero-touch account, is no longer linked. The account now appears to be owned directly by Google, with no partner associated.Could you please help us verify:Why the TD SYNNEX association was removed. The current status of our Zero-touch account. How we can re-associate a partner with the account.Thank you for your support.Kind regards,

Trying to get our Intune tenant connected so that we can start to purchase organizationally owned Android phones and manage them within Intune, similar to what we have done with Apple.  When I set up the enrollment to connect to Managed Google Play, I foolishly used my Microsoft account to connect them. I thought better of it and thought I’d try to add a different email to our tenant, and connect using this instead. I’ve tried to add this new email by inviting it through Google Admin. I get prompted to log in using my Microsoft account, when I do this, I get the following:  The user I’ve invited, still shows up as “pending” in Google Admin. What else do I need to do so I can use this new account instead of mine?

Hi,does anyone know if there's a possibility to place a feature request to Google regarding Zero-Touch-Portal?I wanted to ask if there's plaanned at any point to provide possibility to implement AD authentication to the portal.

I am trying to make a policy in Omnissa Workspace One for Gboard. I want the keyboard to be a Slovenian QWERTZ keyboard but without changing the android system language. This is because our support needs to remote control the devices and use normal mouse an keyboard then. The employees working with the devices will use gboard and this should be in slovenian.What I need:Gboard working with sl-SL from a managed config without changing system language. My current config: 

Is there any way to remotely configure the language settings in gboard and Google voice typing?  Multilingual settings are not something I have much experience with and we're looking to better accommodate associates at retail.  Thanks!

This blog post says it's now generally available but I'm not seeing it live in my tenant yet: What’s new in Microsoft Intune – MayFor those that don't know, Microsoft has been using Company Portal as their custom DPC but is now transitioning to Google’s Device Policy app to get in line with Google’s mandates. This means (among other things), enrollment will happen at http://aka.ms/enrollymyandroid instead of through the Company Portal app.If they've rolled it out to your tenant, it will look like the first image in this other blog post when you go to Devices > Android > Enrollment > Personally-owned work profile.I am curious if this is live for anyone else. Methinks Microsoft has a weird interpretation of "generally available".