Android Enterprise General Discussions

Hi there,I have a couple of Lenovo K11 wifi only models and the reseller has uploaded the serial number into our AZT account, the device has been assigned a configuration profile which is the same used for mobile phones.Problem i have is the tablets setup like a personal device and not a corporate owned, i’ve reset the tablet and had the reseller upload the serial number but still the same outcome.Intune isnt connected to our AZT account and i don’t know how else to troubleshoot this. The following “DPC extras” is what i used for the tablet setup{    "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver",    "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "I5YvS0O5hXY46mb01BlRjq4oJJGs2kuUcHvVkAPEXlg",    "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://play.google.com/managed/downloadManagingApp?identifier=setup",    "android.app.extra.PROVISIONING_ADMIN

We’re having an issue with Android Enterprise.We have registered Android Enterprise via and MDM Solution.Now when we detached our Android Enterprise on the MDM solution and enrolled on a new MDM Solution, we can no longer claim the domain and we cant even log in to Android Enterprise either.

Hi,We are experiencing an issue. We have delete our organisation from a user account linked to Sophos Central MDM. This organisation is still bound to multiple end user devices which cannot access the Google Play Store and we cannot enroll any new devices. We have the organisation ID and the user account, we are looking for a way to restore the organisation to the account. Do anyone know if it is possible to reverse what we have done and restore an organisation ID to the account?Regards, MattMc

Hello all, We're facing an issue with our Intune/Managed Google Play connector. Google has deleted the account set up specifically to connect to our Managed Google Play instance in Intune. This has been an active link, with the last new device registered about 2 weeks ago and apps on devices being updated since then. We are currently unable to enroll new devices or add new apps. We are also unable to attempt to recover the account and have not been able to find a way to contact Google directly about the account issue. Barring being able to recover the account, are there ways for us to lessen the impact of creating a new account for the linkage? Or are we going to have to have all our Android BYOD users re-enroll their devices?

Hi All, just wondering if Android Auto will work for fully-managed (COBO) Samsung devices enrolled into Intune, or COPE for that matter?  Is there anything official from Google on this?  Does anyone have any advice on getting it to work or any gotchas along the way?

Hello,For several weeks now, we are facing an issue in Samsung Contacts app about searching contacts in our Exchange Global Address List.This feature has worked flawlessly for many years, and now when we search for a contact in Exchange GAL, contact is found but when we try to open it Samsung Contacts app fails to open contact and shows “Contact not found”.Thank you for your help.Regards,

Working on a large-scale deployment of Android-based devices with key requirements:• Android 14-  Google Play Store support- Compatibility with enterprise MDM platforms- Long-term lifecycle support (5 years OS patches and version upgrades) Specifically looking for guidance on the below:Is GMS certification mandatory for devices that include Google Play Store in such deployments? Is Android Enterprise essential for stable MDM integration?  For kiosk / signage use cases, is EDLA certification recommended or required? Any known challenges with 5 years OS patches and version upgrades?

One of our customers has replaced 150 devices currently in zero-touch with 150 new devices. The 150 older devices need to be removed. Is there a way to select and remove them all at once from the zero-touch portal?

Hello,I wanted to know if it is possible to access the applications installed via the Play Store through an MDM without going through the MDM.I found this link:https://play.google.com/work/licenses/appsBut it only shows which applications have been approved to be added to the MDM, and not the number of applications installed on the device fleet.Thank you for your help.Best regards,Titouan 

Our enterprise account’s primary contact has left the company, and his email is no longer valid. We are unable to update this information ourselves. We need to regain access to our company account to complete Zero Touch Enrollment for a batch of pending mobile devices.Is there a way to change the primary contact to this account? Any guidance or support would be greatly appreciated. Thank you so much!

Basic set up: Managed Google Play + Intune Devices all set up as "Corporate-owned, fully managed user devices" Policies are set to allow all apps from store and to allow other accounts to be installed on devices. GSuite individual Google accounts with corporate email addresses signed in to all devices to allow for things like Photos backup.  Problem: When migrating a user to a new device, some apps cannot be installed. When a user is signed into Google Play with their Google Account, any app that is already linked to their Google Account from their previous device (for example: WhatsApp, Samsung Notes, Translate), cannot be installed with the error "Your administrator has not given you access to this item". If I sign the user out from their Google account, install the app and then sign them in again, it all works fine, but this should not be necessary. It seems like the problem is stemming from the Play Store not liking the fact that th

Hi everyone,I’m encountering a persistent issue where users on MDM-managed devices (specifically Samsung devices using Knox) are unable to complete the Two-Step Verification (2FA) setup in WhatsApp.Whenever they attempt to set a PIN, they receive the following error:"Not possible to perform two-step authentication at the moment. Please try again in a few hours."After analyzing the system logs, I found strong evidence that the management policies are interrupting the authentication activities. Here are the key findings from the logs: Forced Activity Termination: The system triggers a finishIfPossible command on the 2FA activities (TwoFactorAuthActivity and SettingsTwoFactorAuthActivity) immediately after they are collected in a transition. MDM Policy Interference: The logs show ApplicationPolicy (part of the Knox management layer) checking the state of the WhatsApp package precisely during these transitions.   Input Channel Disposal: There are multiple W/InputManager-JNI warnings in

Hi all, I’m currently working on a project involving the CIS level 1 and 2 benchmarks (https://www.cisecurity.org/benchmark/google_android ). The goal is to configure this in an EMM (not choosen yet). Most of the rules listed in that PDF can be matched with an API (its hard work, wish Android had done this as they did for STIG 😂), but there is one that I can’t trace back to an API.In the Managed Google Play store there is a setting called Improve harmful app detection which they recommend to set to enabled. But I don’t want a user to be able to toggle this on or off, I need it to be forced on.  Does someone now if its even possible to configure the following via an EMM? 

Hey! We recently noticed that a banner is displayed on https://play.google.com/work/apps . According to this, /work will be terminated on April 15. I am aware that the page is generally somewhat outdated and is intended for deprecated EMM APIs. (e.g. https://developers.google.com/android/work/play/emm-api/v1/products/approve ) /work has always been useful for us when it comes to getting a first impression of an app. By replacing /store with /work in the store URL, you could see immediately whether the app was available for Managed Play and offered an AppConfig.https://play.google.com/store/apps/details?id=com.google.android.apps.tachyonhttps://play.google.com/work/apps/details?id=com.google.android.apps.tachyon Will the pages be discontinued without replacement, or is there an alternative? (I mean, yes, you can see everything in the iFrame, but the hurdle for /work was very low and therefore very practical).

IT administrators can set different policy responses based on the device's Security Risk value, including blocking configuration, clearing company data, and allowing continued registration. The EMM service will enforce this policy response based on the results of each integrity check, and the default option does not allow registration to continue. I don't know how to implement the above requirement. My EMM uses AMAPI, and I couldn't find the corresponding fields that can be implemented in the policy

my company is a ZT reseller in France , but does not appear in the French country list . how can i correct this ? 

Hi, As an organisation we are pretty new to ZT. We had good success when testing two devices. We enroll them through ZT and manage through Intune. This worked on our test device (Lenovo Tab K11). I set up a Token separate from the default created on the ZT -> Intune Link. We recently bought 120 Lenovo K11 tablets to set up using the same profile, however we used a new reseller. They added these to our portal.  I assigned the token this morning. Then, when I connected the devices to the internet. No profile was present, it continued with the non Dedicated device set up. I did see a message about potentially waiting 48 hours for the profile to apply. Is this accurate? I waited at least 4 hours and no success.  Do you have any advice or steps to trouble shoot? We have checked the DPC extras Token is correct and used alternate networks to avoid issues with filtering/firewall. We have run SW upgrades on the tablets and Factory reset and re tried. I trie

Hello, We are a large corporate and mostly use Samsung phones as Android devices. Enrolment is being done via ZT portal to a default profile which is Corporate Owned Work Profile provided via Microsoft Intune. We are noticing an increased amount of cases where users set up their phones (no QR code, no text token) with default configuration added using DPC extras and within first few hours they would reset to a factory default state without any notice. This has become a real issue as it is affecting more and more people. Devices enrolled without ZT do not suffer from this issue, even though they are using the exact same enrolment profile. I saw many posts like this here and elsewhere on the internet, but no actual solution. What is the problem here and is it being actively looked by Google?

HelloWe have started using Datalogic Mobile Computers and I recieved a couple of devices that was running Android 13.I then updated them to Android 15 using Datalogics image and Espresso extension. All good, device is happy.We updated the Scan2Deploy agent on the device to latest version.We then did a Factory reset and wanted to enroll the devices into Intune.I created a simple profile in Scan2Deploy with Wi-Fi setup and enrollment. Scanned the QR at the end but then the device runs through few steps and end up on a screen saying “Getting ready for work setup”. Nothing else. Just stuck there.After an hour I reset the device and created a new profile with my phones Hotspot as Wi-Fi to bypass any possible firewall in our company. But the reaction was the same. I could see that the device got 86.77mb of date on the Hot-spot connection and then stuck at “Getting ready..” again. I tried leaving it for the night but it never moved on.The strange thing, is that the exact same enrollment profi

Dear Sir/ Madam,My name is Dominic Ho from “China Mobile Hong Kong Ltd”, we are one of the Samsung Mobile reseller. We have awarded a tender from Hong Kong Police Force recently. and We have deployed the device to HKPF around 1 weeks ago. we then try to perform the “Zero Touch” registration, however, due to the staff has resigned from Our company, We then mistakely input the wrong password many times, and find out the Google Account (**CM - updated to remove personal information) seems now under the “Account Disable” Status.A.) Appreciate to learn how to re-activate the Google Account (**CM - updated to remove personal information) B.) May be we also need to create another “Backup Account” for preventing this situation happened again. 

What is a Managed Google Domain?   In Android Enterprise land, a Managed Google Domain refers to using a Google-managed organisation (like Cloud Identity or Google Workspace) to create and manage the connection to an EMM (the bind), it sits in contrast with Managed Google Play accounts, which uses a “personal” Gmail account to manage enterprise devices and apps.    In practical terms, it means Android management is tied to an organisation’s work domain (e.g. @company.com), managed through the Google Admin console, rather than being tied to a single @gmail.com account. This approach unifies Android management with other Google services (Workspace, Chrome, etc.) under one organisational account, and is not only the default approach for all newly-binding organisations, but recommended by Google as an upgrade for all existing managed Google Play accounts enterprises due to the benefits it provides to IT admins and employees.   Historically, organisa

Hi ​@CoreyC, ​@Lizzie, ​@Emilie_B,as you may remember we still wait for a solution to a reported Wifi Settings issue (in 2024).Our EMM has creaed a Google Case Number also long time ago: 403486364It seem not going forward but we really would like to push for this going further (as i tried now for long time via PM’s etc.). Can you tell me something on this? For anyone else if interested, the issue is:We lock the Wi-Fi settings via Soti Mobicontrol Feature Control profile but keep the possibility for the user to turn it on/off:As soon as it takes place, the Wi-Fi settings are locked (as expected) but the status bar also disables the possibility to turn Wi-Fi on/off: Because of this the user isn’t able to turn Wifi on/off anymore even we allowed it through the profile and it was working before and started (if i remember correctly) with Android 14 and stays still with Android 15 and 16.We want the user again to not do changes on Wifi but being able to turn it on/off if needed.

we are migrating away from intune and we have brought in Jamf for our apple devices but desperately need our application approved for our Android enterprise development. we need to be able to configure app using per app vpn access for our BYOD and also for our corporate devices. Can someone let me know how long this usually takes? or a means of contacting android about this? 

Hello everyone,I’m new to Intune and I have a small question. I am deploying Android tablets in COBO mode (Corporate-Owned, Fully Managed) and I would like the user to be required to set a PIN code during deployment.Which enrollment token should I use? And what configuration or compliance settings do you usually apply to make the PIN mandatory?Thank you in advance for your help! 😊

Hello all,I'm trying to deploy a Dedicated device profile in Microsoft Intune, I created the configuration profiles and the compliance policy with some settings, in specific about PIN creation and complexity, but during the setup users are not asked to enter any PIN, and at the end the device result non-compliant until the PIN is set and is fulfilling the rules I set.Is there by any chance a way to force the PIN creation request during the enrollment phase as happens for user-associated devices? Thanks in advance/Lucius