Recent discussions
Issues with use of Personal Digital Certificates on Android Devices Managed via Google Workspace MDM
Hello everyone, I’m reaching out from my company as we have encountered an issue with the installation and use of personal digital certificates issued by FNMT (Spain) on Android devices managed through Google Workspace MDM. The certificates install correctly, but apps that should use them (e.g., for Wi-Fi authentication or access to internal services) do not detect or recognize these certificates. We have tested on unmanaged Android devices, and the certificates work fine there, so it seems related to Google Workspace MDM management. We’ve confirmed with the certification authority (FNMT) that their certificates comply with standards. Google mentioned that MDM should not block certificates unless there is a policy configured to do so. However, this problem seems to persist regardless. Additionally, other companies have reported similar issues with personal certificates issued by different certification authorities, which suggests a possible systemic incompatibility or configuration issue within the Google Workspace MDM environment affecting the proper functioning of these certificates. Has anyone else experienced this? Are there known workarounds or configuration tips that could help? Any insights or advice would be greatly appreciated. Thanks in advance! Francisco
SCEP Certificate Fails with Multiple Root CAs on COPE/COBO (Works on BYOD)
Hi everyone, We're running into a certificate issue with our Android Enterprise deployment and hoping someone here has encountered something similar or can point us in the right direction. We're using Microsoft Intune as our MDM solution with COPE and COBO enrolled devices. This affects all Android devices regardless of manufacturer, including Google Pixel devices running Android 16 with the latest security patch. The devices use SCEP certificates for Wi-Fi authentication. In early September, we rolled out new Root CAs via Intune. These new Root CAs are used for creating SCEP profiles for Wi-Fi authentication. The devices now have both the old, still valid Root CA and the new Root CA installed. The problem occurs when a device tries to obtain a new SCEP certificate issued by the new Root CA. In this case, the Android device attempts to verify the certificate chain using the old Root CA, which fails because the certificate was issued by the new Root CA. As soon as the old Root CA is removed from the device via MDM, the certificate verification works as expected. Interestingly, the entire process works without any problems on Android devices with personal enrollment (BYOD). We've tested creating a new SCEP profile, but unfortunately that didn't help. Only removing the old Root CA solved the problem. The issue now also occurs with BYOD devices as well. Has anyone dealt with a similar situation during a Root CA migration on Android Enterprise devices? We're trying to understand why COPE and COBO devices behave differently than BYOD devices in this scenario, and whether there's a configuration we're missing that would allow both Root CAs to coexist properly during our transition period. Thanks in advance for any help you can provide.
GSF ID not generated after device enrollment on Android 15
Hi everyone, We’re facing an issue with devices running Android 15 — after successfully enrolling them in our Android Enterprise setup (Device Owner / Fully Managed mode), the Google Services Framework (GSF) ID is not being generated. This issue did not occur on Android 13 or 14; the GSF ID was available immediately after enrollment. However, on Android 15, the GSF ID remains empty even after waiting and rebooting. We’ve already tried: Factory reset and re-enrollment Checking Google Play Services version Ensuring the device is connected to the internet Waiting for Play Store sync Despite that, the GSF ID is still missing. Could anyone confirm if there’s a known change in Android 15 related to GSF ID generation, or if additional permissions/configuration are required for enterprise-enrolled devices to obtain it? Any guidance or workaround would be greatly appreciated.You're Invited! Join us for the upcoming Android Enterprise CAFÉ Takeover!
Hello Community Members, The Android Enterprise team is excited to invite you to our upcoming in-person CAFÉ Takeover events in New York City and Paris! What is the Android Enterprise CAFÉ? The Android Customer Advisory Forum for Enterprise (CAFÉ) is an exclusive, invite-only group of customers who actively engage with the Android Enterprise Product team. As a member, you get a front-row seat to the future of Android Enterprise. Look out for more details about the Android CAFÉ in a future post. Join Us for the CAFÉ Takeover! We’re opening the CAFÉ experience to non-CAFE members with two in-person events. This is a fantastic opportunity to meet the Android Enterprise team, network with your peers, and share your feedback directly with us. These events are exclusively in-person. CAFÉ Takeover: NYC Date & Time: October 14th 10:00am (9:30 Check-in) Location: Google NYC RSVP here CAFÉ Takeover: Paris Date & Time: October 21st 10:00am (9:30 Check-in) Location: Google Paris RSVP here Please note: These are customer-only events and registration confirmation is required to attend. Space is limited, so please RSVP at your earliest convenience to secure your spot. We look forward to seeing you there! Best, The Android Enterprise Team
Gmail does not show certificate selection dialog when "exchange_login_certificate_alias" is not specified in managed configuration
Hi, I am trying to configure Gmail to work with Exchange ActiveSync within a work profile via managed configuration according to the documentation - https://support.google.com/work/android/answer/7065453 The following parameters are specified: "exchange_host", "email_address", "exchange_username", "exchange_authentication_type" (allow_modern_authentication) The "exchange_login_certificate_alias" parameter is not set. I expect that the user will have to select a certificate via the system dialog. But as a result of such a configuration, the certificate selection dialog is not displayed to the user. The mail setup process is interrupted and the error message "Try again later, or contact your IT admin" is displayed However, if I specify any random value in the "exchange_login_certificate_alias" parameter, the certificate selection dialog is displayed. I would like to know whether this is expected behavior or a known issue? Versions Info Gmail client - 2025.08.25.800175820.Release Android 13-16
URGENT: Unable to complete action required for account verification
2 of our accounts got emails this morning that we have to verify our org address because it no longer matches. However, going through verification we get an error at the end to contact support.... going through the support system and answering their questions led to the below need help ASAP as it states we will lose all our apps on July 10th!!!
getting ready for work setup get the issue of something went wrong your app cannot become device owner by the qr code provisison by json in android
i am facing the issue in android 14 or 15 when ever i build the unsigned build it work fine for the android 13 after that it give the error like something went wrong please contact to the it admin and i am build the singed build it give error for the checksum error cannot setup but same thing if i make my app as a device owner by adb command it work fine for me let me know how to fix this issue? i try to replace the checksum and i match both checksum both are same it getting error for me why? below is my mention qr code json, {"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.abc.abc/com.abc.abc.utils.receiver.MyDeviceAdminReceiver", "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "F-EJlegNKdVupdJupPmWz34s2INjWVUDS5ErL-DuETc=", "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://downloadapk", "android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED": true}
QR code provisioning - Run OEM Wizard
Hi, I've got a device owner app I've written, it's working well when I install it via a QR code, but I want the stock Pixel / Moto setup wizard to run during / after the device owner setup wizard. I've done quite a lot of research, this doesn't appear to be easy! Any pointers / leads in the right direction to how I might achieve this would be greatly appreciated. Methods, source code to read, etc. Thanks, Richard
