Recent discussions
Custom app installation with AMAPI
Thanks to the keen eye of jasonbayton for spotting this update in the documentation: https://developers.google.com/android/management/manage-custom-apps The lack of this feature has been a key reason I've avoided any AMAPI based EMM (looking at you Intune!) for fully managed device deployments. This is certainly a welcome enhancement to AMAPI and one that I'm honestly surprised Google delivered on. I think I can finally see the writing on the wall that Custom DPC will eventually now die given that AMAPI is finally catching up. I still need file system push and pull for it to truly be a replacement but this is a major step in the right direction. What are the community thoughts on the matter?mattdermody2 days agoLevel 2.3: Gingerbread7Views0likes0CommentsSupport for a Single VPN Instance Shared Across All Users on a Corporate-Owned Device
Hello everyone, I am exploring how to reduce resource usage on corporate-owned Android devices that are configured with multiple users or profiles. Currently, Android's VPN framework is per-user: Each user (or work profile) maintains its own VPN state. An Always-On VPN can only be configured within the context of the current user or profile. This means that if a device has several users, each user needs to run a separate VPN instance. This design results in unnecessary duplication: Multiple VPN processes or tunnels are active on the same device. System resources (CPU, battery, memory) are consumed redundantly. The VPN app itself must be installed and configured multiple times. My request/idea: Enable a single VPN instance at the device level (not just per-user), so that one VPN tunnel can secure network traffic across all users and profiles. This would: Greatly reduce resource waste. Simplify deployment and management for IT admins. Prevent the need for each user or profile to maintain its own VPN connection. Questions for the community and Google team: Is there any existing mechanism (documented or OEM-specific) that allows a VPN to operate at the device scope rather than user scope? Are there any roadmap plans to support device-level VPN in Android Enterprise? If not currently supported, could this be considered as a feature request for future Android versions? This would be particularly valuable for dedicated devices and shared device scenarios where multiple users must access corporate resources, but IT only wants to maintain one VPN tunnel. Looking forward to your insights and to hear whether others face the same challenge. Thank you.Fxzxmicah2 days agoLevel 1.5: Cupcake73Views0likes8CommentsAndroid Developer Verification Requirements in AE
taking a page from jasonbayton's LinkedIn post I wanted to post and discuss the announcement from Google yesterday and their upcoming Android developer verification requirements. This is something that fully managed devices with customer supplied applications will run into, and it will cause issues on devices A while ago Google stated that they wouldn't scan customer-sideloaded applications with GPP if they were fully managed. See here: https://www.androidenterprise.community/discussions/conversations/is-there-any-way-to-disable-google-play-protect-gpp-from-an-emm-or-to-otherwise-/2507 Would this requirement fall under the same umbrella?remlap3 days agoLevel 1.6: Donut91Views2likes8CommentsNew devices only receive "Enterprise Default Profile" instead of default profile
Hey there, this is my first post here as I could not find a ticket system for Zero Touch. Since a couple of weeks all new devices only getting the "Enterprise Default Profile" automatically assigned which I deleted during zero touch tenant setup in "Configurations". The default profile I created does not get automatically applied anymore. Unfortunately I can change the default assignment profile to whatever I want but newly added devices still are getting the "Enterprise Default Profile". Changing the device profile after the initial upload (including wrong DPC info) to the created target profile works in bulk. Once changed manually the devices apply the correct DPC. Multiple zero touch instances are affected. How to fix the default assignment profile for newly added devices? Any suggestions?kvko4 days agoLevel 1.5: Cupcake943Views0likes7CommentsIntune now showing tenant name on lockscreen
Hi everyone, As of some weeks, Intune started showing the tenant name on the lockscreen. Where it used to say "this device belongs to your organisation" it now says: " This device belongs to company name" . Since this is a big no for most of our customers, I was wondering if other people noticed this as well and maybe even found a solution for it. Microsoft support admitted that they changed this, but they will now help us getting it fixed or even giving us the option to enable or disable this. Showing the company name on a device can make a device more interesting to people who might find a lost or stolen device. Therefore, we never show company names or logo's on the lock screen. And most customers we work with expect that kind of behaviour. We currently have to project on hold because if this detail. (And its costing us extra business because they are not buying the hardware that comes with it 😅) I hope someone else is having more luck! In the meantime I'm escalating this via other companies in our group with better MS connections but those take some time. And if you haven't noticed this issue, please be aware of it. As far as we know, only Intune has done this. Knox, Workspace one and Mobile Iron are not showing this message. Samsung has replied that this is absolutly not right in their opinion. Its a big risk for companies.Michel4 days agoLevel 3.0: Honeycomb1.3KViews1like30CommentsIs there any way to disable Google Play Protect (GPP) from an EMM or to otherwise whitelist apps from scanning?
I am very concerned about the Enhanced GPP features coming soon that are currently being piloted in other regions. https://security.googleblog.com/2023/10/enhanced-google-play-protect-real-time.html This is not a welcome feature whatsoever for the fully managed space where we have business apps written internally that are being installed on business devices, owned by that business. In no way do we want Google sitting in between deciding whether a very legitimate app written internally for an organization should be installed on devices that are purchased and owned by the same organization on fully managed devices. I would like a way to disable GPP completely, or at a minimum whitelist applications from scanning as we don't want Google interfering in the business operations. GPP is a helpful consumer protection features but fully managed devices should have the ability to be opted in or out of the program. Otherwise GPP can incorrectly flag a mission critical app and disable or remove it from a device, thereby bringing down a line-of-business application and an end customers operations. While the intentions of GPP are good, by blocking business apps Google themselves is becoming the malicious actor that GPP is ironically trying. to prevent.Solvedmattdermody4 days agoLevel 2.3: Gingerbread40KViews15likes58CommentsDisable random mac address during EMM enrollment
My company is trying to provision tablets via headwind MDM. We have no problem on some of our networks, but the location they are being provisioned at at-scale have a strict no-random-mac address rule on their network. Thus far I have been unable to figure out how to create a QR code that will disable random mac address on the SSID of the network the device connects to when enrolling in our MDM. Is there a field I am missing? Surely there must be a way to overcome this.AFahmy4 days agoLevel 1.5: Cupcake123Views0likes12CommentsOrganization reached its usage limits, your work profile can't be set up.
We have a fleet that is managed with Android Management API that we use for pre prod testing. We started getting `Organization reached its usage limits, your work profile can't be set up` error recently in this enterprise. It had about 800 device when i did the list devices call. I have now removed the older devices and the list device call now returns 84 devices, but I still see the above error when trying to enroll new device. Its been about 2 days since i deleted the devices. Also been about 2 days since i have filled up https://docs.google.com/forms/d/e/1FAIpQLSf4VCzblf27V6jx1_iFt7lD1WjyCDpSDzQcxunTbQdbkEGG4Q/viewform to increase the quota for registered devices. Is there any way to investigate this issue? Can I check the registered devices qouta anywhere in GCP console? Are there any other case where I can see this error? I am seeing this error for both work profile and fully managed device.SolvedNeed explaination of following feature implementation for AER -3.19. Application track management
I have implemented the following feature and I can set application track from my emm console but not understand what to show for validation or how it will further works after set app track info. Thanks in advance.mhfaruk5 days agoLevel 2.0: Eclair39Views0likes1Comment
Explore other customer resources
Help Center
Explore step-by-step how-to guides.
Solutions Directory
Find solutions and partners.
Website
Discover more about Android's features.