[Feedback] App installs: share your experiences & suggestions

Hi Lizzie,

A couple of things come to mind with regards to working with apps on android (smartphones and tablets for me):

• App version management
  • This is now done within an MDM that supports version management (WS1, Knox Manage and more) 
  • It would be nice to have such a feature in MGP making it available to every managed device without waiting for an MDM to implement it, or not. 

• Some apps require specific rights, causing Android to prompt the user for approval. In some cases, you just want to make the device work as expected without involving the end user. Prompts do not always appear, depending on the app, and end users might ignore them making the app not work properly
  • I'm aware that this is expected behaviour due to privacy regulations. But on a fully managed or dedicated device, you could say that the end user is using a device work purposes only (in theory). I would rather see that I'm able to set all needed permissions for an app, and notify the user that some privacy related permissions are given to an app instead of asking the user to set it. 

Hi Lizzie,

I believe that a truly "fully managed device" should require no hands-on setup by the user.

The current process often requires employees to manually accept special permissions and other requirements after the device has completed it's Android Enterprise provisioning setup. This can include granting permissions to settings like accessibility, alarms and reminders, and appear on top. To make the process smoother and reduce employee effort, we should automate the acceptance of these permissions.

When devices need to be reset in the field, a common troubleshooting step for managed devices - we often rely on employees to handle the provisioning process again. This can be confusing and lead to errors, especially for those unfamiliar with the setup. 

I'd like to see an update to the current limitation of only six apps (one kiosk, five others) being set as required for setup. Many companies have more than six prerequisite applications, so increasing this limit would be a significant improvement.

Additionally, the ability to roll forward and roll back applications would be incredibly helpful for managing app updates. This would allow us to quickly revert to a stable version if a new update causes issues, ensuring maximum device uptime.

Thanks for this great feedback!

I agree, there's strong difference in requirements between devices setup by an IT Admin (or whiteglove-service 3rd party...) in advance vs. setup by the employee intended to use the device.

Re: maximum apps limit - let me look into this.  Who is your EMM?

I agree with the others, especially on those points:

• App versions can be managed per MDM
• App-Op Permissions can be allowed for Work Managed per policy

We primarily use COPE devices and prohibit sideloading, as this is one of the highest security risks. A few users are bothered by this because they would like to install apps from the F-Droid store in a private context.
At the end of July, a “southern German” newspaper wrote about european (/open source) solutions. Almost half of the article was about Google Play (vs. F-Droid) and Android (vs. e/OS). Unfortunately, the article treated “open source / data protection” as synonymous with “security” and made some interesting statements like "Safer app store: F-Droid instead of Google Play". When people read something like this, they tend to believe the statements at first and don't question them.

Currently, sideloading can only be generally allowed or prohibited. If you wanted to offer alternative app stores, you would have to be able to whitelist individual apps for sideloading/app installations. However, this still presents a chicken-and-egg dilemma, because the store itself must first be installed via sideloading. This installation in particular must be trustworthy, otherwise someone could slip in a manipulated app and cause a lot of damage. 

I can't think of a good solution, but we keep getting questions about the F-Droid store. I get why people want open source apps without tracking or ads. But for security reasons, we always have to say no to these requests.

I think i mentioned this already several times (always in case of COPE or fully managed!):

We need one of the following things:

• Possibility to grab the original apk files from play store, to use app deployment from MDM side (if available) to have full version control (ofc only for free apps, paid apps must be then requested from the developer).
• Recommended: To get full version control via managed play store
  • Choose update option per app:
    • Always update (always to latest version)
    • Install/stay on x.x.x (available versions need to be read out from playstore), needs to be changed if you choose a new one
    • Never update (stays on the version intially installed)
  • Permissions set per app (not asked for yet from my side):
    • Show all permissions in an option available on the system
    • Already tick the ones the app would request
    • Possibility to tick permissions not asked by the app but you want to grant
    • Possibility to untick permissions asked by the app but you don't want to grant

Or even both to have the best experience...

Whats possible in our MDMs for Android Enterprise:

Intune: Only possible to install apps from managed google play store

WS1: Install from google play store and upload apk-file from console.

Issue is Google Managed store requires an unique appid even for private apps, can this restriction be removed for private apps. Thanks!

Pretty please 😇

We use COPE for almost all devices and what we often see is that app updates in the work profile are not successful because of these:

• App updates in personal profile are not automatically applied. Sometimes you have to guide users even to install all pending updates before you can complete the work profile app updates.
• App updates in work profiles are paused because there is a incompatible version of the same app installed in the personal profile. (I can remember the exact error text).

Bit late to the party, but here is my input.

Some background: We have an intentionally simplistic MDM for use in high security environments were external connectivity is sporadic at best and often on air-gapped networks. As such installation of apps via the Play store is just not an option. We are currently enhancing our MDM with "app store" like functionality for use in closed environments on fully managed (DO) devices only.

This has actually been going quite well until Friday when Google Play Protect suddenly started blocking our DPC (but that is in another thread).

The main thing I would have liked to see was an ability to delegate silent app installs/uninstalls to a dedicated app rather than have to have it embedded within the DPC itself. It's not critical, but it would be better separation of concerns.