Solved

Hello,We use QR code provisioning to install our custom Device Policy Controller (DPC) app from a custom download URL (not Google Play).The exact same APK + QR configuration:Works on:Samsung Galaxy S20 — Android 13 / One UI 5.0Blocked on:Samsung Galaxy S21 — Android 14 / One UI 6.1Play Protect stops installation with the message:"App blocked to protect your device. This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud."Provisioning QR:{"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "<DeviceAdmin component>","android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM": "<Package checksum>","android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "<S3 bucket url>","android.app.extra.PROVISIONING_LOCALE": "en_US","android.app.extra.PROVISIONING_TIME_ZONE": "Europe/Helsinki","android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED": false,"android.app.extra.PROVISIONING_DEVICE_A

  Hey Android Enterprise community,I'm trying to understand what the "Enable third-party Android mobile management" checkbox in Google Admin does. How does this affect situations where multiple Android Enterprises are bound to multiple EMM solutions? Will both Android Enterprise continue working if they are bound to different EMM solutions, even if only one is selected on the screen above?If I use the Enrollment token link method to provision a device and have no users in my Google Workspace, will switching the EMM provider in the dropdown below the checkbox have any effect? Also, does Authenticate Using Google affect provisioning if there are no users in Google Workspace?Thanks,Marko

Hi today we raised a case with Microsoft for a specific work profile issue with their current Outlook and MS Teams implementation. I wanted to share this here, maybe there are some other customers/admins facing this issue. Our org started to move from Cisco to MS Teams PSTN calling some month ago and everything was fine, but I assume an update to either Outlook or Teams app was published and the issue started. Scenario: COPE or BYODMS Teams and MS Outlook in work profileMS Teams has a PSTN line configured (either mobile or landline) Open Outlook, search for any contact and try to start a call to a mobile or desk number. The OS does not ask whether you like to use the phone on personal profile (as it did the last couple of years 😅) - it will hand over the call request to MS teams! You cannot decide to make the phone call with your Phone app :-( This breaks almost all use cases for our users. Even worse: A phone number like +49 123 828282 is transfered to M

Hi All,I'm trying to remove completly the option of AI mode in Google chrome.I was able to use these settings. AIModeSettings=1 GenAiDefaultSettings=2 How ever it doesn't remove the AI mode from the Google.com search bar that is inside the page. Any formal way to remove this option?  

Apparently, Google has a new policy that only approved DPCs can be installed through QR Provisioning; otherwise, their installation will be blocked.Link: https://developers.google.com/android/play-protect/warning-dev-guidance#android_enterprise_dpc_enrollment The problem is that I am not able to understand how to apply for DPC approval. I found this page, but still not able to find out where to apply. Your help is appreciated. Thanks 

Have purchased the Trial Chrome upgrade on our existing workspace account. Our backend api failing with below error:Request call: POST https://chromedevicemanagement.googleapis.com/v1/enterprises//devices//devicePolicyerror response:{  "code" : 400,  "errors" : [ {    "domain" : "global",    "message" : "Device does not have CDM API enabled. Enable CDM API for the corresponding OU in Google Admin Console.",    "reason" : "failedPrecondition"  } ],  "message" : "Device does not have CDM API enabled. Enable CDM API for the corresponding OU in Google Admin Console.",  "status" : "FAILED_PRECONDITION"}Can you confirm what this error means?As same API works for our paid chrome account, is it an restriction on trial accounts from your end? or we are missing something here?Note: Same client Id and scope is used in Domain-wide delegation setting in admin console. 

Hi everyone,I’m building an Android Enterprise device management solution and I want to keep everything fully compliant (Android Enterprise + Google Play policies). Use case: a company provides company-owned devices to customers under a leasing / device financing contract. We need to manage this at scale (10,000+ devices) across multiple customers/tenants. If a customer becomes delinquent, the company needs a temporary restricted mode (e.g., kiosk/limited access) until the account is back in good standing — with clear user notice, grace period, and contractual consent. What we want to control at scale: enrollment, policy assignment, app allow/deny lists, kiosk/lock task mode, updates, compliance reporting, and remote actions aligned with Android Enterprise best practices.Questions:Is this type of “restricted mode for delinquency” considered acceptable in the Android Enterprise ecosystem when devices are Company-Owned (Device Owner) and the policy is transparent/contractual?Fo

Hello,For the past two weeks, we have been experiencing issues during the enrollment of some of our devices. After enrollment, the Play Store is empty and no apps will install. This is a problem that has occurred before, and a fix was provided by Google (link). A case is currently open between our MDM vendor, Ivanti, and Google: link. (issue tracker 399818918)Are other people experiencing this issue? Our vendor has indicated that at least one other customer is currently facing the same problem.Best regards

Hey,Not sure if this is at all correct place to address this, but once again when I started to do the renewal for Android Enterprise Expert certification, I though that I would want to ensure the Android Academy is still the correct place to do these, as the material is seriously outdated, even it still factually largely applies, it still seems frankly dumb to read upon features that came out with Android 5.1 - 8.1, and obtain a certification by that way.  Also the session that can be enrolled via the portal, are still titled that what is new on Android in 2025, though the session is for this year. If someone has some knowledge of the above would appreciate any info as had to dig abit via various contacts to get info of this community site. 

Hi everyone, I’m trying to enroll a fully managed Android device using the Android Management API. I generate an enrollment token, create the QR code, factory reset the device, and start the QR-based provisioning process. Everything works until the Android Device Policy step, where I get the following error: “Since your organization has reached its usage limits, this device can’t be set up.” I am unable to get past this point. Here is what I have already checked:Listing devices through the API returns an empty list. There are no enrolled devices at all.Billing is active on the cloud project and the Android Management API is enabled.Enterprise creation works, policies return correctly, and I can generate enrollment tokens without any issues.The device is correctly factory reset and the QR scan is working as expected.I tested with both a Workspace-based enterprise and a Gmail-based enterprise. The same limit error appears on both, even though both enterprises have zer

Hello,I manage a fleet of more than 1,000 Samsung Android devices using Omnissa Workspace One (AirWatch), devices are enrolled in COPE. We use Gmail, Google Calendar, and the native Samsung Contacts app in the work profile, all synchronized through an Exchange ActiveSync connector. Since Wednesday, November 26th, we have been experiencing synchronization issues: - Contacts and calendar events saved on Exchange disappear after some time.- The Calendar app eventually shows an “Unauthorized Action” error and refuses to open.- Gmail continues to sync emails normally. The issue occurs randomly (sometimes after one hour, sometimes longer). Clearing Gmail’s app data and signing in again temporarily resolves the problem, but the issue always comes back. We've tryied uninstalling and reinstalling the app through our MDM but we can only do it user by user and we're not sure about it fixing the issue. We have no means to "rollback" Gmail's version to an older one through our M

Hello AE community, Happy new year, Our users encounter a problem when looking for private apps on the playstore, Apps doesn't appear until you type their full name, For exemple: we have an application called "Conformite"When typing "Confo", the app doesn't show upWhen typing "Conformite", it works When looking for a public app like teamsTyping "Tea" Teams shows upTyping "Teams" Teams shows up We created a playstore category to make this search easier, Is there something to do on the playstore console ? I can add screnshots if needed Regards,Batlac 

After numerous support tickets saying Google Play Protect has blocked our DPC app from being installed with the QR code I found this site and from what I understand there was a change at the start of this month that was only advertised to Google Enterprise Partners regarding who can use QR code enrollment and other Android APIs in their app.  Applied for EMM/DPC account twice and each time less than 12 hours later denied with"On reviewing the information that you have submitted in your application, your organization does not meet the requirements to enter the community."I have explained that we have contracts with companies (which we are now in breach of) and are in talks with the Military for a custom DPC solution. RRiVEN LLC has been a company since 2011 and our DUNS profile reflects that.  I have read https://developers.google.com/android/management/permissible-usage https://developers.google.com/android/play-protect/warning-dev-guidance#android_enterpr

Hi Android Enterprise Community Team,   We are currently blocked from the partner onboarding process due to a system error that seems to have locked our DUNS number in a "ghost" application state.   Here is the chronological sequence of the issue:   First Attempt: I initially applied using a generic Gmail address and was correctly declined. Second Attempt (Corporate): I followed the instructions and re-applied using my corporate email. The Error: This second application was marked as "Declined - Further information was requested but not received". However, I never received any email requesting further information (I have checked all Spam/Junk folders multiple times). The process seemingly timed out on the server side without notifying me. Current Blocker: Now, when I try to "Resume Onboarding" or start a fresh application via androidenterprise.dev with my corporate email, the system allows me to log in but throws a generic "Oops Something went wrong" error immediately af

Apparently, Google has a new policy that only approved DPCs can be installed through QR Provisioning; otherwise, their installation will be blocked.Link: https://developers.google.com/android/play-protect/warning-dev-guidance#android_enterprise_dpc_enrollment The problem is that I am not able to understand how to apply for DPC approval. I found this page, but still not able to find out where to apply. Your help is appreciated. Thanks

Hello AE community, Our users encounter screen sensitivity issue while using a screen proctection on their devices,Device impacted is Samsung A9+, There is a setting to enhance screen sensitivity but it is not manageable thought Ivanti NMDM, or Knox Service Plugin. We also use Bluebird devices, for this manufacturer, sensitity setting is manageable using their OEM Config app. Is there another method to manage this setting ? Should i make a FER (Feature Enhancement Request) to Samsung directly ? Regards Batlac

Hi everyone, As of some weeks, Intune started showing the tenant name on the lockscreen. Where it used to say "this device belongs to your organisation" it now says: " This device belongs to company name" . Since this is a big no for most of our customers, I was wondering if other people noticed this as well and maybe even found a solution for it. Microsoft support admitted that they changed this, but they will now help us getting it fixed or even giving us the option to enable or disable this.  Showing the company name on a device can make a device more interesting to people who might find a lost or stolen device. Therefore, we never show company names or logo's on the lock screen. And most customers we work with expect that kind of behaviour. We currently have to project on hold because if this detail. (And its costing us extra business because they are not buying the hardware that comes with it &#x1f605) I hope someone else is having more luck! In the m

Hello,There is a distinct difference in how Google manages Android versus Chrome OS, and as a developer, I think it is important to recognize why the Chrome OS strategy is superior for productivity.The Android Approach: Android is a commercial product first. It focuses on features, consumer appeal, and running on everything. The priority is "It works now."The Chrome OS Approach: Chrome OS started small and humble. It has grown slowly, not by chasing trends, but by building a foundation of trust and robustness.I see this robustness daily in the Crostini environment. Recently, upgrading my VM from Debian 12 (Bookworm) to Debian 13 (Trixie) was a pleasure—a real upgrade requiring no reinstallation. This level of stability is rare in the OS world. It proves that Chrome OS is engineered with a long-term vision of quality.The RiskThe current rumors about new operating systems or "Android on PC" threaten to undermine this stability. If Google tries to make Chrome OS behave

I am the developer of Headwind MDM, the open source MDM for Android. In December 2025, many of our users reported the same issue. While installing an MDM app by the QR code method, it is blocked by Play Protect: "This app can request access to sensitive data". A detailed description of the issue is here. As per Play Protect guidelines, this may happen if an app uses sensitive permissions—RECEIVE_SMS, READ_SMS, NOTIFICATION_LISTENER, and ACCESSIBILITY. We removed these permissions in May 2025, and at that time the issue was resolved. Unfortunately the issue re-appeared again in December, and we were unable to determine why Headwind MDM agent is blocked at the enrollment stage. Even removing all permissions from the manifest didn't resolve the issue! Looks like there is an AI which automatically blocks software in an opaque way (by signature or code similarity). Interesting - sideloading and installing the same MDM agent APK on a non-managed device doesn't trigger Google P

So I am trying to enable Managed Google Play in Intune to use for Android device management.We already have a managed Google domain, but we have device management turned off. To my knowledge we only use it for Workplace. When I try to enable managed google play in Intune I get two different error messages Any ideas or tips of what we need to enable or open up in the Google admin console to enable third party EMM? Does the account I am using to enable managed google play have to be a google super admin or something?

Hi everyone we received some reports from our users in the last couple of month that suddently the phone app on COPE devices (Samsung A-series) starts to show "Can't call from a personal app" - Your organisation only allows you to make calls from work apps. Workaround: Reboot the device. For most of the reports this workaround has to take place once and the message is gone forever. A very small amount of devices starts to show this message again after a couple of weeks. Rebooting is resolving the issue again. Any idea of how to prevent this? Even emergency calls are not possible if this error is appearing! Does anyone else have seen this behavior? Raised a case with Samsung today. Thanks!Daniel

we are asked to verify our google developer accounts on the console. however, when trying to do so, our DUNS number was not working. we know it's the correct number as it's used in a different portal.

Since mid-November '25, forced auto install is not functional for our organization.  Apps are loaded and installable as work apps but do not progress as an auto install from our policy. Has anyone experienced a similar issue?  No policy changes, no SW updates on the MDM client.  Functionality just stopped working.

Hi Everyone, I am trying to set up a fully managed device for my organization. I have completed the process of enterprise creation, but as I generate the enrollment QR and begin setup of my Android, I get an error stating "Since your organization reached its usage limits, this device can't be set up". What am I missing as I can't see any graph or option to increase my limit. Furthermore, I have deleted all the devices from my enterprise. My organization needs a scalable solution so that we can manage thousands of device . Please let me know how to proceed forward.Thanks 

i had this weird issue while trying to auto provision the devices , i created one configuration to auto redirect the devices to an enrollment profile, added the Jason file of the token to it and assigned it to certain devices , yet it didn't work  the device realize that it is  belong to organization and i see my  company support  contact  means it been recognized on my zero touch portal but it ask me to scan QR code for enrollment and not detect the token  Jason  text in the DPC extras also the profile works fine if i scanned the QR, any suggestions ??😅