Solved

We are trying ChromeOS management via EMM where the existing domain account we have works fine i.e we are able to enrol and device sync is also happeneing on EMM side but when I am trying the same with another customer account though the account is showing as enrolled in the Google console, it's not syncing to EMM. There is no error also on backend. Looks like the api to fetch the device list response is empty. We have partner access setting enabled in the customer account still facing same. Is there any other settings on the console we need to check? Note: Customer account has the purchased the Trial Chrome upgrade.

Hi, we are using MS Intune and Google Zero Touch Portal, and a large number of Zebra scanners.We created several profiles in ZTP with DPC extras (JSON) to link the devices to the corresponding Intune enrollment profiles.However, when the scanners are set up and connected to wifi, they will not identify as company devices, but continue setup in "private" mode.I assume there is a problem in our JSON config, but I could not find it. I already checked some other discussions in this forum, but could not yet find a solution. Apologies, if this problem should already be resolved, then I am happy if you point me in the right direction. :) Thanks very much and best regardsTobias

Hello, I have built a device management system using Android Management API. Devices are enrolled in Device Owner mode. After enrolling Samsung devices (especially newer models like Samsung A07), I noticed that Samsung Smart Switch does not work anymore. On older Samsung devices, Smart Switch works even after enrollment. But on newer Samsung devices, Smart Switch does not work once the device is enrolled as Device Owner. I am not using any third-party MDM solutions only Android Management API. My questions:Is Samsung Smart Switch blocked automatically when a device is enrolled in Device Owner mode?Is this expected behavior on newer Samsung devices?Is there any policy configuration that allows Smart Switch to function while still using Device Owner mode?Is this a Samsung restriction or an Android Enterprise restriction? I would appreciate any clarification on this behavior.Thank you.

Hello,We use WorkspaceONE UEM as our MDM. We sometimes use provisioning profiles to deploy commands to devices run-intents, but I'm not an expert on this subject by any means. I am curious if it is possible to use our MDM to deploy an API command to disable Factory Reset Protection. The command information is here: https://developer.android.com/reference/android/app/admin/FactoryResetProtectionPolicy I realize what a specific question this is. If I can provide more information, please let me know. Thanks in advance!

Regarding the function of configuring the login URL, I have configured the signUrl for the enterprise, and then obtained the signinEnrollmentToken of the enterprise through get, and placed its qrcode into the QR code. When I configure the device, my device redirects to the configured signUrl page, and then after successfully logging in by entering the account and password, I need to call enrollmentTokens.create. However, how can I obtain my enterprise id? Is there any good suggestion

Hello, we have observed a regression in location tracking for third party applications after updating ChromeOS on HP Chromebook G1m 11 inch. Device details are ChromeOS version 144.0.7559.108 with previous working version 131.x on the stable channel. After upgrading from version 131 to 144.0.7559.108, third party applications are no longer able to detect or receive location data while Google Maps continues to report the correct location. This behavior was working as expected prior to the OS update, which indicates a possible regression or policy change introduced in ChromeOS 144 affecting third party application access to location services. Thanks Vishal

Hi everyone,I'm a developer who helps enterprises build custom DPC (Device Policy Controller) Reference Documentation apps to manage Android devices based on their unique requirements.Recently, Play Protect has started blocking the installation of custom DPC apps, even when these apps are signed and used internally. The warning claims the app may pose a risk due to access to sensitive data - even though it's strictly for enterprise use. To make things more difficult:Google is no longer accepting registration of custom DPC apps with Android Enterprise, which limits official distribution and management options.Android Management APIs don’t support all use cases, and also have quote limit.I’ve applied twice to join the Android Enterprise portal to build a SaaS-based device management platform, but both requests were rejected without a clear reason. My questions for the community:Is there any official way to get a custom DPC app approved or whitelisted by Play Protect?Are there a

Our product is for AI security and one of the main challenges we have is how do we make sure the extension will always run even in Incogntio mode.I'm talking about the Chrome browser.There is a flag that seems to be not supported MandatoryExtensionsForIncognitoNavigation while Edge do support this. This is very critical to us and I assume all enterprises that would like to keep Incognito mode but still keep security.If this is no an option can we at least have a formal way to check from command line if an extension is allowed in Incognito mode so we can disable Incognito for these users if our ext isn't allowed?  

Hello,We use QR code provisioning to install our custom Device Policy Controller (DPC) app from a custom download URL (not Google Play).The exact same APK + QR configuration:Works on:Samsung Galaxy S20 — Android 13 / One UI 5.0Blocked on:Samsung Galaxy S21 — Android 14 / One UI 6.1Play Protect stops installation with the message:"App blocked to protect your device. This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud."Provisioning QR:{"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "<DeviceAdmin component>","android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM": "<Package checksum>","android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "<S3 bucket url>","android.app.extra.PROVISIONING_LOCALE": "en_US","android.app.extra.PROVISIONING_TIME_ZONE": "Europe/Helsinki","android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED": false,"android.app.extra.PROVISIONING_DEVICE_A

  Hey Android Enterprise community,I'm trying to understand what the "Enable third-party Android mobile management" checkbox in Google Admin does. How does this affect situations where multiple Android Enterprises are bound to multiple EMM solutions? Will both Android Enterprise continue working if they are bound to different EMM solutions, even if only one is selected on the screen above?If I use the Enrollment token link method to provision a device and have no users in my Google Workspace, will switching the EMM provider in the dropdown below the checkbox have any effect? Also, does Authenticate Using Google affect provisioning if there are no users in Google Workspace?Thanks,Marko

Hi today we raised a case with Microsoft for a specific work profile issue with their current Outlook and MS Teams implementation. I wanted to share this here, maybe there are some other customers/admins facing this issue. Our org started to move from Cisco to MS Teams PSTN calling some month ago and everything was fine, but I assume an update to either Outlook or Teams app was published and the issue started. Scenario: COPE or BYODMS Teams and MS Outlook in work profileMS Teams has a PSTN line configured (either mobile or landline) Open Outlook, search for any contact and try to start a call to a mobile or desk number. The OS does not ask whether you like to use the phone on personal profile (as it did the last couple of years 😅) - it will hand over the call request to MS teams! You cannot decide to make the phone call with your Phone app :-( This breaks almost all use cases for our users. Even worse: A phone number like +49 123 828282 is transfered to M

Hi All,I'm trying to remove completly the option of AI mode in Google chrome.I was able to use these settings. AIModeSettings=1 GenAiDefaultSettings=2 How ever it doesn't remove the AI mode from the Google.com search bar that is inside the page. Any formal way to remove this option?  

Have purchased the Trial Chrome upgrade on our existing workspace account. Our backend api failing with below error:Request call: POST https://chromedevicemanagement.googleapis.com/v1/enterprises//devices//devicePolicyerror response:{  "code" : 400,  "errors" : [ {    "domain" : "global",    "message" : "Device does not have CDM API enabled. Enable CDM API for the corresponding OU in Google Admin Console.",    "reason" : "failedPrecondition"  } ],  "message" : "Device does not have CDM API enabled. Enable CDM API for the corresponding OU in Google Admin Console.",  "status" : "FAILED_PRECONDITION"}Can you confirm what this error means?As same API works for our paid chrome account, is it an restriction on trial accounts from your end? or we are missing something here?Note: Same client Id and scope is used in Domain-wide delegation setting in admin console. 

Hi everyone,I’m building an Android Enterprise device management solution and I want to keep everything fully compliant (Android Enterprise + Google Play policies). Use case: a company provides company-owned devices to customers under a leasing / device financing contract. We need to manage this at scale (10,000+ devices) across multiple customers/tenants. If a customer becomes delinquent, the company needs a temporary restricted mode (e.g., kiosk/limited access) until the account is back in good standing — with clear user notice, grace period, and contractual consent. What we want to control at scale: enrollment, policy assignment, app allow/deny lists, kiosk/lock task mode, updates, compliance reporting, and remote actions aligned with Android Enterprise best practices.Questions:Is this type of “restricted mode for delinquency” considered acceptable in the Android Enterprise ecosystem when devices are Company-Owned (Device Owner) and the policy is transparent/contractual?Fo

Hello,For the past two weeks, we have been experiencing issues during the enrollment of some of our devices. After enrollment, the Play Store is empty and no apps will install. This is a problem that has occurred before, and a fix was provided by Google (link). A case is currently open between our MDM vendor, Ivanti, and Google: link. (issue tracker 399818918)Are other people experiencing this issue? Our vendor has indicated that at least one other customer is currently facing the same problem.Best regards

Hey,Not sure if this is at all correct place to address this, but once again when I started to do the renewal for Android Enterprise Expert certification, I though that I would want to ensure the Android Academy is still the correct place to do these, as the material is seriously outdated, even it still factually largely applies, it still seems frankly dumb to read upon features that came out with Android 5.1 - 8.1, and obtain a certification by that way.  Also the session that can be enrolled via the portal, are still titled that what is new on Android in 2025, though the session is for this year. If someone has some knowledge of the above would appreciate any info as had to dig abit via various contacts to get info of this community site. 

Hello,I manage a fleet of more than 1,000 Samsung Android devices using Omnissa Workspace One (AirWatch), devices are enrolled in COPE. We use Gmail, Google Calendar, and the native Samsung Contacts app in the work profile, all synchronized through an Exchange ActiveSync connector. Since Wednesday, November 26th, we have been experiencing synchronization issues: - Contacts and calendar events saved on Exchange disappear after some time.- The Calendar app eventually shows an “Unauthorized Action” error and refuses to open.- Gmail continues to sync emails normally. The issue occurs randomly (sometimes after one hour, sometimes longer). Clearing Gmail’s app data and signing in again temporarily resolves the problem, but the issue always comes back. We've tryied uninstalling and reinstalling the app through our MDM but we can only do it user by user and we're not sure about it fixing the issue. We have no means to "rollback" Gmail's version to an older one through our M

Hello AE community, Happy new year, Our users encounter a problem when looking for private apps on the playstore, Apps doesn't appear until you type their full name, For exemple: we have an application called "Conformite"When typing "Confo", the app doesn't show upWhen typing "Conformite", it works When looking for a public app like teamsTyping "Tea" Teams shows upTyping "Teams" Teams shows up We created a playstore category to make this search easier, Is there something to do on the playstore console ? I can add screnshots if needed Regards,Batlac 

After numerous support tickets saying Google Play Protect has blocked our DPC app from being installed with the QR code I found this site and from what I understand there was a change at the start of this month that was only advertised to Google Enterprise Partners regarding who can use QR code enrollment and other Android APIs in their app.  Applied for EMM/DPC account twice and each time less than 12 hours later denied with"On reviewing the information that you have submitted in your application, your organization does not meet the requirements to enter the community."I have explained that we have contracts with companies (which we are now in breach of) and are in talks with the Military for a custom DPC solution. RRiVEN LLC has been a company since 2011 and our DUNS profile reflects that.  I have read https://developers.google.com/android/management/permissible-usage https://developers.google.com/android/play-protect/warning-dev-guidance#android_enterpr

Hi Android Enterprise Community Team,   We are currently blocked from the partner onboarding process due to a system error that seems to have locked our DUNS number in a "ghost" application state.   Here is the chronological sequence of the issue:   First Attempt: I initially applied using a generic Gmail address and was correctly declined. Second Attempt (Corporate): I followed the instructions and re-applied using my corporate email. The Error: This second application was marked as "Declined - Further information was requested but not received". However, I never received any email requesting further information (I have checked all Spam/Junk folders multiple times). The process seemingly timed out on the server side without notifying me. Current Blocker: Now, when I try to "Resume Onboarding" or start a fresh application via androidenterprise.dev with my corporate email, the system allows me to log in but throws a generic "Oops Something went wrong" error immediately af

Apparently, Google has a new policy that only approved DPCs can be installed through QR Provisioning; otherwise, their installation will be blocked.Link: https://developers.google.com/android/play-protect/warning-dev-guidance#android_enterprise_dpc_enrollment The problem is that I am not able to understand how to apply for DPC approval. I found this page, but still not able to find out where to apply. Your help is appreciated. Thanks

Hello AE community, Our users encounter screen sensitivity issue while using a screen proctection on their devices,Device impacted is Samsung A9+, There is a setting to enhance screen sensitivity but it is not manageable thought Ivanti NMDM, or Knox Service Plugin. We also use Bluebird devices, for this manufacturer, sensitity setting is manageable using their OEM Config app. Is there another method to manage this setting ? Should i make a FER (Feature Enhancement Request) to Samsung directly ? Regards Batlac

Hi everyone, As of some weeks, Intune started showing the tenant name on the lockscreen. Where it used to say "this device belongs to your organisation" it now says: " This device belongs to company name" . Since this is a big no for most of our customers, I was wondering if other people noticed this as well and maybe even found a solution for it. Microsoft support admitted that they changed this, but they will now help us getting it fixed or even giving us the option to enable or disable this.  Showing the company name on a device can make a device more interesting to people who might find a lost or stolen device. Therefore, we never show company names or logo's on the lock screen. And most customers we work with expect that kind of behaviour. We currently have to project on hold because if this detail. (And its costing us extra business because they are not buying the hardware that comes with it &#x1f605) I hope someone else is having more luck! In the m

Hello,There is a distinct difference in how Google manages Android versus Chrome OS, and as a developer, I think it is important to recognize why the Chrome OS strategy is superior for productivity.The Android Approach: Android is a commercial product first. It focuses on features, consumer appeal, and running on everything. The priority is "It works now."The Chrome OS Approach: Chrome OS started small and humble. It has grown slowly, not by chasing trends, but by building a foundation of trust and robustness.I see this robustness daily in the Crostini environment. Recently, upgrading my VM from Debian 12 (Bookworm) to Debian 13 (Trixie) was a pleasure—a real upgrade requiring no reinstallation. This level of stability is rare in the OS world. It proves that Chrome OS is engineered with a long-term vision of quality.The RiskThe current rumors about new operating systems or "Android on PC" threaten to undermine this stability. If Google tries to make Chrome OS behave

I am the developer of Headwind MDM, the open source MDM for Android. In December 2025, many of our users reported the same issue. While installing an MDM app by the QR code method, it is blocked by Play Protect: "This app can request access to sensitive data". A detailed description of the issue is here. As per Play Protect guidelines, this may happen if an app uses sensitive permissions—RECEIVE_SMS, READ_SMS, NOTIFICATION_LISTENER, and ACCESSIBILITY. We removed these permissions in May 2025, and at that time the issue was resolved. Unfortunately the issue re-appeared again in December, and we were unable to determine why Headwind MDM agent is blocked at the enrollment stage. Even removing all permissions from the manifest didn't resolve the issue! Looks like there is an AI which automatically blocks software in an opaque way (by signature or code similarity). Interesting - sideloading and installing the same MDM agent APK on a non-managed device doesn't trigger Google P