Solved

Hey, Is it possible to grant special permissions like `SYSTEM_ALERT_WINDOW` to a device if it is fully managed using Android management API? We tried adding it to the permissionGrants but it is not enforced for some reason. Thanks!

When I execute this on HTTP, I receive a response.[REQUEST]POST https://androidmanagement.googleapis.com/v1/enterprises/LC04k33pjm/devices/32931cb718c4bbcf:issueCommand?key=[YOUR_API_KEY] HTTP/1.1Authorization: Bearer [YOUR_ACCESS_TOKEN]Accept: application/jsonContent-Type: application/json{  "type": "RESET_PASSWORD"}[RESPONSE]HTTP/1.1 200cache-control: privatecontent-encoding: gzipcontent-length: 263content-type: application/json; charset=UTF-8date: Tue, 07 May 2024 15:46:32 GMTserver: ESFvary: Origin, X-Origin, Referer{  "name": "enterprises/LC04k33pjm/devices/32931cb718c4bbcf/operations/1715096792085",  "metadata": {    "@type": "type.googleapis.com/google.android.devicemanagement.v1.Command",    "type": "RESET_PASSWORD",    "createTime": "2024-05-07T15:46:32.085Z",    "duration": "600s",    "userName": "enterprises/LC04k33pjm/users/114476752020549114690"  }}Upon checking the status of the issued command

Hello we create in the past a gmail account for the configuration of the Zero Touch portal. Now we need to update this gmail account to a federated gmail account (from our workspace). Some enrolled devices are already uploaded to zerotouch profiles and devices are alreday assigned to zertouch profiles. Is it possible to edit and change the google account used for the zerotouch portal?KR WilliamV

Hi,I have my google account linked to an EMM registration.  I now no longer have access to that EMM system and want to set up my google account to a new EMM system.  Unable to do this due to the above. Do not want to create a brand new google account.I guess only Google Support can assist here but how does one (without a support contract) get in touch with them and get them to disassociate my account from an old EMM system that I no longer have access to.Thank you all!

I've made an app I need a list of email addresses for internal and closed app testers to help me test my app for publishing from my google play console?

Application device policy is set Automatic update but did not instal the system update automatically. Seems like that system update is downloading but not processing for the installation. As my app is on kiosk mode therefore there is no manual way to install the update. Application is running two user one is admin user and another is secondary user. 1. Admin user 2. Secondary https://developer.android.com/work/dpc/system-updates#set-policyDevice policy creating with the selection: pattern: String ="TYPE_INSTALL_AUTOMATIC""TYPE_INSTALL_WINDOWED""TYPE_POSTPONE"fun mapToPatternToSystemUpdatePolicy(pattern: String,startTime: Int?,endTime: Int?,😞 SystemUpdatePolicy {// Device update policy if (pattern.contains("TYPE_INSTALL_AUTOMATIC")) {return SystemUpdatePolicy.createAutomaticInstallPolicy()} else if (pattern.contains("TYPE_INSTALL_WINDOWED")) {// Update windowed time is et minutes. if (startTime != null && endTime != null) {return SystemUpdatePolicy.createW

Need help and/or feedback. We are looking at rolling out several hundred android devices for ordering purposes over the next year and I am running into an issue getting these devices registered. Running into the issue where it tells me "MAXIMUM NUMBER OF DEVICES ALLOWED TO ENROLL INTO THIS ANDROID ENTERPRISE USER ACCOUNT HAS BEEN REACHED". after look into this I've noticed that the USER ACCOUNT has a limit of 10 devices. Is there another way to add more devices or will I need to create more user accounts?

I'm trying to add a new app to our environment as google play managed app. Adding the app itself to the Intune app list works as expected, but the problem arises when I'm trying to add that app to our google play collection (from the left menu in google play -> organise apps). Normally I look up the app in the search field and select it, then save the changes in the collection. It seems like today the search field is not working, no return comes up. Doesn't matter what I fill in, the field doesn't find anything, and there's no feedback either if I press enter or if I click on the magnifying glass icon.What could I check? 

We are unable to create accounts in the terotouch portal. We get the massage:'" Error an unexpected error has occurred. Try again leter." 'This massage is for all of the users that try this. what is the next step to prevent this ?  Kind regards Petri 

@jasonbayton  we are currently assigning devices in zero touch console by serial. They have a particular configuration tied to them using DPC extras so that when the device is turned on and connected to a network, it begins the work managed enrollment process which has worked for 8 months and still does  I just received a zebra tc22 and trying to enroll the device using the same mechanisms but isnt working. The device goes to the home screen instead of the work managed screens to tie it to the workspace one console  trying to see if this is related to a delta in dpc extras for A13 but striking out.

A bit of background to use 1st, we have only ever used the Device Administrator to manage our company owned phones and use an Intune licence.I want to start using Android Enterprise but I've not as yet had any training so this is all new to me.Ideally, we want to use Fully Controlled Devices for our Company owned devices and Work Profiles for those users using their own device. Which I am sure is quite common practice.So I have had a play and not yet got anywhere with Fully Controlled Devices but have got Work Profiles setup and working to an extent. However, one stumbling block is that the Google apps, Docs, sheets, Drive etc. show no data from the user’s account. Apps like MS Outlook work just fine.Could someone be kind enough to point me in the right direction on this?Also, what training sources would people recommend? We are a State Education environment, so have a very limited budget as per usual. Thank you

We are using fido2 keys for login for our shared windows computers and want to do the same for our shared Android devices but its just sad to see the missing support from Google, is there a philosophical reason it is not supported or it is just not developed? Native app and browser support of FIDO2 passwordless authentication - Microsoft Entra ID | Microsoft Learn More context:MDM: IntuneEntra ID Shared device Mode

We have 5000 devices getting the message that the google account has been removed from them, and play store apps are no longer installing / available.I try and sign in and check our token (workspace one says its all good) but our account is no longer administrative and cant login? Workspace one says everything is fine. How do we get into admin.google.com with our EMM account? Right its looking like we need to just rebuild the whole environment and re-do thousands of devices.  

Currently, I am trying to implement lost mode notifications with push pubsub and I need to subscribe enterprise to receive usage logs. When I try to use the following json to patch my enterprise (a chunk related to usage logs):"enabledNotificationTypes": ["ENROLLMENT","STATUS_REPORT","USAGE_LOGS","COMMAND"]I receive only "ENROLLMENT", "STATUS_REPORT" and "COMMAND" in response json. And as expected no location event logs are being pushed from the pubsub. Do I need extra configuration to use USAGE_LOGS or something?Response example json: {        "name": "enterprises/enterpriseName",        "enabledNotificationTypes": [                  "ENROLLMENT",                  "STATUS_REPORT",                  "COMMAND"        ],       "pubsubTopic": "projects/projectId/topics

A bit of background on this, we're currently moving to use COPE Enrolment for all of our devices after using BYOD Enrolment for devices purchased by our org. Utilising BYOD we had issues with users signing into their gmail accounts and leaving the business and we were locked out of the device by Factory Reset Protection (We've used Knox Mobile Enrolment to solve this). This all made sense as it was a BYOD device and for consumers etc it makes a lot of sense. The problem we've encountered is even with COPE enroled devices, if a user doesn't remove their gmail account from the personal profile before resetting the device when the device is used again you're unable to use a Captive Portal network for setup again and this error message is received - "Unable to sign in to Wi-Fi AP. An unauthorised factory reset has been performed on this device. the sign-in screen cannot be accessed."  Even after enrolling the device using a WPA2/3 Network and signing in with the google

We are struggling with some user reports about blocked USB file transfer functionality on their Samsung A52 / A54 devices enrolled with corporate-owned work profile.   Microsoft released a blog post about this issue here. Known Issue: Some management settings become permanent on Android 14 - Microsoft Community Hub   We stumbled across the one-time hint about "do not upgrade non-Samsung devices to Android 14" in the advisory. Did not find any other information whether Samsung is also affected or not, but as we only have Samsung as corporate devices this seems also to apply to Samsung devices. After factory resetting the device and a fresh enrollment the USB file transfer is working as expected / configured!     *15th March: please note: this post has been moved and been made into a new topic and new title

I am following up on an article I read by @jasonbayton  that was about using adb to force install apps that would otherwise be incompatible. In the article you mentioned that there were no other ways to bypass SDK restrictions, but would it not be possible to change values in the app manifest to accomplish the same thing? Thanks for your time and information! https://bayton.org/android/android-14-minimum-sdk/#is-it-possible-to-test-the-changes 

Hello,I need clarification. My organization holds a Google Workspace for Nonprofits license which grants us an Android Enterprise Basic license. Everything has suited our needs thus far.Recently, I've encountered an issue. We're attempting to configure two or more work profiles on an Android tablet using the local account feature present in System-Multiaccount. However, when we configure the first work account, this feature disappears.Is there any configuration within the admin console that could be causing this behavior?Could it possibly be linked to the type of license we have?

Hello, I have different feedbacks where the virtual keyboard is not appearing at the Intune login page during a ZT enrollment, has anyone experienced the same issue and knows how to fix it please? Environment:- Android tablets running Android 13- COPE mode- Google Gboard installed and setup as default input method- Zero Touch enrollment- After the enrollment start and goes to the Login to Microsoft account step, the virtual keyboard is not appearing when touching the fields Some leads: - Gboard is not allowed by default and got disabled during the enrollment?- Non system or protected apps (flags to add in the software?) got removed when starting the enrollment? Thanks!

Hi  I want to know when I activate AE, can Google reply the account used for activating AE to the EMM or MDM, so that in the future, if I want to cancel or deactivate the AE , I can know exactly which Google account I used. Because I have met several times that the client forgets which account was used, so they can't deactivate the account Thanks

As a New Zealand based reseller, can I enroll the devices to Australia tenant? 

Hi guys, can anyone tell me what happens to a fully set up Android device when this device is added afterwards to Zero Touch and gets its config? Does nothing happen until the next hard reset or is it possible that it does an reset by 'itself'? Thank you.

We have multiple Playstore developer accounts in our company, most of them are only running managed google play and permanently private apps.All the teams have to go through the new Account verification according to the new Play Store policy.We probably need to involve legal department or similar for official documents and ID for each of these accounts.Is there a way we could do this in one go for all of our accounts?

Dear Android Enterprise Community,I am using my own service account for creating new enterprises for organisation instead of going multiple process so, is it good or i have to change my approach.

Dear Android Enterprise Community,Do we have to create new project always for each new organisation ?I want to know correct way for enrolling new organisation for Android Management API Services.