User Profile
okmick
Level 2.0: Eclair
Joined 2 years ago
User Widgets
Contributions
Do you wish Microsoft would implement Android user profiles in Intune?
If so, then upvote my feedback here: Implement persistent multi user feature on Android | Microsoft Feedback. No, this is not the same as Microsoft Entra Shared Mode. It uses Android's built-in user profile feature and is documented by Google here: Manage multiple users | Android Enterprise | Android Developers. Microsoft disables this feature on all enrollment profiles with no way to enable it.Re: Does anyone allow multiple users on their Androids?
Interesting. It's good to know that other EMMs are doing a better job than Microsoft. Like so many other institutions, my org uses Intune because it comes for free with our M365 licenses and we already use it to manage Windows devices. There's a lot of things I don't like about it and I think the Managed Home Screen is one of them. I would love to know their reasoning why they didn't implement secondary users with Entra shared mode but I probably won't ever get that answer.Re: Does anyone allow multiple users on their Androids?
Shared entra mode build multiple profiles on a device Hmmm I didn't think this was true. From my testing, it seems that it doesn't create multiple user profiles, instead it just uses one user profile and signs in/signs out the Microsoft account. Also I agree with Moombas shared use devices aren't going anywhere. I come from education which is interesting because in a K12 setting single user devices are the standard. Students, faculty and staff are all issued a device that only they use. But in higher education, it's a completely different story. Very few colleges or universities have the money to issue a device to each student and sometimes we can't even give a device to each faculty member. So, shared use devices become the norm. Thanks for the link to Knox Authentication Manager. We use Samsung devices but don't pay for any Knox services and it looks like this requires a license.Does anyone allow multiple users on their Androids?
I've got a use case for some multi-user Android tablets and I'm trying to figure out the best solution. I know Android allows you to create secondary users by default but it appears that Microsoft Intune is disabling this setting automatically. Doesn't seem to be a way to allow it given that the only options are block or not configured. I put in a ticket with Microsoft and I'm sure their answer will be to use Microsoft Entra Shared Mode and the Managed Home Screen but that doesn't work very well. Also, it appears multi-user functionality is documented by Google and an EMM can set it up so the user can create secondary users using the standard Android settings or the DPC can create the secondary user. Also looks like there's some work to be done as far as making sure the DPC can still manage the secondary users as well. https://developer.android.com/work/dpc/dedicated-devices/multiple-users So I am curious for those using other EMMs: do you allow secondary users on any of your Android devices?Re: Private app package name already in use
First of all, I just want to say there are so many interesting things happening in this conversation and I'm happy that we're having it. I understand your perspective and I think we are both coming from vastly different organizations/use cases so let me tell you a little bit about me and what my work looks like: I work as a systems engineer at a university. Historically, we've only managed Windows machines, Macs and iPads. We've only just begun managing Android devices this past year, which really excited me as a long time Android dude. It was initially a project to deploy 20 or so tablets to faculty that taught online classes so they could more easily annotate with a pen and touchscreen. There's some drama that happened with this project that I won't get into but ultimately it got axed and these tablets aren't used very much. This was very disappointing for me as I put in a TON of work to get it off the ground and built some pretty awesome custom integrations with our asset management system, Intune, Entra, AD and ZTE. But that aside, it did open doors for us as we are now ready to manage Android devices and can offer them as solutions to our users. Cue Poppulo and digital signage. You already saw my post on that so I won't re-hash it. But basically we want to move away from Windows kiosks to run the Poppulo app and start using some sort of Android solution instead. So for us, Android devices and the apps that run on them are not mission critical. This is what sets us apart. Digital signs just sit on walls and display information about the university and the academic department they are in front of. If they go down, nothing bad will happen. Another thing is that as a university, we're limited on funds, so we don't always have the pleasure of choosing our software. We have to work with what we have. That doesn't mean we never spend money on software, we do, but we have to be efficient with our choices. Since we are a Microsoft shop, we get Intune for free so it just makes sense for us. Doesn't mean I love it, in fact, I downright hate it most of the time (mostly on the Windows side). These digital signs aren't mission critical so we don't need to go choosing an EMM that supports Poppulo. In fact, if I had it my way, we'd choose a digital sign software that works well with Intune. I think that's another way we differ as well: you're working with mission critical apps that are a part of a large process/workflow and you can't just switch to using something else all willy nilly. It makes sense that you'd choose the EMM that fits the app rather than the other way around. But for us it's the opposite. My goal as an IT admin is to make our processes as automated and simplified as possible. That way, there's less room for error when technicians are doing deployments and a future admin can easily manage the configurations and understand how to support the system. If we could switch to using a digital signage software that was already available in the Play Store with a managed configuration and deploy the Elo backpacks everywhere, this whole thing would be a BREEZE. Google Zero Touch means they're ready to go in minutes out of the box, it's practically plug and play. All the technician does is mark the device as a digital sign in our asset management system, plug it in and the integration takes care of everything. Your comments on Google's neglect for dedicated devices brought up an interesting thought for me: I went to Microsoft Ignite last year and attended a session on "frontline worker devices". They talked at length about how they are working to support Android devices for frontline workers. They're doing things like supporting "specialized devices", enabling FOTA deployments for Zebra devices and continuing to enhance their Entra shared device mode (enables ephemeral multi-user mode like jasonbayton is wanting from AMAPI). This was obviously irrelevant to me as I don't work for a business and have no frontline workers. But it seems at least for Android, Microsoft is very focused on the dedicated device space. But this is in stark contrast on the Windows side. We have many computer labs and shared spaces at my university as you can probably imagine. Microsoft's support for shared Windows is dismal at best. Every new feature or product they roll out is always user-based rather than device based. It's wild to me that I still have to write a script in Intune to deploy printer objects on a shared device. This was so easy in Group Policy. MS made Universal Print, but it's all user-based access which doesn't work for us. MS is focused on businesses and I get that, education orgs aren't as important to them, they give us free student licenses after all. But anyway, I think it's interesting how Google and Microsoft approach dedicated devices so I can relate to your frustration on the Windows side. A last note on developer perspectives, in addition to managing a team of systems engineers, I am also a Computer Science student (free tuition if you work full time :D). So I am slowly learning the developer perspective more and more. For example, the rise of web apps. Google has been on the web app train since pretty much the beginning and that's kind of been their shtick. Microsoft is starting to do the same, all their native desktop apps are becoming progressive web apps, the biggest one of late is Outlook. It's been a pretty controversial move and I noticed that I had three different perspectives on that: as an IT admin, I love PWAs because their easy to manage. Easy to install, easy to support. as a developer, I love PWAs because you don't have to develop native apps for each platform. Just make a really good web app and then wrap it for desktop usage. as a user however, I sometimes hate them. Google's are pretty good but in the case of Microsoft Outlook, the experience is sub-par compared to Outlook classic. Everything feels slower, features are missing and I don't feel like I'm as productive. I just mention that to say that I am constantly thinking about different perspectives. With your help, I now understand the work involved for Poppulo to publish their apps in Google Play. Even for such a simple app like this content player that doesn't do anything besides display some images and videos. It's just not something they're going to put in the effort for one customer. This became long winded but hopefully it all makes sense. Cheers.Re: Private app package name already in use
Thanks for your perspective. I suppose I'm only left with one question: how much work is it to publish an app in Google Play? The apk they gave me had "googleplay" in the file name and I'm not sure what to make of that. Really hope this isn't a triggering question, just trying to learn here.Re: Private app package name already in use
Update on this: Poppulo says It looks like that app that was uploaded is an old version of the app that's too old to use, so unfortunately, sharing it won't be an option. I'm more than happy to communicate your team's interest in having the app uploaded to the google play store, but at this time that's not an option we can offer. UGH I'm pushing back on this. I can't imagine it's that hard to upload the newest version of their APK right? It's kind of wild to think that I'm the only one that wants to deploy the app this way.Re: Why is the Google Play organization ID different depending on where you look?
Hmmm no it never would have been a gmail. Although I suppose the account I use is just a regular Google account but made using an organizational email but I don't think that should make a difference. Alex_Mucyour question made me remember something: last year I disconnected and reconnected our managed Google Play account. I had made app collections, didn't like it and realized the only way to undo it was to reconnect the account. I used the same exact account but I wonder if that had something to do with it....Re: Why is the Google Play organization ID different depending on where you look?
Lol ya'll are cracking me up! Did everyone in this thread not read this part of my post? I'm logged into the same Google account I used to connect Intune with Google Play. I think you owe me a steak dinner sir. I won't post my account details but I will gladly DM you.Why is the Google Play organization ID different depending on where you look?
If you didn't see my other post Private app package name already in use I've asked one of our software vendors to make one of their private apps available to my organization. To prepare for that, I went to gather our organization ID and noticed that it's different depending on where I look. From the Managed Google Play Console: https://play.google.com/work/adminsettings From the Managed Google Play iframe in Microsoft Intune: I know it doesn't mean much with the IDs blacked out but just wanted to show you where exactly I was looking. In the first instance, I'm logged into the same Google account I used to connect Intune with Google Play. Any ideas why the organization IDs would be different? I am wondering which ID to give them. Thanks.Re: Private app package name already in use
I've been an Android user/fan for a long time but I'm a newbie when it comes to Android management so forgive me for asking: what is AMAPI lacking right now that everyone is waiting for? I've not had the pleasure of using a custom DPC (besides Company Portal on work profiles but that doesn't really count), I went full Android Enterprise from the get-go for my project so I guess I don't know what I'm missing.
