unable to enroll the Samsung S25 ultra into Intune as BYOD.
Hi Team, We are unable to enroll the Samsung S25 Ultra devices in Intune as BYOD. We are getting the "Can't add work profile " error during the enrollment process. So far we received couple of requests for same issue and the affected users count is increasing day by day. We have reached to Microsoft team as well, they suggested to check with Samsung team.
Common identifier between AMAPI & Require for setup app for validation
We are enrolling devices using AMAPI by generating a QR code with an assigned policy either for work profile or fully managed enrollment. During enrollment, the device prompts for a require for setup app, which, after configuration, returns RESULT_OK, marking the setup as complete and finalizing the device enrollment. Before returning RESULT_OK, To identify the enrolling device, the backend gets the device ID and enterprise ID from the Pub/Sub provisioning notification. The device ID (which matches the GSF ID) is then sent by the require for setup app to the backend for validation. This identifier is also used to enforce enrollment limits based on the enterprise license count. The Issue: Up to Android 14, retrieving the GSF ID was possible. However, in Android 15, it now returns null. Question: Is there an alternative identifier that can be used to identify the enrolling device—one that the backend can retrieve and that the setup app can also access during enrollment? Below is the information we receive from Pub/Sub when a device is enrolled: { "name": [*Hidden for privacy reasons] "managementMode": "PROFILE_OWNER", "state": "PROVISIONING", "enrollmentTime": "2025-04-04T06:17:02.751Z", "lastPolicySyncTime": "2025-04-04T06:17:02.817Z", "softwareInfo": { "androidVersion": "15", "androidDevicePolicyVersionCode": 10323580, "androidDevicePolicyVersionName": "128.32.3 (10323580)", "androidBuildNumber": "AP3A.240905.015.A2", "deviceKernelVersion": "5.15.149-android13-8-00010-gc2e0ba41ba85-ab12040008", "bootloaderVersion": "unknown", "androidBuildTime": "2025-03-11T13:26:50Z", "securityPatchLevel": "2025-03-01", "primaryLanguageCode": "en-IN", "deviceBuildSignature": "c9009d01ebf9f5d0302bc71b2fe9aa9a47a432bba17308a3111b75d7b2143456", "systemUpdateInfo": { "updateStatus": "UP_TO_DATE" } }, "hardwareInfo": { "brand": "Redmi", "hardware": "mt6835", "deviceBasebandVersion": "MOLY.NR17.R1.TC8.PR2.SP.V1.P51,MOLY.NR17.R1.TC8.PR2.SP.V1.P51", "manufacturer": "Xiaomi", "serialNumber": [*Hidden for privacy reasons] "model": "23124RN87I", "enterpriseSpecificId": [*Hidden for privacy reasons] }, "policyName": [*Hidden for privacy reasons] "memoryInfo": { "totalRam": "5865836544", "totalInternalStorage": "806965248" }, "userName": [*Hidden for privacy reasons] "enrollmentTokenName": [*Hidden for privacy reasons] "securityPosture": { }, "ownership": "PERSONALLY_OWNED" } *Updated by Community admin - removed due to privacy reasons 4 April[Community tips] What guidance do you provide with new devices?
Hello everyone, I recently helped a family member set up their new phone (after their old one had a long and fruitful life 😃). It struck me how important it is to help, when needed, to guide someone through using a new device and highlight key features that they may be used to using (and any new ones). This made me think, this is a key area for work devices too and so I thought it might be interesting to hear how we do this across the community. For example, do you provide documentation with step-by-step instructions, guidance on device usage and key information, or assistance when switching device types or operating systems? It would be great to hear any tips you have for supporting colleagues with new devices, plus anything that would make your life easier when creating useful resources. Thanks so much, Lizzie
Enhancing Android Enterprise OS Update Management
Hi, The way the Android API implements OS update management on Android Enterprise devices is not particularly useful for devices with user affinity. Are there any upcoming API changes for EMM solutions like Microsoft Intune? From my experience with the current API: AUTOMATIC – The OS update is installed as soon as it becomes available via OTA, which is not practical for real-time scenarios. WINDOWED – Similar to AUTOMATIC but with the limitation that OS updates can only be installed within a defined maintenance window. This means that if a user needs to update their device due to a software bug fixed in the latest OS version, they may not be able to do so immediately if the maintenance window is set outside working hours. Source: https://support.google.com/work/android/answer/13791272?hl=en#zippy=%2Cmanaging-system-updates-using-system-update-policies Suggested Improvements: Provide an option to control OS updates on BYOD (Work Profile only). I understand that when enrolling a device through Work Profile, only the work container can be managed via EMM. Google may need to reconsider this approach. It would be beneficial to have an approach similar to Apple’s, where EMM admins can manage OS updates (e.g., push specific updates, set deadlines, etc.) through DDM (Declarative Device Management - Source: https://support.apple.com/en-gb/guide/deployment/depc30268577/web ), even on BYOD devices (Device Enrollment) — without requiring supervision like DO (Device Owner mode). I’m aware that Samsung Knox E-FOTA exists, but it is limited to Samsung devices. Expanding this capability to all Android devices (like Google Pixel devices) would greatly improve update management in enterprise environments. BR, Marco
Problem Joining Work Profile From Android Device
I created an enrollment token for an enterprise for work profile, and I ensured that setAllowPersonalUsage("PERSONAL_USAGE_ALLOWED"); was set for the token. How ever when I try to join from my android 11(tecno) and android 14(google pixel 7) device with work profile via the ADP app, I get : Can't add work Profile A work profile can't be added to this Pixel. If you have questions, contact your IT admin. However from my emulator device running Android 15, I could join the enterprise using work profile.
Non-work app in the Work profile
I have a work profile and I have company apps installed from intune. I also have 'personal' apps in the Work profile. These were added by me using the Work profile version of the Google Play store. As a result, I have work and non-work apps co-existing in the Work profile. My question is if my Employer can see those non-work apps and the app data which are in the Work profile?Debunking 12 Android Enterprise myths
Have you ever heard statements like “Android just isn’t secure” or been asked whether BYOD is too risky for enterprise? These concerns, often based on outdated perceptions, can prevent businesses from fully realizing the benefits of Android Enterprise. So, let’s cut through the noise. Here we’ll address 12 common misconceptions and explore the realities of deploying and managing Android devices in today’s modern workplace. Myth 1: Is Android really less secure? Reality: Always-on security. Android offers proven, multi-layered, proactive security With a zero-trust approach to security, Android operates under the principle of "never trust, always verify." It continuously assesses the security posture of devices and applications, and grants access based on real-time risk assessments. Built-in security at every level includes hardware-level safeguards like verified boot and encryption, software-level protections such as application sandboxing, and proactive threat detection with Google Play Protect. The result is robust defense. Combined with granular control organizations maintain a high level of security while empowering employees with the flexibility of mobile work. Want to dive deeper? Enjoy a cup of tea while you explore our security paper. Myth 2: Android Enterprise is only suitable for large enterprises Reality: Designed for scalability, Android Enterprise can be effectively deployed by businesses of all sizes Android Enterprise offers a range of options to deploy and manage Android devices, so businesses of all sizes can choose the model that best suits their needs and budget. For smaller businesses, BYOD can significantly reduce upfront costs associated with purchasing and managing a fleet of company-owned devices. Plus, the Google Admin console provides a user-friendly interface, simplifying tasks like device provisioning and policy enforcement, making it easier for businesses with limited IT resources to manage their mobile workforce effectively. By offering a range of deployment options, simplified management tools, and cost-effective solutions, Android Enterprise empowers businesses of all sizes to leverage effective device management. Myth 3: BYOD is too risky for enterprise environments Reality: With the right approach, Bring-Your-Own-Device (BYOD) can be a secure and cost-effective strategy Android Work Profile provides a self-contained profile on an Android device that isolates work apps and data from personal apps and data, enabling businesses to safely implement BYOD policies. This secure container safeguards sensitive company data through robust encryption and remote wipe capabilities, even if personal apps are compromised. Work Profile also empowers organizations with enhanced app management capabilities. Businesses can implement approved app lists, ensuring only necessary applications are used for work, without impacting personal app usage. Additionally, they can enforce restrictions on specific app functionalities within the work environment. With these advanced security and management features, Work Profile empowers organizations to securely embrace the flexibility of BYOD. For more detail explore this Work Profile Security on Company Owned Devices paper. Myth 4: Android Enterprise is too complex to implement and manage Reality: Android Enterprise simplifies device management with powerful tools designed for businesses Android Enterprise has significantly simplified management with features like zero-touch enrollment for easy device setup and streamlined policies for controlling work apps and data. Managed Google Play empowers IT administrators with granular control over app distribution and management, ensuring only approved applications are installed on company devices, including tailored company apps. By integrating with leading EMM providers to leverage these tools, businesses can easily customize devices to meet their specific needs, enforce security policies, and manage their mobile workforce efficiently. Myth 5: Android devices are more susceptible to malware Reality: All mobile devices can be targets for malware, but Android has implemented robust security measures to protect against threats Google Play Protect leverages machine learning to proactively detect and combat malware, phishing attacks, and ransomware. It scans apps both before and after installation, even monitoring them for suspicious behavior after download. This proactive approach, combined with regular security updates, provides a robust defense against malicious software, significantly reducing the risk of installing and running harmful apps on Android devices. See for yourself with our Transparency Report. It highlights just how rare downloading potentially harmful applications on an Enterprise device really is. Myth 6: BYOD makes it difficult to achieve a good work-life balance Reality: Android Work Profile allows employees to easily switch between work and personal profiles, enabling them to disconnect from work when they need to By separating work and personal data and apps, Work Profile helps employees maintain a clear boundary between work and personal life, reducing stress and enhancing well-being. Employees can seamlessly switch between the Work Profile, and their personal profile, enjoying a familiar device environment while empowered to toggle off work notifications and fully disconnect for a better work-life balance, increased productivity and employee wellbeing. Myth 7: Android Enterprise is not suitable for highly regulated industries Reality: Android Enterprise provides the robust security and compliance features necessary for highly regulated industries Highly regulated industries require robust mobility management solutions with exceptional flexibility and control. Android Enterprise delivers strong security, powerful device management, and innovative solutions to manage and deploy devices seamlessly across diverse use cases. Continuously evolving to address dynamic compliance requirements, Android 15 introduced enhanced security logging aligned with the latest NIAP regulations. Plus, the Android Management API empowers businesses with the agility to adapt policies and ensure compliance with developing industry regulations and security standards. Discover how Android Enterprise empowers financial services in our customer stories, or explore exactly how we comply with industry standards and Android’s certifications in our security paper. Myth 8: Android is fragmented and updates are slow Reality: Android ensures a smooth and consistent user experience alongside simple and robust management capabilities While Android's open nature has historically presented challenges in terms of device fragmentation and update consistency, this view is outdated. As an open-source platform, Android benefits from rigorous scrutiny by a diverse community, including developers, security researchers, and even government agencies. This constant feedback accelerates security advancements. Initiatives like Project Treble have revolutionized the update process by decoupling core Android components from device-specific software. This allows manufacturers to deliver the latest security patches and feature updates more quickly and efficiently. The Android Enterprise Recommended program prioritizes timely security updates and OS upgrades for participating devices, ensuring a more consistent and secure user experience. More widely, Google releases monthly security updates to the platform, the details of which can be found on the Android Security Bulletin. Recommended EMM partners provide essential tools for managing these device updates, ensuring timely patching to maintain a secure mobile environment. Myth 9: Android devices aren't premium Reality: The Android ecosystem boasts a wide range of devices, from budget-friendly options to high-end flagships that rival the best in the industry Premium Android devices offer cutting-edge features like powerful processors, high-resolution displays, and advanced camera features, and innovative designs for a premium user experience. To ensure a consistent and high-quality experience for businesses, the Android Enterprise Recommended program certifies devices and solutions that meet Google's strict enterprise requirements, giving businesses confidence in their chosen devices. Myth 10: The Play Store is limited Reality: The Google Play Store is a vast marketplace with millions of apps, including a wide range of enterprise-grade solutions. From productivity tools and communication apps to industry-specific solutions, the Play Store offers a diverse range of applications to meet the unique needs of any business. Plus, the Play Store empowers businesses to develop and distribute custom applications. By leveraging Android developer tools, businesses can create tailored solutions and securely distribute them to their employees through Managed Google Play. This effectively creates a custom app store while benefiting from the built-in security and robust infrastructure of Google Play Protect. Myth 11: Android Enterprise devices are separate to regular Android devices Reality: The hardware remains the same Android Enterprise is not a separate operating system. It's a suite of tools that enhances the core Android OS with enterprise-grade features and management capabilities. This means any Android device can leverage Android Enterprise, providing businesses with the flexibility and control to meet their specific mobility requirements while maintaining the familiar Android user experience. Myth 12: You can only use Android Enterprise with Google's products and services Reality: While Google offers a robust suite of productivity and collaboration tools, Android Enterprise is designed to be highly interoperable Android Enterprise is only supported on Play protect certified devices. These devices often come pre-installed with popular Google services like Chrome, Google Play Store, and Google Maps (GMS). However, this does not limit users to Google's ecosystem. Android Enterprise seamlessly integrates with a wide range of third-party enterprise applications and services, including those from Microsoft, Salesforce, and others. This flexibility empowers businesses to choose the best software solutions for their specific needs, regardless of their preferred technology stack. Were you surprised by any of these myths? Have you encountered similar challenges or misconceptions in your own experiences? Let us know in the comments below.
