Zero-touch
183 TopicsDefault configuration not applying
Hi, I have 2 configurations in my zero touch portal and our vendors have been adding devices. For some reason, the configuration I have set as default is not applying and I don't see anywhere else to make changes. Any help would be appreciated. Thanks! JT6Views0likes0CommentsIntune Management Capabilities for Samsung Devices
Dear Team, Greetings, I would like to better understand the management capabilities available for Samsung Android devices, with Intune . Specifically, I am looking for clarity on whether these devices can be fully managed through Intune instead of relying on the Samsung Knox management tool, including support for application deployment, patch distribution, firmware updates, and other administrative functions. Any slides reference would be good for my internal discussion ?.55Views0likes6CommentsAndroid COPE Devices randomly wiping
Hello, Recently our COPE profile in ZT is not functioning. The device will go through the enrollment, it gets registered correctly in our tenant (Entra/Intune) and we can get to the home screen just fine. However, after some time the device will receive the following notification: “Your organization has set up this device to be managed by your organization. If this is an error, contact your device’s provider. All data on the device will be deleted. Your device will automatically reset in 2 hour.” The config in ZT and the one in Intune match (token is correct and the DPC extras are fine). This profile was working up until 2 weeks ago. We’re stumped. We recreated a different COPE profiles with the required DPC extras as per Microsoft’s documentation, tried removing compliance policies and device configurations to make it a plain profile. No luck, still receives the reset notification. Phones tested: Samsung A15, Samsung A16 all running the latest Android 16OS with the latest security patch. Any help would be appreciated, thank you!216Views0likes10Comments2FA sign in error at Android Zero Touch portal
I am the IT admin/owner of our Android Zero Touch instance, and I am trying to log into the portal to view and interact with devices associated with our organization. Our zero touch instance is linked with our Intune tenant, and is working correctly. I keep getting the error that my sign in was rejected because it doesn't meet my organization's 2 step verification policy and to contact my IT admin for more information. I am that IT admin, and I can't login. My login information is correct, I have our account ID, and I'm just trying to get in touch with someone to help with the login. I can't even login to support portal to get help, so I had to use my personal Google account to post this.39Views0likes2CommentsWe have all our devices on Samsung Knox; I would like to try using Android Zero-Touch enrollment as well. Is that possible?
We got all our new company Samsung phones added into Samsung Knox. None of the distributors we work with are Android Zero Touch partners; we've asked them to join and they probably won't any time soon. I read that there's been some effort to unify Samsung Knox and Android Zero Touch, although in many cases it still seems like EMMs have better support for Android Zero Touch whereas Samsung would prefer you use their in-house EMM. We would like to try using the Android Zero Touch enrollment as well. Unlike Samsung, it seems like I can't even register my own customer account. So my questions: is there any possible way to get just a Zero Touch customer account set up, with no devices added, when none of the resellers I actually bought a device from are Android partners? Also, is there some way I could get some of our Knox enrolled devices to use Zero Touch?160Views0likes14CommentsIssue: Play Protect Blocks DPC Installation During QR Provisioning on Android 14 / One UI 6.1
Hello, We use QR code provisioning to install our custom Device Policy Controller (DPC) app from a custom download URL (not Google Play). The exact same APK + QR configuration: Works on: Samsung Galaxy S20 — Android 13 / One UI 5.0 Blocked on: Samsung Galaxy S21 — Android 14 / One UI 6.1 Play Protect stops installation with the message: "App blocked to protect your device. This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud." Provisioning QR: { "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "<DeviceAdmin component>", "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM": "<Package checksum>", "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "<S3 bucket url>", "android.app.extra.PROVISIONING_LOCALE": "en_US", "android.app.extra.PROVISIONING_TIME_ZONE": "Europe/Helsinki", "android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED": false, "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME": "<Package name>", "android.app.extra.PROVISIONING_WIFI_HIDDEN": true, "android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE": "WPA", "android.app.extra.PROVISIONING_WIFI_SSID": "<WiFi SSID>", "android.app.extra.PROVISIONING_WIFI_PASSWORD": "<WiFi Password>" } Questions: Question 1: What changed in Android 14 or One UI 6.1 related to: - Sideloading DPCs during provisioning - Play Protect enforcement during QR setup Question 2: What is the new required approach to ensure the DPC installation is allowed? (e.g., signature checksum requirement, Play signing, allow list, new provisioning extras) Question 3: Is there updated documentation that describes the new DPC provisioning security rules? We need to understand the change and how to properly support Android 14+ devices in enterprise deployments. Thank you!Solved159Views2likes5CommentsZTE Enrollment Profiles Issue
Greetings everyone! New day, new challenge. I’ve received a number of Zebra tablets. We already use ZTE, which works fine, but as you know it assigns devices to a single profile based on the serial number. The issue is: These tablets (same model) will be used for many different purposes, and I don’t think it’s efficient to take each device out of the box, read the serial number, and manually assign it to a different ZTE profile. I could easily end up managing 200 different profiles. So my question is: Is there a way to let the device choose which group or category it should belong to during enrollment? For example, during setup the device could ask the user which category it belongs to and based on that selection it would automatically join the correct group and receive the appropriate configuration. Is this possible? Or am I dreaming? 😄 Has anyone faced this issue and found a good solution? Thanks in advance!137Views0likes13CommentsAndroid Zero Touch Portal - Owner Account changed to Admin after adding another User
Hey Team, I was trying to add another user as Admin in our Zero Touch Portal. However, post adding the user, my Owner Role was downgraded / changed to Admin. How do I get the Owner Role back to my account. Thanks in advance. (This post was edited to remove personal information, in compliance with our guidelines)62Views0likes1CommentDevice financing at scale (10,000+ devices): compliant “restricted mode” on delinquency using Android Enterprise (Device Owner)
Hi everyone, I’m building an Android Enterprise device management solution and I want to keep everything fully compliant (Android Enterprise + Google Play policies). Use case: a company provides company-owned devices to customers under a leasing / device financing contract. We need to manage this at scale (10,000+ devices) across multiple customers/tenants. If a customer becomes delinquent, the company needs a temporary restricted mode (e.g., kiosk/limited access) until the account is back in good standing — with clear user notice, grace period, and contractual consent. What we want to control at scale: enrollment, policy assignment, app allow/deny lists, kiosk/lock task mode, updates, compliance reporting, and remote actions aligned with Android Enterprise best practices. Questions: Is this type of “restricted mode for delinquency” considered acceptable in the Android Enterprise ecosystem when devices are Company-Owned (Device Owner) and the policy is transparent/contractual? For 10,000+ devices, what is the recommended architecture: Android Management API (AMAPI) policies only, or a custom DPC (and why)? For distribution, is the safest path a managed Google Play private app per enterprise/tenant, or another approved approach for large-scale deployments? Any best practices to avoid being flagged by Play Protect / Play policy reviews for legitimate enterprise enforcement features (kiosk, app restrictions, device restrictions), especially at this scale? I’m not looking to bypass security or do anything hidden; the goal is a compliant enterprise solution. Thanks for any guidance or official documentation links.Solved129Views0likes8Comments