[Day 2] Mission Intune : When Migration Becomes a Mission (Almost) Impossible
Good Morning Everyone 🕵️ Deep within the digital infrastructure, a high-stakes mission is being prepped. Five mobility experts have been deployed to solve a massive puzzle: migrating tens of thousands of smartphones to Microsoft Intune. The Goal: Ensure a fluid, secure, and uninterrupted transition for thousands of users. The Battlefront: A complex landscape filled with legacy policies, mixed configurations, and strict deadlines. It’s a race against the clock where one wrong move could start a domino effect. From scripts to security protocols—nothing is left to chance. Failure is not an option. Following Broadcom’s acquisition of VMware in 2023, the Workspace ONE product is now owned by Omnissa. Broadcom’s commercial strategy, which has influenced its spin-off companies, had become highly aggressive toward all customers. Consequently, we have decided to migrate the management of our Android and iOS tertiary fleet to Microsoft Intune.. While we are familiar with Intune, several limitations should be noted: Reporting: Intune offers basic reporting through Microsoft Endpoint Manager and Power BI integration, but lacks the advanced, customizable dashboards available in Workspace ONE. Deployment Performance: Application and configuration deployments can be slow, with status updates often delayed due to Intune’s reliance on periodic device check-ins rather than real-time communication. iOS Management: Intune provides full functionality only for devices enrolled via Apple Business Manager (ABM). Non-ABM devices have restricted supervision capabilities, limiting advanced configuration and app deployment. Error Handling: Intune does not display granular error codes in its console. Troubleshooting often requires log collection from the device or use of Microsoft Support tools, increasing diagnostic complexity. Conditional Access & Compliance: Intune integrates tightly with Azure AD for conditional access policies, which is a strength, but requires additional configuration and licensing for advanced scenarios. App Protection Policies: Strong for Microsoft 365 apps, but less flexible for third-party apps compared to Workspace ONE. Migration Strategy Overview The project aims to migrate the entire mobile fleet—a few tens of thousands Android and some iOs devices—between September 2023 and December 2024. Cybersecurity requirements mandate a shift from COBO (with personal Google accounts allowed) to COPE, reinforcing corporate control and reducing exposure to security risks. Key Challenges Technical Constraints: Devices incompatible with Android 13 require hardware replacement. For most employees, migration involves full device reset and Intune re-enrollment—a complex, time-consuming process. Security Limitations: Backup tools cannot be authorized, increasing the risk of data loss and user errors. A recurring issue is failure to remove Microsoft Authenticator configurations, creating significant support overhead. Performance Impact: The Samsung Galaxy A32, previously adequate under COBO, performs poorly under COPE, affecting user experience. Status and Strategic Decision By June 2024, progress is far below target. To mitigate operational disruption and support overload, the strategy shifts: forced migrations are discontinued. Migration now occurs only during: Hardware replacement (obsolescence, failure, or breakage) Voluntary device reset This approach prioritizes stability and resource optimization while maintaining compliance with security standards. We’ve been with Intune for almost two years, we make do with it and we are hardly surprised anymore when something doesn’t work. If you have any questions, don't hesitate to reach out via the comments below KrisManaged configuration to Gboard has disappeared from MDM
The ability to apply a managed configuration to Gbaord has disappeared. We think this is due to a recent change to the Gboard app where Google has removed this ability. Environment: MDM = Omnissa Workspace One UEM (we are also hearing reports of this impacting SOTI customers as well) Rugged Zebra Mobile devices, majority running either A11 or A13 Leads: Managed App configs are still present on Chrome & ServiceNow Now Agent, hence why we believe this is not an MDM Console issue. We have escalated to Omnissa support anyway, who have in turn escalated to Google. Is anyone else seeing this issue?
Request for Android Community: Advice and Help on Playing Pre-Recorded Voice on Calls
To the Esteemed Android Developer Community, I am seeking your expert advice to understand whether my task is feasible on the Android platform. I aim to implement the following functionality: Task Description: Objective: I want to create an Android app that plays a pre-recorded voice message during a phone call. The app will: Automatically answer an incoming call when it is ON. Play a pre-recorded audio file stored on the user's phone (recorded by the user). Audio Content: “I am busy right now, call back after some time.” Disconnect the call after playing the message. Usage Scenario: This feature will be used only when the app is ON. It is intended for times when the user is busy and wants to inform the caller without manually attending the call. Key Requirements: Detect and answer incoming calls automatically. Play the recorded voice message to the caller. Ensure the caller hears the message clearly on their end. Disconnect the call programmatically after the message is played. Questions for the Community: Is this Task Feasible? Can the Android platform route a pre-recorded voice file to the call audio stream (STREAM_VOICE_CALL) so the caller can hear it? Are there technical or carrier-level restrictions that could prevent this functionality? Android APIs or Services: Are there specific APIs, such as TelecomManager, CallScreeningService, or AudioManager, that can handle this requirement effectively? Privacy and Legal Concerns: Are there any privacy or legal considerations (e.g., notifying the caller) that I should be aware of when implementing this feature? Compatibility Across Devices: How can I ensure compatibility across different Android devices and versions (API 26 and above)? Additional Information: Voice File: The pre-recorded message is stored locally on the user’s phone in a secure folder. App Activation: The functionality will work only when the app is manually turned ON by the user. Intent: This is a personal productivity tool to handle calls during busy periods. Help Needed: Advice: Can you confirm whether this task is achievable on the Android platform with existing APIs and hardware? Are there specific approaches or best practices to consider for implementing this? Code Implementation: I am looking to hire an experienced Android developer who can: Write fully working code to achieve this task. Ensure the solution is robust, privacy-compliant, and compatible across devices. I deeply appreciate the Android community's expertise and guidance. Your input will help me determine the feasibility and approach for this project. If you have any suggestions, insights, or are interested in developing this, please reply to this request.
Samsung Secure Folder and DUAL messenger features - not available in COPE
Dear community, hope everyone had lovely Christmas time! I just wanted to raise one issue you also might been run into. It's about Samsung Secure Folder and Dual Messenger features on COPE enrolled devices. Unfortunately these features are not available in COPE enrolled Samsung devices. We used to have all 10k fleet enrolled as BYOD and Secure Folder/Dual Messenger features were/are available. Now only personal owned devices are enrolled as BYOD and corporate owned devices are enrolled as COPE method. Unfortunately there is no setting available for us to make this work on the COPE enrolled devices on EMM side. According to Samsung, they have not updated Secure Folder software in 5 years and and don't necessarily expect we will get any update. The "error message" is very misleading: "Security policy prevents the installation of Secure Folder". Because there is no security policy setup in EMM (Microsoft Intune) for this feature. It's just pure Samsung thing. As mentioned... Samsung Secure Folder solution does not work on COPE enrolled Samsung devices but nice surprise is that on ThinkPhone (Motorola) , Secure Folder works even on COPE. This also implies that Samsung really could make it work if they wanted to put in the development effort, as it is not totally restricted by the Android Enterprise architecture of COPE since the ThinkPhone is able to do it. But so far Samsung does not seem to still support this app much. More on this topic from here: https://communities.vmware.com/t5/Workspace-ONE-Discussions/Android-Samsung-Impossible-to-enable-Dual-Messenger-feature-or/td-p/2260737 -jarmoproblematic re-enrollment following smartphone reset under Android 15
Hey Everyone, Since a couple of weeks, we are encountering a problem with the re-enrollment of devices that have moved to Android 15. our employees arrive on the next screen : I reproduced the incident under the following conditions : Step 1 , the device is enrolled on Omnissa WSP1 in COBO with personnal Google Account Step 2 , for some reasons, the device is erased (example : 10 errors code) Step 3 , the profil in KME or Zero Touch is Microsoft Intune & no more Omnissa Step 4 , It seems that the KME or ZERO Touch verification did not happen at the right time. Step 5 , our employees have to proove the use of the device like a personal device ! We didn't encounter this problem for devices in Android 13 or 14. The devices i used : Motorola g54 5G Android 15 V1TDS35H.83-20-5-5 security patch : 1 july 2025 Samsung A35 - SM-A356B Android 15 AP3A.240905.015.A2.A356BXXS5BYF3 security patch : 1 july 2025 We have several thousand devices left to migrate to Microsoft Intune, this new enrollment behavior is unacceptable for 100% company devices. Our fleet is fully managed in KME or Zero Touch. Can you investigate this incident? Chris
