#Modern Workplace

Credits: Google Microsoft’s shift to the modern Google Android Management API (AMAPI) brings a highly anticipated, low-friction onboarding experience to Android Enterprise Personally-Owned Work Profiles: Web-Based Enrollment. This mirrors the web-first workflow we’ve seen on iOS for a while, completely removing the traditional requirement for end-users to pre-download the heavy Intune Company Portal application from the public Play Store. However, moving to a modern, browser-driven enrollment framework completely changes how security tokens are passed under the hood. So if you are planning to deploy Android Web-Based Enrolment while maintaining a strict Zero-Trust tenant, you will almost certainly run into infinite authentication loops, hidden app blocks, and broken single sign-on (SSO). In this blog post, I’ll break down the architectural reality of Android container sandboxing, uncover the hidden identity dependencies, and detail the exact Conditional Access exclusions you need to m...

Enrolment time grouping for Android Enterprise is finally here. I had been using it for Autopilot Device Preparation (APDP) and now that it supports Android OS, I wanted to experience it first hand and capture all the caveats or gotchas. For those who are not familiar with the feature, enrolment time grouping was first introduced for Windows OS as part of Autopilot Device Preparation to speed up app and policy provisioning during device enrollment. The feature allows enrolment time grouping when you can add a Microsoft Entra security group in the enrolment profile so that devices are added to the group during enrolment, rather than after. This pre-knowledge of the security group that the device will become member of after enrollment enables Intune to deliver the configurations to the device quickly on enrollment, not only reduces post-enrolment latency but also improves productivity. If you don't configure enrolment time grouping, then Microsoft Intune can only determine the apps a...

When it comes to managed apps on Android Enterprise devices, normally it is Managed Google Play store that comes to mind. One setup and synced, you can make any published app in Managed Google Play store available to the Android managed devices. But what about apps outside the Managed Google Play store? Particularly non Google OEM specific apps in form of system apps? Organizations may want to allow system apps like Camera & Photos Gallery available to the end users to store media files in the work container. This is where Android Enterprise system app type in Intune can come handy. Through this app type you can enable a system app for Android Enterprise dedicated devices, fully managed devices, Android Enterprise corporate-owned with work profile, or Android Enterprise personally-owned work profiles. Before you assign an Android Enterprise system app to a device, you must first enable the app in Microsoft Intune. To enable an app, assign the system app as Required . When you no lo...

Credits: Adobe Stock While working on a MDM migration project, I came across an interesting issue in Intune that almost had me heading down a rabbit hole. As part of the migration, the existing mobile devices were to be un-enrolled from a non Microsoft MDM solution and then enrolled into Intune using the Company Portal method. Nothing fancy, but when this process didn't work, I obviously got into an investigation mode and started looking at some of the obvious things. The obvious items that I looked at - 1. Network requirements for Intune, Android and Apple services. I must state that in this customer's tenant they had ADFS setup, so that added to the complexity. However, since the enrolment was taking place outside the customer's network, none of the network requirements really played a factor. 2. Intune device platform restrictions. Normally when a device is not allowed to enrol in Intune, more often than not it is due to device platform restriction policies. Especially ...

For the last few days I have been working on Android and iOS device management configuration in Microsoft Intune and as part of it I came across Organize apps feature aka Collections in Managed Google Play.  So what are Collections?  Collections are displayed on the front page of the managed Play Store app, allowing easy access to apps of your choice. For example, Organizations can make IT approved essential apps like Microsoft apps for quick access in the managed play store. However, as easy as this may sound, there are some caveats attached to this configuration. Tips from the field - 1. Creating a collection changes the Play Store layout type which requires that all apps must be added to a collection to be visible.  2. Deleting collections doesn't automatically revert to the basic layout. 3. Only approved apps can be added to a collection. 4. The managed Play Store app automatically displays a collection if it contains at least one app that's been made available to the...

While working on some web links for Android Enterprise enrolled devices, I stumbled upon the following message in Intune suggesting that Web apps aren't supported on Android Enterprise devices. So what is the alternative then? Well, it is still a web link but only in form of a published web app through the Managed Google Play. Managed Google Play web links are installable and manageable just like other Android apps. When selected, they will launch in the device's browser. One thing to note is that while Web links published through Managed Google Play Web apps will open with Microsoft Edge or any other browser for that matter, the complete support, particularly for all the display options available for web links (full screen, standalone, and minimal UI), will only work with the Chrome browser. So it is imperative to push a browser for the web links to open correctly. How to create Managed Google Play web link? 1. Sign in to the Microsoft Intune admin center . 2. Select Apps >...