#Modern Workplace

Credits: Google Microsoft’s shift to the modern Google Android Management API (AMAPI) brings a highly anticipated, low-friction onboarding experience to Android Enterprise Personally-Owned Work Profiles: Web-Based Enrollment. This mirrors the web-first workflow we’ve seen on iOS for a while, completely removing the traditional requirement for end-users to pre-download the heavy Intune Company Portal application from the public Play Store. However, moving to a modern, browser-driven enrollment framework completely changes how security tokens are passed under the hood. So if you are planning to deploy Android Web-Based Enrolment while maintaining a strict Zero-Trust tenant, you will almost certainly run into infinite authentication loops, hidden app blocks, and broken single sign-on (SSO). In this blog post, I’ll break down the architectural reality of Android container sandboxing, uncover the hidden identity dependencies, and detail the exact Conditional Access exclusions you need to m...

When it comes to managed apps on Android Enterprise devices, normally it is Managed Google Play store that comes to mind. One setup and synced, you can make any published app in Managed Google Play store available to the Android managed devices. But what about apps outside the Managed Google Play store? Particularly non Google OEM specific apps in form of system apps? Organizations may want to allow system apps like Camera & Photos Gallery available to the end users to store media files in the work container. This is where Android Enterprise system app type in Intune can come handy. Through this app type you can enable a system app for Android Enterprise dedicated devices, fully managed devices, Android Enterprise corporate-owned with work profile, or Android Enterprise personally-owned work profiles. Before you assign an Android Enterprise system app to a device, you must first enable the app in Microsoft Intune. To enable an app, assign the system app as Required . When you no lo...

For the last few days I have been working on Android and iOS device management configuration in Microsoft Intune and as part of it I came across Organize apps feature aka Collections in Managed Google Play.  So what are Collections?  Collections are displayed on the front page of the managed Play Store app, allowing easy access to apps of your choice. For example, Organizations can make IT approved essential apps like Microsoft apps for quick access in the managed play store. However, as easy as this may sound, there are some caveats attached to this configuration. Tips from the field - 1. Creating a collection changes the Play Store layout type which requires that all apps must be added to a collection to be visible.  2. Deleting collections doesn't automatically revert to the basic layout. 3. Only approved apps can be added to a collection. 4. The managed Play Store app automatically displays a collection if it contains at least one app that's been made available to the...

When a device is enrolled in Intune as a corporate device then Intune can collect full phone hardware and app inventory, but only partially for devices enrolled as personal. The benefit of managing devices  as corporate is the unlocking of additional device management capabilities as compared to personal devices. At the time of writing this blog, Intune automatically assigns corporate-owned status to devices that join to Microsoft Entra via: - Device enrollment manager account (all platforms) - An Apple device enrollment program such as Apple School Manager, Apple Business Manager, or Apple Configurator (iOS/iPadOS only) - Windows Autopilot - Co-management with Microsoft Intune and group policy (GPO) - Azure Virtual Desktop - Automatic mobile device management (MDM) enrollment via provisioning package - Knox Mobile Enrollment - Android Corporate-owned devices with work profile - Android Fully managed devices - Android Dedicated devices. - Android Open Source Project (AOSP) Corporat...

Source:Microsoft With the help of Microsoft Intune, organizations can use the device states returned from the enrolled devices to Entra ID to identify whether these devices meet specific policy compliance requirements and accordingly enforce controls to grant or block access to corporate resources. With device states, once the user has successfully authenticated, a Primary Refresh Token (PRT) containing both user and device claims is issued. With conditional access policies requiring either a device-based control or a multifactor authentication control in place, the policy requirement can be met through its device state using PRT without attempting MFA. This is because when a PRT requests access to an application, its device, session, and MFA claims are trusted by Microsoft Entra ID. The PRT is valid for 14 days and is continuously renewed as long as the user actively uses the device, providing users a resilient experience. With the currently available device states, Microsoft recommen...