Android devices¶
Intune manages Android through Android Enterprise, Google's management framework, on devices with Google Mobile Services (GMS). Devices without GMS, such as many AR/VR headsets and some rugged devices, use AOSP management. The older device administrator method is finished.
Device administrator is no longer an option
Android device administrator management is deprecated and unavailable for devices with access to Google Mobile Services. Don't enroll new devices with it, migrate any remaining ones, and block it with an enrollment restriction so devices can't fall back to it. Intune offers a streamlined flow to move personal devices from device administrator to personally owned work profile.
Choose a method¶
| Method | Ownership | What's managed | Use for |
|---|---|---|---|
| Personally owned work profile | Personal | A separate work profile only. Personal apps and data stay private. | BYOD phones |
| Corporate-owned work profile (COPE) | Corporate | Whole device, with a work profile and room for personal use | Company phones that people may also use personally |
| Fully managed (COBO) | Corporate | Whole device, work only | Company phones for work use only |
| Dedicated (COSU) | Corporate | Whole device, usually locked to one or a few apps | Kiosks, scanners, shared frontline devices |
| AOSP, user-associated or userless | Corporate | Whole device, with a reduced feature set | Devices without Google Mobile Services |
| App protection only | Not enrolled | Work data inside protected apps | BYOD where users won't enroll |
Feature differences that often decide the choice:
| Capability | Work profile (BYOD) | Dedicated | Fully managed |
|---|---|---|---|
| Available (self-service) apps | |||
| Kiosk mode | |||
| Prevent factory reset | |||
| Zero-touch, QR code, NFC or token enrollment | |||
| Personal data stays private | n/a | n/a |
Prerequisite: connect Managed Google Play¶
Every Android Enterprise method needs Intune connected to Managed Google Play. Go to Devices > Enrollment > Android > Managed Google Play and complete the binding with an IT-owned account, not a person's account. Intune then adds Company Portal and other common apps automatically.
Personally owned work profile¶
- Allow Android Enterprise (work profile) for personal devices in your platform restriction.
- Assign a work profile enrollment profile under Devices > Enrollment > Android > Personally-owned devices with work profile.
- Users install Company Portal from Google Play, sign in, and follow the prompts. Work apps show a briefcase badge.
When the user leaves, retire the device. That removes the work profile and leaves personal data alone.
Corporate methods¶
Create the enrollment profile¶
Under Devices > Enrollment > Android, create a profile for Corporate-owned, fully managed user devices, Corporate-owned devices with work profile, or Corporate-owned dedicated devices. Each profile gives you an enrollment token and a QR code. For dedicated devices you also pick a token type: standard dedicated, or dedicated with Microsoft Entra shared device mode for frontline workers who sign in and out of shared phones.
Token management:
- Replace a token that's nearing its expiry date, revoke one that leaked or is no longer needed, and export the token JSON for zero-touch or Knox configuration.
- Revoking or replacing a token doesn't affect devices that are already enrolled.
- Dedicated device tokens have an expiry date you set. Record it in the admin calendar.
- For fully managed devices, a staging token lets you or a partner do all the provisioning steps, so the user only signs in to the Microsoft Intune app (Android 10 and later).
Provision the devices¶
All corporate methods start from a factory-reset device.
| Provisioning method | How it works | Best for |
|---|---|---|
| Zero-touch enrollment (Google) | Devices bought from a zero-touch reseller are assigned to your configuration and enroll on first boot | Large fleets, the lowest-effort option |
| Knox Mobile Enrollment (Samsung) | Samsung's equivalent of zero-touch | Samsung fleets |
| QR code | Tap the welcome screen six times, connect to Wi-Fi, scan the profile's QR code | Small batches and kiosks |
Token (afw#setup) |
Enter afw#setup instead of a Google account, then the token |
When QR isn't practical. Not supported for COPE on Android 11 or later. |
| NFC | Bump the device against a programmed NFC tag | Rarely used today. Not supported for COPE on Android 11 or later. |
The Microsoft Intune app installs automatically on corporate devices and handles enrollment and check-in. Company Portal is used for personal work profile devices.
Exclude the Microsoft Intune cloud app from browser compliance policies
During corporate Android enrollment, setup signs the user in through a Chrome tab. If you have a Conditional Access policy that requires a compliant device (or blocks access) for All resources on Android and Browsers, exclude the Microsoft Intune cloud app from it. Otherwise the enrollment sign-in is blocked by the very compliance it's trying to establish.
Tell users not to restart during enrollment
A fully managed or COPE device that restarts halfway through enrollment can look enrolled but never receive policies. If that happens, factory reset it and start again.
Dedicated devices¶
- Use Managed Home Screen for a multi-app kiosk with your own layout, wallpaper, allowed apps, and optional sign-in for shared use.
- Assign dedicated device apps and policies to device groups. There's no user to target.
- Use a dynamic group based on the enrollment profile name (
enrollmentProfileName) so devices land in the right group, or use enrollment time grouping.
AOSP devices¶
AOSP management is for corporate devices without Google Mobile Services: many AR/VR headsets, smart glasses and some rugged devices. Microsoft supports a specific list of device models.
- Enrollment uses a QR code, either user-associated (one user) or userless (shared).
- The feature set is smaller than Android Enterprise. Check the supported settings before you commit.
- Without Google's push service, some actions can take up to 8 hours to reach the device, including wipes, app deployments, remote lock and passcode reset.
Things that change over time¶
- Play Integrity verdicts: On Android 13 and later, Google's strong integrity verdict now depends on the device having recent security updates. Devices that fall behind can drop to device integrity, which can block them through app protection conditional launch or compliance. Set a realistic minimum security patch level in compliance policies and min patch version in app protection, and watch the app protection status report for outdated patches.
- Factory reset protection: If you configure factory reset protection emails, only those Google accounts can unlock a device that was reset outside Intune. A wipe from Intune doesn't trigger factory reset protection.
- Firmware updates: Samsung and Zebra devices can get firmware over-the-air updates through Intune. See Apple and Android updates.