How to start with Android Enterprise Corporate owned, fully managed user devices in Microsoft Intune

A few days ago I wrote about setting up Android Enterprise Work profiles. Today I will show how to get started with a second management mode; Corporate owned, fully managed user devices. With this management mode the IT admin takes full control of the device, unlike with Work profiles.

To get started with Android Enterprise Corporate owned, fully managed devices your managed Google Play account needs to be connected with your Intune tenant. If you want to see the steps which needs to be taken to connect Intune with Google play, see my previous blog.

Enable Corporate owned devices

When the connection is set between Intune and Google Play, the next thing we need to do is enabling Corporate owned devices.

1. Open the Device Management Portal and click Device Enrollment
2. Click Android enrollment
3. Click Corporate owned, fully managed user devices (Preview)

Set Allow users to enroll corporate-owned devices to Yes.

An enrollment token will be created. During enrollment this token is needed to let your users scan the code and enroll their device.

Create a device restrictions profile

The second step is creating a device restrictions profile for Device owner only.

1. Click Device configuration – Profiles
2. Click Create profile
3. Give the configuration a Name
4. Give the configuration a Description (Optional)
5. Choose Android Enterprise as Platform
6. Choose Device Owner Only – Device restrictions as Profile type

Pick the right settings for your environment on all the configuration tabs. For my test I only blocked Factory reset.
A new tab since the second preview is the Applications tab. On this tab you can choose to allow access to all the apps in the Google Play store.
When finished the settings click OK twice and click Create.

1. Click the Assignments tab
2. Search for your security group and add it
3. Click Save

Create a Device Owner Compliance policy

Since the second preview of Corporate owned, fully managed user devices the Device Owner Compliance policy option is available. So from now on we can create a compliance policy and use that for example in a Conditional Access policy to allow or block access to company data.
To create a compliance policy, follow below steps.

1. Click Device Compliance – Policies
2. Click Create Policy

1. Give the compliance policy a Name
2. Dive the policy a Description (optional)
3. Choose Android Enterprise as Platform
4. Choose Device Owner as Profile Type
5. Click the Settings tab – Device properties tab to configure devices requirements like minimum OS versions
6. Click OK

On the System security tab you set requirements like Require a password and the password type.
Click OK twice and Create when finished.

1. Click the Assignments tab
2. Search for the security group of choice and select the group
3. Click Save to assign the compliance policy

Approve and assign Android applications

The next step in this configuration is approving and assigning Android applications from the Managed Google Play store.

1. In the Device Management Portal click Client apps – Apps
2. Click Add

1. Choose Managed Google Play as App type
2. Click the Managed Google Play (Approve) tab
3. Search for the required app and click the app

Click Approve

Click Approve

1. Click Keep approved when app requests new permissions
2. Click Save

Click OK

Click Sync

After a few seconds the approved apps are available in Intune.

1. To assign the approved app, click the app
2. Click the Assignments tab
3. Click Add group
4. Select Required as Assignment type
5. On the Include tab search for the security group you want to assign the policy to and select the group
6. Click OK twice – click Save

Repeat these steps for all Android applications you want to deploy to your managed devices.

End-user Experience

Now let`s have a look at this end-user experience. For this test using the QR code scanner, you need an Android device with Android 7 or higher.
The enrollment is started by tapping on the screen seven times.

Depending on the device/ Android version it will install a QR code reader if that isn`t already available on the device by default.

Some of the screens below might look different the you will see, or you will see some extra screens. That depends on the Android OS version and supplier. For example I got to accept some terms and conditions from Motorola on one device, but haven`t such conditions on a Nokia.

Scan the QR Code which we have in the Device Management Portal. This will start the device enrollment.

The setup of the work device is started.

Accept the Chrome Terms of service and Privacy notice by clicking Accept & Continue.

Sign in with your corporate credentials.

Setting up device

If you require a PIN to unlock the device, than the first step is to set a PIN.
Click START.

You`re redirected to the settings where you can set the required PIN code. When finished, you`re redirected back to the enrollment wizard.

When device encryption is set as a requirement, the second step is to enable secure start-up. Click START.

Settings is opened again where you can enable Secure startup.

Back at the wizard, click INSTALL to start the installation of the assigned apps

Wait for the required apps Microsoft Authenticator and Intune which are installed. Those apps are installed by default, without the need to assign them manually.
Click Next when the apps are installed.

The next step is to register your device. It is done by signing in to the Microsoft Intune app.
Click START.

Click SIGN IN.

Click NEXT to register the device in Intune.

Click DONE.

The setup and registration is finished.
Click DONE.

You are now logged on to the Android device.
We can see all the applications assigned as required are installed, or will be installed shortly.

Installation of those applications is done without the need of a (personal) Google Play account. You`re signed in to the Google Play store with a Google for Work account automatically.

When we open the Microsoft Intune app all the user owned devices are shown.

Applying Intune policies is handled by the Device Policy app which is installed by default, but not shown between the apps. You can open the app from the Play Store or via Settings, Google, Device Policy.
When you open the app you can perform a manual sync and see an overview of (some of the) applied settings and installed apps.

If we open the settings, we can see Factory reset is not available as set in the Device Restrictions policy.

That`s it for Android Enterprise Corporate owned, Fully managed user devices.
Are you also interested in using Android Enterprise combined with Samsung Knox Mobile Enrollment (KME)? Have a look at my article about Samsung KME.