Close Menu
Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Facebook X (Twitter) Instagram
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    • Home
    • Intune
    • Windows
      • Modern Workplace
    • macOS
    • Android
    • iOS
    • Automation
      • Logic Apps
      • Intune Monitoring
      • GitHub
    • Security
      • Passwordless
      • Security
    • Speaking
    • About me
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Home»Android»Set Microsoft Launcher as the default launcher for fully managed Android Enterprise devices
    Android

    Set Microsoft Launcher as the default launcher for fully managed Android Enterprise devices

    Peter KlapwijkBy Peter KlapwijkJune 20, 2020Updated:June 20, 202053 Mins Read

    With the latest Microsoft Endpoint Manager (Intune) service release (2006), we are now able to set the Microsoft Launcher as the default launcher for fully managed Android Enterprise devices.

    A reason for setting the Microsoft Launcher as default is to make your different Android devices in the company have the same look and feel. As every Android vendor changes the stock Android experience, it might be hard to provide support on all those devices with all those different launchers. Using the same launcher on every device, makes it much easier to support this.

    To set the Microsoft Launcher as the default launcher, we need to deploy the Microsoft Launcher app and use a Device restrictions profile to set the launcher as default.
    Optional we can use an App Configuration policy to deploy additional settings for the Launcher and grant permissions to the app.

    So let`s get started with this setup.

    Deploy the Microsoft Launcher app

    We start by deploying the Microsoft Launcher app as required to our Android Enterprise Fully Managed devices.

    • Sign-in to the Endpoint Manager admin center
    • Browse to Apps – Android apps
    • Click +Add
    • Select Managed Google Play app as App type
    • Click Select
    • Search for Microsoft Launcher
    • Select Microsoft Launcher
    • Click Approve (twice)
    • Click Done
    • Click Sync in the top left corner
    • After a few minutes the app is shown in the overview
    • Assign the app as required to the security group of choice

    Create Device restrictions profile

    To set the Microsoft Launcher as default launcher we use a Device restrictions configurations profile.

    • Browse to Devices – Android
    • On the Configuration profiles tab click +Create profile
    • Select Android Enterprise as Platform
    • Select Device restrictions (under Device Owner only) as Profile
    • Click Create
    • Give the profile a Name
    • Enter a Description (Optional)
    • Click Next
    • Open Device experience
    • Select Fully managed as Enrollment profile type
    • Set Make Microsoft Launcher the default launcher to Enabled
    • Make your choice in all other settings
    • Click Next

    Finish the wizard by assigning the profile to a security group of choice.

    Create App configuration policy

    The option to create and deploy an App configuration policy is optional, but granting the required permissions to the app with the profile provides a better experience for the user, otherwise the user needs to grant these permissions manually.
    Besides the permissions, additional settings can be deployed like a default background.

    • Browse to Apps – App configuration policies
    • Click +Add
    • Select Managed devices
    • Give the policy a Name
    • Enter a Description (Optional)
    • Select Android Enterprise as Platform
    • Select Device Owner Only as Profile type
    • Click Select app
    • Search for launcher
    • Select Microsoft Launcher
    • Click OK
    • Click Next
    • Click +Add
    • Select all permissions which are needed by the app
    • Click OK
    • Select Auto grant from the drop-down list for every permissions
    • Select Use configuration designer as Configuration settings format
    • Select all the additional settings of your choice, like Set Device Wallpaper
    • Click OK
    • Set the Configuration value for every settings
    • Click Next

    Finish the wizard by assigning the policy to a security group.

    End-user experience

    Now that all settings and the Microsoft Launcher app are deployed, let`s have a look at the end-user experience.

    The Microsoft Launcher is set as default launcher. As I replaced the default wallpaper by using the App configuration policy, that wallpaper is shown on my screen shot.

    When I swipe to the left, the Microsoft Launcher feed is shown. As I have applied the calendar permissions already with the App Config policy, no need for the user to grant that permission. Only sign-in to show the calendar items.

    When we have a look at the App permissions, we see all required permissions are indeed applied.

    That`s it for this post. Thank you for reading! Reach out to me if you have any feedback or questions.

    Share. Facebook Twitter LinkedIn Email WhatsApp
    Peter Klapwijk
    • Website
    • X (Twitter)
    • LinkedIn

    Peter is a Security (Intune) MVP since 2020 and is working as Modern Workplace Engineer at Wortell in The Netherlands. He has more than 15 years of experience in IT, with a strong focus on Microsoft technologies like Microsoft Intune, Windows, and (low-code) automation.

    Related Posts

    How to start with Android Enterprise Corporate owned dedicated devices in Microsoft Intune

    April 24, 2019

    How to start with Android Enterprise Corporate owned, fully managed user devices in Microsoft Intune

    April 18, 2019

    How to start with Android Enterprise work profiles in Microsoft Intune

    April 16, 2019
    View 5 Comments

    5 Comments

    1. Rkast on March 28, 2021 18:20

      I applied all app permissions (also read, write contacts) but always get a prompt for contact sync/permission. Any method to prevent the prompt?

      Reply
    2. Bastiaan on April 20, 2022 16:39

      I can’t get this to work. The Microsoft Launcher is installed in the work profile, but it is not set as the default launcher. The app configuration policy is showing a conflict warning icon, but no error message with more details. When I try to set the Microsoft Launcher as default using the Android UI, I receive an error: “You are using this application outside of work profile”. I cannot get this to work. What did I do wrong?

      Reply
      • Peter Klapwijk on April 20, 2022 20:54

        Do you try to configure this in the Work profile?
        The article describes how to configure the launcher or a fully managed device, without a work profile.

        Reply
    3. Andreas Nuechter on August 17, 2022 22:24

      Hi Peter, can we use MS launcher on work profile on Android devices as single launcher for work and private profile? Due to data privacy regulations we can’t use a fully managed device with private employee data. Thx Andreas

      Reply
    4. New Admin on March 11, 2023 15:46

      This helped me to auto start Microsoft Launcher after reboot on a fully managed device!

      Reply
    Leave A Reply Cancel Reply

    Peter Klapwijk

    Hi! Welcome to my blog post.
    I hope you enjoy reading my articles.

    Hit the About Me button to get in contact with me or leave a comment.

    Awards
    Sponsor
    Latest Posts

    Create deployment ring groups for Microsoft Intune

    June 27, 2025

    Update Windows Defender during Windows Autopilot enrollments

    May 16, 2025

    Hide the “Turn on an ad privacy feature” pop-up in Chrome with Microsoft Intune

    April 19, 2025

    How to set Google as default search provider with Microsoft Intune

    April 18, 2025
    follow me
    • Twitter 4.8K
    • LinkedIn 6.1K
    • YouTube
    • Bluesky 1.5K
    Tags
    Administrative Templates Android Automation Autopilot Azure Azure AD Browser Conditional Access Edge EMS Exchange Online Feitian FIDO2 Flow Google Chrome Graph Graph API Identity Management Intune Intune Monitoring iOS KIOSK Logic Apps macOS MEM MEMMonitoring Microsoft 365 Microsoft Edge Microsoft Endpoint Manager Modern Workplace Office 365 OneDrive for Business Outlook Passwordless PowerApps Power Automate Security SharePoint Online Teams Windows Windows 10 Windows10 Windows 11 Windows Autopilot Windows Update
    Copy right

    This information is provided “AS IS” with no warranties, confers no rights and is not supported by the authors, or In The Cloud 24-7.

     

    Copyright © 2025 by In The Cloud 24-7/ Peter Klapwijk. All rights reserved, No part of the information on this web site may be reproduced or posted in any form or by any means without the prior written permission of the publisher.

    Shorthand; Don’t pass off my work as yours, it’s not nice.

    Recent Comments
    • Parth Savjadiya on Using Visual Studio with Microsoft Endpoint Privilege Management, some notes
    • Chris Johnson on Assign Deny Local Log On user right to an (Azure) AD group by using Microsoft Intune
    • Northernsky on Automatically wipe a Windows 10 device after a number of authentication failures
    • Henrik on Intune Driver update for Windows – Get applicable devices
    • Adam on Get notified on expiring Azure App Registration client secrets
    most popular

    Application installation issues; Download pending

    October 1, 2024

    Restrict which users can logon into a Windows 10 device with Microsoft Intune

    April 11, 2020

    How to change the Windows 11 language with Intune

    November 11, 2022

    Update Microsoft Edge during Windows Autopilot enrollments

    July 9, 2024
    Peter Klapwijk – In The Cloud 24-7
    X (Twitter) LinkedIn YouTube RSS Bluesky
    © 2025 ThemeSphere. Designed by ThemeSphere.

    Type above and press Enter to search. Press Esc to cancel.

    Manage Cookie Consent
    To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
    Functional Always active
    The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
    Preferences
    The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
    Statistics
    The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
    Marketing
    The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
    Manage options Manage services Manage {vendor_count} vendors Read more about these purposes
    View preferences
    {title} {title} {title}