Tag: Android

  • Setting up Android Enterprise enrolment in Intune.

    I recently sat down to enrol a fleet of brand new corporate Android tablets into Microsoft Intune.

    Everything was cruising along nicely until Intune stopped me in my tracks with a bizarre error message. What should have been a five minute job turned into a stubborn puzzle that cost me half my morning.

    Picking the Right Enrolment Path

    Before you hand out tablets to a team, you have to tell Intune how they will be used. Android gives you three basic flavours:

    • Corporate-owned, fully managed: The company owns the hardware, one user logs in, and IT has full control. This was what I needed.
    • Dedicated devices: Great for a front desk sign-in screen locked to one app, but useless for mobile staff.
    • Work profile: Best for personal phones where you only want a tiny, secure work bubble.

    I picked fully managed, set up my enrolment profile, and decided to do things properly. For a more detailed explanation of these please visit Android Management Options

    A Quick Win: Naming Your Devices

    Before touching the hardware, I always set up an automatic naming template. Leaving default device names makes your admin portal look like a junk drawer.

    I used this handy format in the enrolment profile:

    TAB-{{DEVICETYPE}}-{{SERIAL}}

    This tags every tablet with its hardware type and unique serial number right out of the box. It makes finding a specific device later ridiculously simple.

    Down the Rabbit Hole

    Next, I wanted every new tablet to drop into a dedicated Entra ID security group automatically as soon as it enrolled. That way, all the apps and security policies apply without me lifting a finger.

    I tried to save the profile, but Intune threw a giant warning at me:

    “Before you configure device groups, make sure that the Intune Provisioning Client or Intune ClientConfidential app has been added as an owner.”

    Fair enough, I thought. I jumped over to Entra ID, opened my tablet security group, clicked Owners, and searched for both names.

    Nothing. The search box stared back at me, completely blank.

    I figured the app was just hiding in the tenant. I opened Enterprise applications and searched for “Intune”, but the only thing that popped up was a PowerShell tool. Neither of the apps Microsoft explicitly told me to add actually existed under those names.

    Cracking the Code

    After twenty minutes of digging through documentation and banging my head against the desk, I realised Microsoft played a naming trick. The service principal is in your tenant, but its display name changes depending on how the tenant was set up.

    The name is a red herring. The secret is finding it by its permanent Application ID:

    f1346770-5b25-470b-88bd-d5744ab7952c

    Once I stopped searching for names, fixing it took sixty seconds:

    1. Open Entra ID and head to Enterprise applications.
    2. Change the search filter to Application ID starts with and paste in f1346770-5b25-470b-88bd-d5744ab7952c.
    3. Check the name that appears. In my tenant, it was disguised as Intune Autopilot ConfidentialClient.
    4. Go back to your device group, click Owners, choose Add owners, and paste that exact name in.

    As soon as that hidden app became an owner, Intune happily accepted the group and the tablets enrolled smoothly.

    Save that Application ID in your notes. The next time Intune sends you on a wild goose chase, you can skip the headache and get right back to work.

    Give it a spin on your next rollout and see what you think.

  • Which Android Management Mode Do You Actually Need?

    I spent way too much time testing different Android enterprise setups before realizing one simple truth: you cannot manage every device the same way.

    Pick the wrong mode, and you either end up with angry staff or a massive security headache.

    Here is how I break down the three main flavors of Android device management, so you can pick the right tool for the job.

    Corporate-Owned, Fully Managed

    The company buys the phone, hands it to an employee, and IT keeps full control.

    This was exactly what I needed for my fleet. You can push updates, wipe the hardware remotely if it gets lost, and lock down security settings without asking permission.

    • Best for: Company-owned phones issued to individual staff members.
    • Why it works: You get complete visibility and protection without compromise.

    Dedicated Devices

    Think of these as digital kiosks. They are locked down tight, usually running just a single app or a tiny set of approved tools.

    They are fantastic for a front-desk visitor sign-in screen, a warehouse barcode scanner, or an interactive shop display. But try giving one to a mobile worker who needs email, maps, and a browser, and it quickly becomes useless.

    • Best for: Kiosks, shared inventory scanners, and point-of-sale tablets.
    • Why it works: Nobody can tamper with the settings or wander off into YouTube.

    Work Profile

    This is the sweet spot for Bring Your Own Device (BYOD) setups.

    Instead of taking over the entire phone, you create a secure, encrypted sandbox just for company apps like email and Slack. The user keeps total privacy on their side of the phone, and IT gets full control inside the work container. If that person leaves the company, you can wipe the work data in one click without touching their personal family photos.

    • Best for: Personal phones used for light day-to-day work tasks.
    • Why it works: Total privacy for the employee, solid security for the company.

    Match the management mode to the actual daily job, and your deployment will run a whole lot smoother. Give these setups a test run in your lab and see which one fits your team best.