Microsoft Intune: Deploy Company-owned device

1. Create the enrollment profile: go to Microsoft Intune > Device enrollment > Android enrollment and click Corporate-owned dedicated devices.

   

2. Click Create Profile and then give it a name, description and a token expiry date (max 90 days)

   

3. Click Create in the create profile window.

   

   

4. Click profile you just created

5. Click Token.

   

6. Click Show token.

   

7. This token is required when enrolling the corporate owned dedicated devices.

   

Create an Azure AD Group

1. Navigate to portal.azure.com, locate and select Azure Active Directory.

2. Select Groups > New group.

   

3. Provide a name for the group such as Android Enterprise Kiosk Profile and set Membership type = Dynamic device.

   

4. Select Dynamic device members.

5. Use a simple rule using the enrollmentProfileName attribute to create the dynamic rule as shown below:

   

Add apps from Managed Google Play

1. Go to Microsoft Intune > Client apps – Apps > Add App.

2. Select Managed Google Play > Approve.

   

3. Search for “Managed Home Screen” and any other apps needed in Kiosk mode.

   

4. Press Sync to add these apps to the apps list.

   

5. Assign the apps to the “Android Enterprise Kiosk Profile” group.

   

Create an Android enterprise kiosk configuration profile

1. Within Intune, select Device configuration > Profiles > Create Profile.

   

2. Select Properties > Platform = Android Enterprise, Profile type = Device restrictions

3. Select Settings > Dedicated devices and choose Single or Multi app Kiosk mode.

4. Select Add and add the apps previously added to Managed Google Play that were synced with Intune. Do not add the Managed Home Screen app

5. Go to Intune > Device Configuration > Profiles.

6. Select the Kiosk mode profile

7. Assign the Azure AD group created earlier.

   

To enroll your device as an Android Enterprise Company-owned device, you need to ensure the device is factory reset and at the welcome screen. From here, there are 3 ways you can enroll your device into Intune as an Android Enterprise Company-owned device.

• DPC Identifier [Also known as the hashtag method] afw#setup
• QR Code Enrollment / NFC Enrollment
• Knox Mobile Enrollment

KME Enrollment

1. To automate with KME, log into the KME console via https://www.samsungknox.com/ and select MDM Profiles.

2. Then select Create Profile.

   

3. Give the profile a name and pick Microsoft Intune as the MDM.

4. Enter https://aka.ms/intunekme_deviceowner as the MDM Agent APK.

   

5. Click Continue.

   

6. Enter {"com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN":“YOUR TOKEN"} in the custom JSON box.

   

7. Your token will be found in your enrollment profile in the Intune console.

   

8. Next go to Devices in KME and select the device(s) you want to assign the Intune profile to.

9. Select Actions drop down and select Configure devices.