Since last month Android Enterprise Corporate-owned dedicated device with Azure AD Shared mode (what a name!) is generally available in Microsoft Intune. Time to have a look at this new management mode.
As written in this article;
With this new capability, customers can now optionally enroll their AE dedicated devices into Azure AD Shared device mode, which will allow end-users to gain single sign-on and single sign-out across all of the participating applications on the device.
Single sign-on, that sounds good!
To get our devices enrolled, we have to set up a few configurations in Intune. We need to create an Enrollment profile, to enroll our Android devices in AAD shared mode.
We need to create a Device restrictions profile, to configure our devices as kiosk devices.
We deploy the Managed Home Screen app to our devices to manage the home screen.
And we create an App Configuration policy, to configure the Managed Home Screen app.
Let’s get started!
Configure Enrollment profile
- Sign-in to the Endpoint Manager admin center
- Browse to Devices – Android – Android enrollment
- Choose Corporate-owned dedicated devices
- Click Create profile
- Give the profile a Name
- Enter a Description (Optional)
- Choose Token type Corporate-owned dedicated device with Azure AD shared mode
- Choose a Token expiration date
- Click Next
Review the settings and click Create.
After the profile is configured, open the enrollment profile and open the Token tab. With the token, we can enroll the device. Enrollment starts for example by scanning the QR Code in OOBE mode. Or you can use the token, to configure zero-touch enrollment with Samsung Knox or Google Zero touch enrollment.
Configure Device restrictions profile
The next step is to configure a Device restrictions profile. In this profile, we configure the kiosk mode and the Home screen.
- Browse to Devices – Android – Configuration profiles
- Click Create profile
- Choose Android Enterprise as Platform
- Choose Device restrictions under Fully managed, dedicated….. as Profile type
- Click Create
- Give the profile a Name
- Enter a Description (Optional)
- Click Next
- Open Device experience
- Choose Dedicated device as Enrollment profile type
- Choose the preferred Kiosk mode
Configure the other settings to your needs.
For example, create a custom app layout and configure the home screen like below.
Configure App Configuration policy
In the App Configuration policy, we configure the Managed Home screen app. We configure the sign in type, to provide single sign on. And (optionally) we configure the session pin and auto sign-out time.
- Browse to Apps – App configuration policies
- Click Add – Managed devices
- Give the profile a Name
- Enter a Description (Optional)
- Choose Android Enterprise
- Choose Fully managed, dedicated….
- Click select apps and select Managed Home screen on the right (click OK)
- Click Next
- Choose Use configuration designer as settings format
- Configure the below settings to your needs by clicking Add and select the items on the right
Count down time on auto Sign-out dialog
Auto Sign-out time
Enable Auto Sign-out
Complexity of session PIN
Enable session PIN.
Sign in type
Enable sign in
Deploy Managed Home Screen app
I assume you already know what the steps are to deploy a Managed Google play store app. At least the Managed Home screen app needs to be deployed. But also don’t forget to deploy the apps, which your users are allowed to use on the device.
This are minimal the configuration steps to configure our devices as dedicated devices with shared AAD mode.
End-user experience
Let’s have a look at the end-user experience.
How the enrollment is started depends on the enrollment method you choose. I configured Samsung Knox Mobile enrollment, and therefore as soon as I have an internet connection, the enrolment is automatically started.
A notification is shown, this isn’t a private device.
Choose Next.
In the next enrollment phase, the work apps are installed.
Choose Install.
After the required apps are installed, choose Next.
Choose Set up to register the device.
Choose Done, when the registration is finished.
As soon as the profiles are applied and the Managed Home Screen app is launched, you are presented a sign in screen.
As I have configured Text message as authentication method, my frontline workers are able to sign in to the shared device using their mobile number.
Enter the code sent to your mobile, to sign in to the device.
As I have configured the requirement of a session PIN, the user needs to enter a PIN to secure the session.
And we’re signed in to the device!
As Microsoft Teams participates with the Azure AD Shared mode, the user is provided a single sign on experience when Teams is opened.
When Auto sign out is configured, after the inactivity time is almost reached a notification is shown to sign out or resume.
That’s it for this post.
The sign in experience is a great step forward for the end user when to app supports Azure AD MSAL and integrates with Azure AD shared mode. Unfortunately at the moment of writing, only the Managed Home Screen and Teams app support MSAL. I hope this will change soon, so other apps provide a single sign on experience as well.
Thanks for reading!
Hi Peter,
Awesome article.
May I ask, what tooling are you using to create the screenshots during enrollment?
Hi Jordi,
Thanks!
I’m using the build-in screenshot feature. Nothing fancy :)I
Even during enrollment, the screenshots are saved in the gallery and can be accessed after enrollment (when you are able to exit kiosk mode).
Hi peter,
how do you configure “configured Text message as authentication method, my frontline workers are able to sign in to the shared device using their mobile number.”
You need to configure those Multifactor Authentication (MFA) options in Azure.
I have enforced authenticator app on all user accounts, which is just as easy for the end user to use, when configured correctly.
This would be amazing except that Outlook retains the previous user’s config which isn’t ideal.
Hi Peter! Nice article. I am testing the profile myself and I followed the steps mentioned but for some reason on the “installing work apps” part I just see Microsoft authenticator and Intune, I dont see Managed home screen, even if I configure the policy and I also set it as required. Do you have any other idea on whats happening?
Thank you!
i also have the same issue as you when i doing testing
Hi Gianelli and Jeffery,
How is the app assigned, to a dynamic group?
If you use a dynamic group, that might cause a delay as the newly enrolled device isn’t directly a member of the group during enrollment.
Great guide which is helping me set this up.
I did have a question around how the device is picking up the device restriction when enrolled. When I create the device restriction it asks what group it wants to assign this too. Is this being done via a Dynamic Group which is looking at which devices are using the newly created enrolment profile created in step 1.
Question…..I want to give one Enterprise dedicated device access to Instagram but not to any other device is this possible or do I have to setup a new token etc.
Hi, I follow your setup to setup shared device but once the MS Home Page app is install its forcing me to setup pin on device (not pin per session)
How can I avoid setting up pin for device