inTune Android 9 Tablet QR enrollment doesn't run device policy anymore

[Harlington_IT]

Trying out inTune, I was setting up a tablet (TECLAST P80X £64 from Amazon, it's pretty nippy for the price) in multi app kiosk mode, but unfortunately blocked off access to WiFi, and it wasn't recognising that a pin was set to exit kiosk mode.

Managed to do a factory reset, but now when I run through the set up, either via the QR code token, or using sfw#setup, it starts going through the enrollment, then just shows the desktop.

Via QR I can then log into the play store and run the device policy app which asks for the QR token again and runs through installing the required apps, but doesn't have the managed desktop app as a launcher, only as an overlay app which can just be closed by the user.

Via sfw#setup, the play store is set up with the user "Android Enterprise" but it's logged out and needs to be logged back in, which it can't be.

It's also come up saying that "device is already setup", so I removed it from intune, and until I discovered I could go into the play store and run the device policy, it wasn't showing up again as an enrolled device.

 

I've got the kiosk setup working perfectly on another device, and I can factory reset and re-enroll it without any issues. I can delete it from intune and re-enroll without issues.

 

Has anyone come across this?

 

It's no real issue as the tablet is my own so I'll be setting it up eventually with my own gmail details, I'd just like to resolve this issue if possible in case it occurs with any other devices.

[TechMonkey]

Is the policy applied? I found that rebuilding tablets using sfw#setup created a new name. The tutorial I followed had a dynamic group setup that the devices were added to, though I can't remember if this was part of the QR-code setup or something else.

[Harlington_IT]

Is the policy applied? I found that rebuilding tablets using sfw#setup created a new name. The tutorial I followed had a dynamic group setup that the devices were added to, though I can't remember if this was part of the QR-code setup or something else.

 

I've found they get a new name too if the policy is run. The rules for the dynamic group membership is that the OS starts with "And".

 

However with this one device, if I tap the first screen enough times to bring up the QR scanner, then scan the token QR, it goes to the WiFi setup screen, with WiFi off as default. I turn it on, add the hidden network, tap next which takes me to the "Set up your device" screen which says "This device will be managed, monitored and kept secure by your organisation", which I tap on accept. It then says "Setting up work device" before dropping to the standard Android desktop. Opening the play store prompts for an email address, which I use the one registered in Android Enterprise, I can then find and open the already installed Android Device Policy app, which brings up an "Enrol this device" screen. That then takes me to the QR scanner again, and once scanned sets up a separate work profile which installs Microsoft Intune, then activates the intune app, then installs the software set to "required" and adds the tablet to the right group.

 

I'm stumped as to why it doesn't run the Android Device Policy app automatically. If I use the sfw#setup method, I can't manually run the app as it's hidden.