Intune: Managing Android Devices

[MYK-IT]

Not using Google or G-Suite (as Microsoft 365) but wanted to test enrolling some android mobile phones (school owned) to our Intune.

 

I have been following this method (https://docs.microsoft.com/en-us/mem/intune/apps/apps-add-android-for-work), however I just wanted some advice on the correct method / procedure for enabling "Managed Google Play", as in what (type of) account do I need to setup and use. I presume one that uses our school domain, as opposed to creating a gmail.com one?

 

I have found some other guides relating to this process, but they show screenshots of entering your company name etc. but when I started the 'create account' process 'to manage my business' the first few steps didn't tally up - and I've paused pending verification that this is indeed the correct way of setting up a Google Administration account (for education) for use with Intune?

 

Ultimately, I don't want end-users from creating (random) Gmail accounts to use their work (android) mobiles or to access Play Store.

 

Thanks,

[Reverend_Dan]

I Followed this method

Only needed one google account set up the managed google play store. Everything else is then just taken care of by Microsoft accounts. Its the Corp owned dedicated device you want. and once the device is restarted enrole with afw#setup in the first box. Scan the qr code and it all just works.

Took a couple of days to get my head around it but managed to prove it successful secure when the bursars son tried his password a few times and it auto locked out the phone.

 

Its great though as depending on how your policies are set up in intune as any apps with Win10 and Android versions will autoinstall (once you enable the equivalent in the managed play store)

Edited March 22, 2021 by Reverend_Dan

[MYK-IT]

Thanks @Reverend_Dan,

 

I will check that video out when I get an opportunity.

 

In respect of the Google (Administration) Account to manage the Play Store etc. I was just after confirmation as to the correct (link) type of account to create. E.g. is there a Google Business / Education Administration Account process, as opposed to a standard gmail account/?

 

Thanks,

[Reverend_Dan]

I just set up a bog standard new gmail account and linked it though this. There is no need to go the full google admin. I think it was the usual; lots of old information about the old methods of doing it saying you require a fully set up google admin.

It just uses this account to "purchase" apps from the playstore as a way to sync them with Intune. Which you do by going to apps -> android apps -> create -> type = managed play store. Add them then click the sync button.

 

Pitfall to watch out for is that you can't enrol a device this way if you are an Intune enrolment administrator. It will get your UPN/Email, you'll get a page cannot be found error when it gets to the first part of the Intune enrolment.

[sparkeh]

Yep standard gmail account is fine for the managed store.

 

Also check out Google Zero Touch if your devices support it. We just ship boxed devices to users now. Turn on, input credentials, phone sets itself up and away they go [emoji1303]