Microsoft Intune Setup

Estimated reading time: 5 minutes

Azure Intune configuration

Need Setup MDM and MAM

Go to Azure Active Directory | Mobility (MDM and MAM)
https://portal.azure.com/?l=en.en-us#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility

Select Item Microsoft “Microsoft Intune”

Switch MDM user scope to ALL
Switch MAM user scope to ALL

Microsoft

Assign Licence Microsot Intune for user security group

Go to Azure Active Directory | Licenses | All Products
https://portal.azure.com/?l=en.en-us#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products

Select License “Microsoft 365 E5 Developer (without Windows and Audio Confere”, go to Licensed groups and press + Assign

Need to be sure Microsoft Intune License is on. Save.

Company Branding

Need setup company branding for setup Logos, background pictures
Go to Azure Active Directory | Company branding | Press + New language
https://portal.azure.com/?l=en.en-us#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding

Endpoint configuration settings for Android devices

Docs on Microsoft https://docs.microsoft.com/en-us/troubleshoot/mem/intune/configure-android-enterprise-devices-intune

Go to Endpoint Configuration
https://endpoint.microsoft.com/#home

Setup Android enrollment

Go to Devices | Android | Android enrollment
https://endpoint.microsoft.com/?l=en.en-us#blade/Microsoft_Intune_DeviceSettings/DevicesAndroidMenu/androidEnrollment

for this step you need Google account Enterprise for make Azure access to Google play apps. And Azure used that account for download and setup apps on Android phones.

Press “Managed Google Play” button
Check “I agree.” on “1. I grant Microsoft permission to send both user and device information to Google. Learn more. “ and press “Launch Google to connect now” button.

Enable Android enterprise work profile enrollment

From the Intune portal, go to Device Enrollment > Enrollment Restrictions, and then select Default under Device Type Restrictions.
Select Properties > Select platforms, select Block for Android, select Allow for Android work profile, select OK, and then select Save to save your changes.

Deploy applications

After your Intune account is connected to your Android enterprise account, you can deploy some applications by following these steps:

Go to Apps All apps Add
In the Select app type pane, locate the available Store app types, and then select Managed Google Play app.
Search for an app to view the app details. Intune Company Portal app.
On the page that displays the app, select Approve. A window for the app opens and prompts you to give permissions for the app to perform various operations.
Select Approve again to accept the app permissions.
On the Approval Settings tab, select Keep approved when app requests new permissions, and then select Save.
Click Select to select the app.
Select Sync at the top to sync the app with the Managed Google Play service.
Select Refresh to update the app list and display the newly added app.
After the app is added to Microsoft Intune, you can assign the app to users and devices.
go to Apps | All Apps and look under Manage to see the app displayed in the list.
To assign the app to a group, select the app that you want to assign. In the Manage section of the menu, select Properties, and then select Edit next to Assignments to open the Add group pane.
In the Assignments tab, under Required, select Add group, select the groups to include, and then select Select.
On the Assign pane, select Review + save to complete the included groups selection.
On the Assignments pane, select Save to save your changes.
Return to the App Properties view, and verify the app under Assignments.

You can also add additional apps and assign to Security group.

Connect Android Phone to the Microsoft Intune

Download from Google Play app Microsoft Corporate Portal
Run Microsoft Corporate Portal and make login use Azure credentional

Full manage Android configuration

Zero touch

Use QR code

Enroll by using a token

For Android 6 and newer devices, you can use the token value, such as 12345, to enroll the device.
Android 6.1 and newer versions can also leverage QR code scanning when using the afw#setup enrollment method.
For corporate-owned work profile (COPE) devices, the afw#setup enrollment method is only supported on devices running Android 8-10. It’s not available on Android 11. For further details, refer to the Google developer docs here.

Steps

Turn on your wiped device.
On the Welcome screen, select your language.
Connect to your Wifi, and then choose NEXT.
Accept the Google Terms and conditions, and then choose NEXT.
On the Google sign-in screen, enter afw#setup instead of a Gmail account, and then choose NEXT.
Choose INSTALL for the Android Device Policy app.
Continue installation of this policy. Some devices may require additional terms acceptance.
On the Enroll this device screen, allow your device to scan the QR code. Or, choose to enter the token manually.
Follow the on-screen prompts to complete enrollment.

Full version on microsoft:
https://docs.microsoft.com/en-us/mem/intune/enrollment/android-dedicated-devices-fully-managed-enroll#enroll-by-using-a-token

QR CODE FOR SVETEKDEV

List Android Devices FOR ENTPERPRISE

Full list devices recommendet with Android Enterprise youu can see:
https://androidenterprisepartners.withgoogle.com/devices/#!?AER

Where you can buy that devices:
https://androidenterprisepartners.withgoogle.com/resellers

REFERENCES

Original: Configure android enterprise devices intune
Original: Android dedicated devices fully managed enroll#enroll-by-using-a-token

azure, intune, configuration