Android Kiosk Enrollment and Microsoft Intune

Last month I wrote about the different Android enrollment scenarios Microsoft Intune supports. For this month's post, I'm focusing on the Android enterprise enrollment process, specifically single purpose device enrollment (e.g. kiosk) using a factory reset device.

Note: the device must be factory reset to enroll using Android enterprise.

Let's get started

Create an Azure AD Group

Create a group in Azure AD that will dynamically add Android enterprise devices to it. This group will be associated with the Android enterprise enrollment profile. To do this,

1. Navigate to portal.azure.com, locate and select Azure Active Directory
2. Select Groups > New group
3. Group type should = Security
4. Provide a name for the group such as "Android Enterprise Kiosk Profile"
5. Membership type = Dynamic device
6. Select Dynamic device members

Use a simple rule using the "enrollmentProfileName" attribute to create the dynamic rule as shown below:

Create Android enterprise device enrollment profile

1. Find and select Microsoft Intune from portal.azure.com
2. Under device enrollment > Android enrollment select "Kiosk and task device enrollments"
3. Create a new enrollment profile by selecting "Create"
4. Provide a name and select an expiration date for the Token (this can be used to register devices with a token or QR code if necessary)

Add apps from Managed Google Play

1. Navigate to the Managed Google Play account by selecting Mobile apps > Managed Google Play > Open the managed Google Play store
2. Search for and add the "Managed Home Screen" app and additional apps you'd like on the locked task screen for the device.
3. Sync with Managed Google Play within Intune and assign the apps and/or weblinks to the kiosk group created earlier.

For the apps to show up on the locked task screen (i.e. kiosk device) we must do two things:

1. Under Mobile apps in Intune, assign the apps to the Azure AD group we created earlier ("Kiosk and task device enrollments" in my case), including assigning the Managed Home Screen.
2. In the configuration profile we'll create next, under kiosk add the same apps, except the Managed Home Screen (leave the Managed Home Screen out of the configuration profile).

Creating an Android enterprise kiosk configuration profile

1. Within Intune select Device configuration > Profiles > Create Profile
2. Select Properties > Platform = Android Enterprise, Profile type = Device restrictions
3. Under settings select Kiosk > Kiosk mode: either select Multi-app or Single app kiosk. For this post I've selected Multi-app kiosk.
4. Select Add and add the apps previously added to Managed Google Play that were synced with Intune. Remember, do not add the Managed Home Screen app (otherwise it will show up as an app on the screen of the kiosk device which isn't necessary).

For the remaining settings, feel free to configure the other settings to match your business requirements.

Enrolling devices

There are various methods for enrolling a device shown in the table below:

For more details about Android kiosk device enrollment with Intune please visit: https://docs.microsoft.com/en-us/intune/android-kiosk-enroll#set-up-android-kiosk-management

Below are the series of steps performed when my Pixel 2 device is enrolled with Intune with Android enterprise as a multi-app kiosk using a QR code, of course if you prefer, zero-touch is available on supported Android (8.0+) devices as well:

Tap on the screen six times
	I tapped 5 times and it's asking me for 1 more tap
Needs to download the QR reader app before QR code scan	Connect to Wi-Fi so we can download the QR reader
Once connected to Wi-Fi the device checks for updates	Downloading Google Play Store
Checking device info…	Installing QR Reader
Once the QR Reader is installed it will use the camera to scan the QR code under the Android enterprise enrollment profile created earlier	QR code is accepted and we're prompted to continue setting up the device.
Updating the Google Play Store again which is connecting to the Managed Google Play store	Downloading Google Play services…
Uploading Google Play services…	Finish device updates
Registering the device with Intune	Intune device configuration policy we created earlier is now applied
The Managed Home Screen is applied and the apps we assigned earlier are shown on the locked down kiosk screen.