Microsoft Intune: Android Enterprise Enrollment Guide 

Prerequisite: Connecting Intune to Managed Google Play

Before configuring any Android enrollment type, complete these prerequisites.

Step 1: Verify Intune Licenses

Users should have one of the following:

• Microsoft Intune Plan 1

• Microsoft 365 E3/E5

• EMS E3/E5

• Microsoft Business Premium

Step 2: Configure Microsoft Entra ID

Navigate to Microsoft Entra Admin Center → Users → Licenses

Step 3: Connect Managed Google Play

Navigate to Intune Admin Center → Tenant Administration → Connectors and Tokens → Managed Google Play

Click

Connect

Sign in using a Google account → Accept Google Terms → Status should display

Connected 

Step 4: Configure MDM Authority

Navigate to Tenant Administration → Tenant Status → Verify 

MDM Authority = Microsoft Intune

Step 5: Configure Enrollment Restrictions

Navigate to Devices → Enrollment → Enrollment Restrictions

Create restrictions for

• Android Enterprise

• Device Administrator (optional)

• AOSP

• Personally Owned

• Corporate Owned

1. Android Enterprise Personally Owned Devices with Work Profile (BYOD) 

BYOD Work Profile Onboarding Flow

Step1:

• Navigate to Enrollment:

Devices → Android → Android Enrollment

• Select Profile Type:

Personally-owned devices with work profile

• Deployment Note:

No QR code required (Users self-enroll by downloading the Company Portal app or via web-based enrollment).

Step 2: Create Compliance Policy

Navigate: Devices → Android → Compliance Policies

↓

Configure Examples:

• Require Password

• Minimum Android Version

• Block Rooted Devices

• Require Encryption

• Require Google Play Protect

↓

Assignment:

• Assign to target users.

Step 3: Create Configuration Profile

Navigate: Devices → Android → Configuration Profiles → Create

↓

Select Profile Type: Platform: Android Enterprise → Profile Type: Work Profile

↓

Configure Settings:

• Password

• WiFi

• VPN

• Certificates

• Restrictions

Step 4: Deploy Applications

Navigate: Apps → Android → Add → Managed Google Play App

↓

Approve Apps:

• Outlook

• Teams

• Edge

• OneDrive

• Company Portal

↓

Assignment:

• Assign as Required

User Enrollment Experience

User Actions: User installs Company Portal → Signs in → Accepts terms

↓

System Action: Create Work Profile

↓

Status:

• Enrollment complete.

2. Android Enterprise Corporate Owned Dedicated Devices (COSU) 

COSU (Dedicated Device) Configuration & Enrollment Flow

Step 1: Create Enrollment Profile

Navigate: Devices → Android → Android Enrollment → Corporate-owned dedicated devices

↓

Action: Create Enrollment Profile

↓

Example:

• Profile Name: Warehouse-Kiosk

Step 2: Configure Token

Configure: Token Type → Corporate-owned Dedicated Device

↓

Generate:

• QR Code

• Token

• Enrollment URL

Step 3: Create Device Restriction Profile

Select: Platform: Android Enterprise → Profile: Dedicated Device

↓

Configure Restrictions:

• Disable Status Bar

• Disable Safe Mode

• Disable Factory Reset

• Disable USB Debugging

• Disable Camera

• Disable Bluetooth

• Disable Screen Capture

Step 4: Create Kiosk Profile

Select: Profile Type: Device Restrictions → Dedicated Device

↓

Configure:

• Single App -or- Multi App Kiosk

↓

App Examples:

• Microsoft Edge

• Managed Home Screen

• Custom Warehouse App

Step 5: Deploy Apps

Action: Install

↓

Apps to Deploy:

• Managed Home Screen

• Business App

• Scanner App

• Edge

Device Enrollment Experience

Device Actions: Factory Reset Device

↓

User Actions: Tap 'Welcome Screen' 6 Times → Scan QR Code

↓

Status:

• Device enrolls automatically.

3. Android Enterprise Corporate-Owned Fully Managed (COBO) 

COBO (Fully Managed) Configuration & Enrollment Flow

Step 1: Create Enrollment Profile

Navigate: Devices → Android → Android Enrollment → Corporate-owned fully managed user devices

↓

Action: Create Enrollment Profile

Step 2: Access Enrollment Methods

Generate / Access:

• QR Code

• NFC

• Token

Step 3: Create Configuration Profile

Select: Platform: Android Enterprise → Profile: Fully Managed

↓

Configure Settings:

• Password

• WiFi

• VPN

• Certificates

• Restrictions

Step 4: Configure Device Restrictions

Action: Disable

↓

Settings to Disable:

• Factory Reset

• Developer Options

• USB File Transfer

• Unknown Sources

• Bluetooth Sharing

• Personal Gmail

• Personal Accounts

Step 5: Deploy Applications

Action: Assign as Required

↓

Core Apps:

• Outlook

• Teams

• Edge

• Defender

• Authenticator

• Company Portal

Device Enrollment Experience

Device Actions: Ensure Device is Factory Reset

↓

Admin / User Actions: Tap 'Welcome Screen' 6 Times → Scan QR Code

↓

Status:

• Enrollment complete. Entire device is managed.

4. Android Enterprise Corporate-Owned Work Profile (COPE) 

COPE (Corporate-Owned Work Profile) Configuration & Enrollment Flow

Step 1: Create Enrollment Profile

Navigate: Devices → Android → Android Enrollment → Corporate-owned devices with work profile

↓

Action: Create Enrollment Profile

Step 2: Access Enrollment Methods

Generate:

• QR Code

• (Token string also available)

Step 3: Create Configuration Profile

Select: Platform: Android Enterprise → Profile: Corporate-owned Work Profile

↓

Configure Settings & Restrictions:

• Password

• VPN

• Certificates

• WiFi

• Camera

• Bluetooth

• Copy / Paste Restrictions

• Data Sharing Restrictions

Step 4: Deploy Applications

Action: Assign as Required

↓

Core Apps:

• Outlook

• Teams

• OneDrive

• Defender

• Authenticator

• Edge

Device Enrollment Experience

Device Actions: Ensure Device is Factory Reset

↓

Admin / User Actions: Tap 'Welcome Screen' 6 Times → Scan QR Code

↓

Status:

• Device is enrolled (Company retains device-level control).

• Secure Work Profile is created (Personal apps and data remain separate).

5. Android Open Source Project (AOSP) 

AOSP (Android Open Source Project) Configuration & Enrollment Flow

Step 1: Navigate to AOSP Enrollment

Navigate: Devices → Android → Enrollment → Android Open Source Project

Step 2: Create Enrollment Profile

Action: Create Profile

↓

Choose Management Mode:

• Corporate-owned, user-associated devices (For single-user specialized gear like smart glasses)

• Corporate-owned, userless devices (For shared-use hardware or kiosks)

Step 3: Access Enrollment Methods

Generate:

• QR Code

• Enrollment Token

Step 4: Configure and Deploy Resources

Action: Assign as Required

↓

Resources to Deploy:

• LOB (Line-of-Business) Applications via APK

• Certificates

• WiFi Profiles (Mandatory network injection)

• VPN Profiles

• Device Restrictions

Device Enrollment Experience

Device Actions: Ensure Device is Factory Reset

↓

Admin / User Actions: Scan AOSP QR Code at Welcome Screen

↓

Status:

• Enrollment complete. Non-GMS device is fully managed.

6. Android Device Administrator (DA) 

Note: This is a legacy enrollment method. Google has deprecated Device Administrator for most enterprise use cases. New deployments should use Android Enterprise unless you have a specific legacy requirement. 

Purpose

• Legacy Android devices

• Android 7–9

• No Work Profile

Android Device Administrator (DA) Configuration & Enrollment Flow

Step 1: Navigate to Device Administrator

Navigate: Devices → Android → Android Enrollment → Device Administrator

Step 2: Enable DA Enrollment

Action: Enable

↓

Device Types:

• Personal Devices

• Corporate Devices

Step 3: Create Compliance Policy

Action: Create Compliance Policy

↓

Configure Settings:

• Password Requirements

• Require Encryption

• Minimum OS Version

• Block Rooted Devices

Step 4: Deploy App & Enroll

Action: Deploy

↓

Core App:

• Company Portal

Device Enrollment Experience

User Actions: User installs Company Portal → User signs in

↓

System Action: Registers device as Device Administrator

↓

Status:

• Device is enrolled.