Moving Teams Android Devices to AOSP Device Management

IMPORTANT! Microsoft Teams Android devices will be commencing auto updates for firmware in order to migrate to Intune AOSP device management starting on May 15th.

These firmware updates will eventually not be pauseable after the end of May.

Devices will simply take them following the phases set in Teams Admin Center:

• Validation: 0-15 days
• General: 16-45 days (default)
• Final: 45-60 days

Thus if a device has an auto update start date of May 15th, for the first 15 days only devices in the Validation phase will be updated. Then from May 30th, devices in the General phase will start updating. Finally starting June 28th, devices in the Final phase will start updating.

 

Please ensure that all prerequisites for AOSP device management migration are completed for your organization to ensure a smooth migration. Your devices may sign out during migration if the prerequisites are not carried out properly.

Please see the table below for the schedule of auto updates for your devices.

 

We are pleased to announce that Microsoft Teams Android devices will be moving to Intune Android Open Source Project (AOSP) device management later this year. AOSP device management will be the mobile device management (MDM) platform for Teams devices going forward. This move will bring a more reliable experience, an improved deployment experience for admins, and it will serve as the platform for future innovation and richer management scenarios for Microsoft Teams Android devices (Teams Rooms, Teams panels, Teams phones, and Teams displays).

 

AOSP Device Management is the replacement for the legacy Android Device Administrator solution used for managing Teams Devices.

This mandatory migration will take place over several months and will not start until Q4CY24 continuing into H1CY25. We’ve taken great care to minimize the end user and IT admin impact with this migration, but there is action required for you as the IT admin. Following our published guidance for migration will only take a few minutes and will ensure your devices are seamlessly migrated between MDM platforms with a simple firmware upgrade and set you up for success for new device enrollments in the future. End users will notice no difference in device functionality.

There are two parts to a successful migration to AOSP Device Management:

• Step 1: Create new enrollment profiles & configuration/compliance policies in Intune. This step can be completed today, even before the firmware updates are available. Performing these steps will have no impact on existing devices but please note that failing to create enrollment profiles before performing step 2 will result in signed out Teams Devices.

• Step 2: Once the AOSP Device Management capable firmware is released in Teams Admin Center, you will need to install the firmware updates for each of the supported Teams Devices. This firmware update will automatically unenroll the device from Device Administrator and re-enroll the device with AOSP Device Management using the enrollment profile created in Step 1. This entire process will be done while the device remains signed into Teams. These firmware updates will be made available from Teams Admin Center as a manual update to allow you time to slowly migrate your devices. Updates will switch to automatic in H1CY25 for those with large quantities of devices.

Step by step guidance on how to complete steps 1 and 2 (as well as guidance for configuration & compliance policies) can be found in the AOSP Device Management migration admin guide.

For more details on the AOSP Device Management migration, watch the Step-by-Step AOSP Migration video linked below:

 

 

FAQ:

How will I know firmware is available for my devices?

When AOSP DM compatible firmware is available for your devices a firmware update will show as available for your Teams Device in Teams Admin Center labeled as AOSP. 

Will the firmware update be pushed out automatically? My organization needs time to prepare!

AOSP DM firmware will initially be available as manual updates for a period of time, allowing organizations to prepare the prerequisites and test the new firmware on specifically selected devices. It will become a mandatory auto update only after this manual update period. See the table above.

Your organization can already complete the prerequisites of creating enrollment profiles and AOSP policies today even before the firmware is generally available.

Isn't Device Administrator being deprecated by end of year 2024? What happens if my devices haven't migrated to AOSP by then?

Although Device Administrator will be deprecated by end of year for devices with GMS, Teams Devices are not GMS devices and therefore will remain supported with Device Administrator for Intune enrollment until AOSP migration is completed as Device Administrator is not being deprecated for non-GMS devices. Read more here in the Intune blog on Device Administrator deprecation: Click Here

My organization uses device identifiers today combined with enrollment restrictions to limit Android Device Administrator enrollment, is there something similar with AOSP Device Management?

We've made this easier with AOSP Device Management! Teams Android Devices automatically enroll as corporate with no need to filter because when you set the Teams Devices toggle in the enrollment profile, only Teams Devices can enroll with AOSP DM, end user mobile devices do not have a way to enroll with AOSP DM so there is no need to use enrollment restrictions like before.

My organization does not enroll our Teams Android Devices in Intune today, do we need to do anything?

No, if your organization does not enroll its Teams Devices into Intune today and currently has the Intune license unassigned from accounts signing into Teams Devices, there will be no impact when you install the new device firmware which supports AOSP device management. Your devices will get the new management applications, but no action is required beyond updating the devices to the new firmware once released.

What happens if I don’t do anything?

Devices will initially be offered firmware updates manually through Teams Admin Center, however in H1CY25 this will change to automatic updates regardless of admin action.

If your organization does enroll its Teams devices into Intune, then by not creating an enrollment profile, devices will fail to enroll properly in Intune and will thus not be able to sign in (or sign out if they were already signed in before). Not creating new AOSP policies could lead to unexpected issues in your environment, as Device Administrator policies will not be migrated automatically.

Wait, I don’t have to enroll my devices in Intune at all? Why would I want to use Intune?

Intune provides a security wrapper around your devices allowing you to set security controls as well as detect if the device is compliant with your organization security requirements prior to allowing the device to sign in to your M365 instance.

Does this change mean I will no longer see my Teams Android Devices in Teams admin center or the Pro Management Portal?

No, this migration changes the enrollment method into Microsoft Intune but has no impact on the manageability inside of Teams admin center or the Teams Pro Management Portal.

Are there devices that will not migrate to AOSP Device Management?

All devices currently certified and supported for Microsoft Teams will be migrated, those devices can be found here:

• Teams Rooms on Android
• Teams phones
• Teams panels
• Teams displays

There are some Teams Android Devices that were previously supported, but are now end of life, which you may still have in your environment, those legacy devices specifically not migrating are listed here:

• AudioCodes C448HD (Teams Phone)
• AudioCodes C450HD (Teams Phone)
• AudioCodes RXV80 (Teams Rooms on Android)
• Crestron UC-2 (Teams Phone)
• Crestron UC-P8 (Teams Phone)
• Crestron UC-P8-I (Teams Phone)
• Crestron UC-P10 (Teams Phone)
• Crestron UC-P10-I (Teams Phone)
• Crestron UC-P8-C (Teams Phone)
• Crestron UC-P8-C-I (Teams Phone)
• Crestron UC-P10-C (Teams Phone)
• Crestron UC-P10-C-I (Teams Phone)
• Crestron UC-P8-TD (Teams Display)
• Crestron UC-P8-TD-I (Teams Display)
• Crestron UC-P10-TD (Teams Display)
• Crestron UC-P10-TD-I (Teams Display)
• EPOS Expand Vision 3T (Teams Rooms on Android)
• EPOS Expand Vision 5T (Teams Rooms on Android)
• EPOS Expand Control TC (Teams Rooms on Android)
• EPOS Expand Control Panel (Teams Panel)
• Lenovo ThinkSmart View (Teams Display)
• Lenovo ThinkSmart View Plus (Teams Display)
• Polycom Trio 8500 (Teams Phone)
• Polycom Trio 8800 (Teams Phone)
• Yealink T55/55A (Teams Phone)
• Yealink T56/56A (Teams Phone)
• Yealink T58/58A (Teams Phone)
• Yealink CP960 (Teams Phone)
• Yealink VP59 (Teams Phone)
• Yealink MP52 (Teams Phone)
• Yealink VC210 (Teams Rooms on Android)
• Yealink DeskVisio 24 (Teams Display)

What happens with those devices that will not migrate?

The devices listed above will remain on Android Device Administrator. These devices can still be used once Android Device Administrator is fully deprecated but will be considered legacy and unsupported where features may be removed at any time. To use the device you will need to unenroll from Intune and then sign the device back in without an Intune license assigned to the account, more information about this can be found here: Manage Intune devices with Android device administrator | Microsoft Learn

Will I notice anything different with the devices after the migration?

No, the devices will not look any different from an end user perspective. As an IT admin you will see two new applications installed on your devices (visible in the software health tab in Teams Admin Center), these two applications are the “Authenticator” app and the “Microsoft Intune” app these applications replace the previous “Company Portal” application.

Does the sign-in process for devices change once this migration has been completed?

With the exception of the case with Device Code Flow documented below, there is no change to the sign-in process or the look and feel of your devices with this migration.

What if once this migration is complete, I take a device out of storage that has not been through the migration?  Will I be able to upgrade it?

Yes, there will be out of box updates available to ensure devices are able to receive the latest apps and can be automatically enrolled using AOSP DM.

When creating the enrollment profile, how long should I set the enrollment profile token expiration date?

If you're participating in a private preview of AOSP DM, please ensure your enrollment policy has a 90 day or shorter expiration, at GA you can replace this with an extended enrollment profile. Those waiting for General Availability without having any devices in preview, feel free to utilize the 65 year expiration.

Once AOSP DM is generally available and I have a device I want to setup for the first time, will I need to use the QR code option in the enrollment profile? Or do I need to create another enrollment profile?

No, the QR code you can generate when creating an AOSP DM enrollment profile in Intune is not applicable for Teams Android Devices and will not be available for use if the "Teams Device" toggle is selected when creating the enrollment profile. And no, for brand new devices signing in for the first time after AOSP DM is generally available, they will enroll using the existing enrollment profile you've created in the migration documentation.

What AOSP policies are supported for Teams Devices?

There's currently a limited set of supported compliance policies for Teams Android Devices enrolled with AOSP Management but more are planned for in future releases:

• Device Health Rooted devices (Block).
• Device Properties Minimum OS version.
• Device Properties Maximum OS version.
• System Security Require encryption of data storage on device.

I am a new customer to Teams Devices and want to skip Android Device Administrator, can I enroll my devices using AOSP DM now?

First, thank you for purchasing Teams Devices!  But to ensure stability, supportability, and a positive customer experience, we've limited AOSP DM to a subset of preview customers with existing Teams Devices. We ask all new customers to please use Android Device Administrator until AOSP DM is generally available.

Why not use Android Enterprise?

Android Enterprise specifically requires Google Mobile Services, and since Teams Devices do not contain Google Mobile Services, AOSP Device Management is our solution.

Why is my device is signing out on migration?

Please ensure the following:

1. Ensure a AOSP Device Management enrollment profile is created with a enrollment token extended beyond the current date and the Teams Devices option enabled: https://learn.microsoft.com/en-us/MicrosoftTeams/rooms/android-migration-guide#step-1---set-up-new-aosp-management-enrollment-profiles
2. If Conditional Access policies are configured requiring device compliance: ensure you have created a AOSP DM compliance policy with supported policies: https://learn.microsoft.com/en-us/MicrosoftTeams/rooms/android-migration-guide#creating-a-aosp-management-compliance-policy

Note: If these devices are signed in with user accounts requiring user interactive multi-factor authentication, they may be prompted to sign back in post migration, this is expected.

Why is sign-in failing using microsoft.com/devicelogin (Device Code Flow (DCF))?

For sign in for shared space devices with Teams resource accounts (Teams Rooms, Teams Panels, Common Area Phones), this sign in failure is typically caused because user interactive multi-factor authentication (MFA) is being enforced on the account. MFA is not supported for shared space devices: https://learn.microsoft.com/en-us/microsoftteams/rooms/supported-ca-and-compliance-policies?tabs=mtr-a#supported-conditional-access-policies (NOTE: other MFA factors: known network location, compliant device, etc are supported for Teams resource accounts)

For sign in with a personal account, if user interactive MFA is enforced via policy, the web sign in using microsoft.com/devicelogin is not supported.  This can be mitigated through the following methods:

• With Teams app 1449/1.0.94.2025087003 and later you can leverage the on screen keyboard to use DCF with UPN.
• Use filters via conditional access to exclude user-interactive MFA policy from sign in (based on known network location or device type filters).
• Sign in locally on the Teams device, the user interactive MFA prompt will appear on the Teams Device, users can interact, complete the MFA prompt and sign in successfully.

How can I use a device enrollment manager (DEM) account to enroll my Teams devices?

DEM accounts are not supported for AOSP Device Management. The account being used for enrollment must be removed from the DEM list. Enroll devices using a device enrollment manager account - Microsoft Intune | Microsoft Learn

Can I migrate my devices to AOSP DM while hotdesking?

Migration while a user is hotdesking is not a supported scenario and the migration will fail.

Who do I contact if I need more support or information?

Please reach out to your Microsoft account representatives or open a support case for more details.

 

BEST PRACTICES (Conditional Access policies/rules)