First published on TechNet on Mar 03, 2017 Author: Chris Baldwin, Senior Program Manager
About Android for Work app permissions
Android for Work requires that you "approve" applications in Google's managed Play web console before syncing them to Intune and deploying them to your users. Because Android for Work allows you to silently and automatically push these apps to users' devices, you must accept the app's permissions on behalf of all your users at approval time. End users will not see any app permission prompts at installation time, so it's important that IT admins read and understand these permissions before approving.
Handling updated permissions
But what happens when the app developer publishes a new version of the app with additional permissions? New permissions will not automatically be accepted, even if you've already approved the app.
Here's what will occur:
Devices that already have the old version installed will still be able to use it, but the app won't be upgraded. Users will remain on the old version until the new permissions are accepted. Once accepted, the update will automatically install.
Devices that don't already have the app installed will never get the app installed until the new permissions are accepted.
What you should do
We recommend that you periodically visit the managed Google Play console and check for new permissions to be updated. If you deploy an app and observe that it's not being installed on the device, the first thing to check would be to see if the app requires new permissions.
Sign in with your Google account that you used to originally browse for and approve the apps
Visit the "Updates" tab to see if any apps require an update. Any apps listed here require new permissions that you haven't approved yet and won't deploy until they are. Here's what it will look like:
In the future
We recognize visiting Play to look for new permissions isn't ideal, and we're working to improve that based on your feedback. Intune is planning some features in the admin console to more visibly alert IT admins when apps update their permissions. Stay tuned for that.