%3CLINGO-SUB%20id%3D%22lingo-sub-280184%22%20slang%3D%22en-US%22%3ECOSU%20Configuration%20and%20Enrollment%20using%20the%20QR%20code%20enrollment%20method%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-280184%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%3EFirst%20published%20on%20TechNet%20on%20Oct%2008%2C%202018%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3EHi%20everyone%2C%20Matt%20Butcher%20here.%20I%E2%80%99m%20a%20Support%20Escalation%20Engineer%20on%20the%20Intune%20team%20and%20today%20I%20wanted%20to%20take%20a%20minute%20to%20go%20through%20the%20steps%20to%20configure%20and%20enroll%20COSU%20(corporate%20owned%20single%20use)%20Android%20enterprise%20devices%20using%20the%20popular%20QR%20code%20method.%20%3CBR%20%2F%3E%3CBR%20%2F%3ETo%20give%20you%20a%20little%20background%2C%20back%20in%20July%20we%20announced%20support%20for%20Android%20enterprise%20purpose-built%20device%20management%2C%20where%20we%20can%20target%20task-based%20usage%20cases%20such%20as%20unattended%20guest%20kiosk%20experiences%2C%20inventory%20tracking%2C%20mobile%20ticketing%2C%20point-of-sale%20devices%2C%20etc.%20Devices%20managed%20in%20this%20way%20can%20enroll%20into%20Intune%20using%20a%20few%20different%20enrollment%20methods%2C%20such%20as%20scanning%20a%20QR%20code%2C%20which%20is%20what%20we%E2%80%99ll%20be%20discussing%20here.%20The%20benefit%20with%20this%20is%20that%20administrators%20can%20enroll%20these%20devices%20without%20needing%20to%20have%20user%20account%20credentials%20on%20the%20device.%20IT%20admins%20can%20then%20configure%20these%20corporate-owned%20devices%20to%20be%20used%20in%20locked-down%20environments%2C%20allowing%20only%20the%20app%20or%20apps%20necessary%20to%20complete%20the%20task%20while%20preventing%20users%20from%20accessing%20settings%2C%20installing%20other%20apps%2C%20or%20changing%20any%20device%20functions%20that%20might%20interfere%20with%20reliable%20operation.%20%3CBR%20%2F%3E%3CBR%20%2F%3EFor%20the%20purposes%20of%20this%20example%2C%20you%E2%80%99ll%20need%20a%20device%20running%20Android%207%20or%20later%20that%20you%20can%20factory%20reset%2C%20and%20an%20open%20wi-fi%20network.%20Once%20you%20have%20that%2C%20just%20follow%20the%20steps%20below.%20%3CBR%20%2F%3E%3CBR%20%2F%3E1.%20If%20you%20haven't%20done%20this%20already%2C%20start%20by%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fconnect-intune-android-enterprise%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20connecting%20your%20Intune%20account%20to%20your%20Android%20enterprise%20account%20%3C%2FA%3E%20.%20%3CBR%20%2F%3E%3CBR%20%2F%3E2.%20Next%2C%20approve%20any%20applications%20from%20the%20%3CA%20href%3D%22https%3A%2F%2Fplay.google.com%2Fwork%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Managed%20Play%20Store%20%3C%2FA%3E%20that%20you%20need%20to%20be%20in%20the%20Managed%20Home%20Screen%20experience%20(including%20the%20%3CA%20href%3D%22https%3A%2F%2Fplay.google.com%2Fwork%2Fapps%2Fdetails%3Fid%3Dcom.microsoft.launcher.enterprise%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Managed%20Home%20Screen%20%3C%2FA%3E%20%26amp%3B%20%3CA%20href%3D%22https%3A%2F%2Fplay.google.com%2Fwork%2Fapps%2Fdetails%3Fid%3Dcom.google.android.apps.work.clouddpc%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Android%20Device%20Policy%20%3C%2FA%3E%20).%20%3CBR%20%2F%3E%3CBR%20%2F%3E3.%20Now%20we%20need%20to%20sync%20those%20apps%20to%20Intune.%20Open%20a%20browser%20and%20go%20to%20the%20%3CA%20href%3D%22https%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_Intune_DeviceSettings%2FExtensionLandingBlade%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Intune%20portal%20%3C%2FA%3E%20%2C%20then%20navigate%20to%20%3CSTRONG%3E%20Client%20Apps%20-%20%3C%2FSTRONG%3E%20%26gt%3B%20%3CSTRONG%3E%20Setup%20%E2%80%93%20Managed%20Google%20Play%20%3C%2FSTRONG%3E%20and%20click%20%3CSTRONG%3E%20Sync%20%3C%2FSTRONG%3E%20.%20%3CBR%20%2F%3E%3CBR%20%2F%3E4.%20Once%20the%20sync%20is%20complete%2C%20we%20need%20to%20create%20an%20Assigned%20or%20Dynamic%20device%20group%20that%20will%20be%20used%20for%20the%20deployment.%20If%20using%20a%20Dynamic%20device%20group%2C%20set%20the%20membership%20rule%20to%20%3CSTRONG%3E%20Add%20devices%20where%20%3C%2FSTRONG%3E%20%2F%20%3CSTRONG%3E%20enrollmentProfileName%20%3C%2FSTRONG%3E%20%2F%20%3CSTRONG%3E%20Equals%20%3C%2FSTRONG%3E%20%2F%20%26lt%3B%20%3CSTRONG%3E%20%3CI%3E%20InsertCOSUEnrollmentProfileNameHere%20%3C%2FI%3E%20%26gt%3B%20%3C%2FSTRONG%3E%20.%20I%E2%80%99ll%20be%20using%20a%20Dynamic%20device%20group%20named%20%3CI%3E%20COSU_Dynamic_Device_Group%20%3C%2FI%3E%20so%20my%20rule%20will%20be%20%3CSTRONG%3E%20Add%20devices%20where%20%3C%2FSTRONG%3E%20%2F%20%3CSTRONG%3E%20enrollmentProfileName%20%3C%2FSTRONG%3E%20%2F%20%3CSTRONG%3E%20Equals%20%3C%2FSTRONG%3E%20%2F%20%3CSTRONG%3E%20COSU_Enrollment_Profile%20%3C%2FSTRONG%3E%20as%20shown%20below.%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20644px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F58717iEB64AE3775C59D9A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%20%3CBR%20%2F%3E%3CBR%20%2F%3E5.%20Now%20we%20need%20to%20create%20our%20COSU%20Enrollment%20Profile.%20From%20the%20%3CA%20href%3D%22https%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_Intune_DeviceSettings%2FExtensionLandingBlade%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Intune%20portal%20%3C%2FA%3E%20%2C%20navigate%20to%20%3CSTRONG%3E%20Intune%20-%20%3C%2FSTRONG%3E%20%26gt%3B%20%3CSTRONG%3E%20Android%20Enrollment%20-%20%3C%2FSTRONG%3E%20%26gt%3B%20%3CSTRONG%3E%20Kiosk%20and%20Task%20Device%20Enrollments%20-%20%3C%2FSTRONG%3E%20%26gt%3B%20%3CSTRONG%3E%20Create.%20%3C%2FSTRONG%3E%20Name%20the%20profile%20what%20you%20chose%20in%20your%20Dynamic%20Membership%20Criteria%2C%20which%20in%20our%20example%20was%20%3CSTRONG%3E%20COSU_Enrollment_Profile%20%3C%2FSTRONG%3E%20.%20%3CBR%20%2F%3E%3CBR%20%2F%3E6.%20Once%20that%E2%80%99s%20done%2C%20we%E2%80%99ll%20now%20create%20our%20Kiosk%20Profile.%20From%20the%20%3CA%20href%3D%22https%3A%2F%2Fportal.azure.com%2F%23blade%2FMicrosoft_Intune_DeviceSettings%2FExtensionLandingBlade%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Intune%20portal%20%3C%2FA%3E%20%2C%20navigate%20to%20%3CSTRONG%3E%20Device%20Configuration%20-%20%3C%2FSTRONG%3E%20%26gt%3B%20%3CSTRONG%3E%20Profiles%20-%20%3C%2FSTRONG%3E%20%26gt%3B%20%3CSTRONG%3E%20Create%20Profile.%20And%20configure%20the%20profile%20accordingly%3A%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3Ea.%20Name%3A%20Whatever%20you%20like%20%3CBR%20%2F%3Eb.%20Platform%3A%20Android%20Enterprise%20%3CBR%20%2F%3Ec.%20Profile%20Type%3A%20Device%20Owner%20Only%20%E2%80%93%20Device%20Restrictions%20%3CBR%20%2F%3Ed.%20Navigate%20to%20the%20Kiosk%20node%20and%20select%20%3CSTRONG%3E%20Multi-app%20kiosk%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3Ee.%20Click%20%3CSTRONG%3E%20Add%20%3C%2FSTRONG%3E%20.%20The%20list%20of%20all%20your%20apps%20will%20appear%20on%20the%20right%20%3CBR%20%2F%3Ef.%20Add%20your%20apps%20but%20%3CSTRONG%3E%20do%20not%20%3C%2FSTRONG%3E%20add%20the%20Managed%20Home%20Screen.%20%3CBR%20%2F%3Eg.%20If%20you%20have%20Web%20Apps%2C%20be%20sure%20to%20include%20a%20browser%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20644px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F58718iED38759E8CABE6D7%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20also%20recommend%20adding%20a%20password%20just%20to%20see%20what%20happens%20with%20the%20%3CSTRONG%3E%20Android%20Device%20Policy%20%3C%2FSTRONG%3E%20app.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20644px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F58719i2D02431522194BCD%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E7.%20Deploy%20all%20your%20apps%20as%20%3CSTRONG%3E%20Required%20%3C%2FSTRONG%3E%20to%20your%20Dynamic%20device%20group.%20Note%20that%20if%20you%20have%20Web%20Apps%2C%20you%20do%20not%20need%20to%20deploy%20them.%20%3CBR%20%2F%3E%3CBR%20%2F%3E8.%20Factory%20Reset%20your%20Android%20device.%20%3CBR%20%2F%3E%3CBR%20%2F%3E9.%20Wait%20for%20OOBE%20to%20begin%2C%20then%20tap%20the%20white%20space%20until%20you%E2%80%99re%20prompted%20to%20download%20%3CSTRONG%3E%20QR%20Reader%20%3C%2FSTRONG%3E%20.%20%3CBR%20%2F%3E%3CBR%20%2F%3E10.%20Connect%20to%20your%20open%20Wi-Fi%20network%20and%20wait%20for%20the%20QR%20reader%20to%20be%20installed%20(your%20screen%20will%20just%20be%20a%20camera).%20%3CBR%20%2F%3E%3CBR%20%2F%3E11.%20Use%20QR%20Reader%20to%20scan%20the%20QR%20code%20attached%20to%20your%20COSU%20Enrollment%20Profile.%20As%20the%20device%20enrolls%2C%20wait%20until%20the%20Managed%20Home%20Screen%20experience%20begins.%20If%20you%20required%20a%20PIN%2C%20manually%20set%20it%20before%20the%20Managed%20Home%20Screen%20experience%20begins.%20If%20you%20fail%20to%20do%20this%20the%20policy%20will%20show%20as%20failed.%20This%20is%20important%20because%20the%20PIN%20requirement%20does%20not%20present%20a%20toast%20notification%20to%20the%20user%20however%20the%20settings%20are%20still%20enforced.%20%3CBR%20%2F%3E%3CBR%20%2F%3EThat%E2%80%99s%20it!%20Now%20your%20device%20is%20enrolled%20and%20ready%20to%20use.%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3E%20Key%20Notes%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EDon't%20add%20the%20%3CSTRONG%3E%20Managed%20Home%20Screen%20%3C%2FSTRONG%3E%20app%20to%20the%20Multi-App%20Kiosk%20profile.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EIf%20using%20web%20links%2C%20you%20do%20not%20need%20to%20deploy%20these%20to%20the%20device%20groups.%20Only%20store%20apps%20are%20required%20to%20be%20deployed.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EIf%20requiring%20a%20PIN%2C%20the%20user%20will%20not%20be%20prompted.%20The%20setting%20is%20enforced%20and%20you%20will%20need%20to%20configure%20the%20PIN%20manually.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3ETo%20get%20out%20of%20the%20%3CSTRONG%3E%20Managed%20Home%20Screen%20%3C%2FSTRONG%3E%20experience%2C%20all%20you%20need%20to%20do%20is%20remove%20the%20%3CSTRONG%3E%20Managed%20Home%20Screen%20%3C%2FSTRONG%3E%20app%20deployment.%20You%20can%20adjust%20the%20Multi-App%20Kiosk%20Mode%20profile%20as%20needed%2C%20and%20then%20redeploy%20the%20%3CSTRONG%3E%20Managed%20Home%20Screen%20%3C%2FSTRONG%3E%20app.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3ETo%20get%20out%20of%20COSU%2C%20you%20will%20need%20to%20factory%20reset%20the%20device.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EWhen%20troubleshooting%2C%20It%20is%20recommended%20to%20include%20the%20%3CSTRONG%3E%20Android%20Device%20Policy%20%3C%2FSTRONG%3E%20app%20in%20your%20Multi-App%20Kiosk%20profile.%20This%20will%20allow%20you%20to%20verify%20what%20policies%20Google%20is%20sending%20to%20the%20device.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EThere%20is%20no%20direct%20communication%20between%20Intune%20and%20devices%20enrolled%20using%20this%20method.%20Intune%20sends%20policy%20information%20to%20Google%20which%20then%20manages%20policy%20delivery.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EDevice%20names%20will%20look%20like%20this%3A%20%3CSTRONG%3E%20%3CI%3E%2030a97bfb2327b18d_AndroidEnterprise_10%2F2%2F2018_10%3A34%20PM%20%3C%2FI%3E%20%3C%2FSTRONG%3E%20.%20Currently%20this%20cannot%20be%20changed.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3ECompliance%20will%20show%20as%20%3CSTRONG%3E%20Not%20Evaluated%20%3C%2FSTRONG%3E%20because%20COSU%20does%20not%20support%20compliance%20policies.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EIn%20this%20scenario%2C%20you%20cannot%20deploy%20certificate%20profiles%2C%20and%20wi-fi%20profiles%20are%20limited%20to%20open%20authentication%20or%20pre-shared%20key%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%20%3CSTRONG%3E%3CEM%3EMatthew%20Butcher%20%3C%2FEM%3E%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CEM%3E%20Intune%20Support%20Escalation%20Engineer%20%3CBR%20%2F%3EMicrosoft%20CSS%3C%2FEM%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-280184%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20post%20covers%20the%20steps%20to%20configure%20and%20enroll%20COSU%20Android%20enterprise%20devices%20using%20the%20popular%20QR%20code%20method.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-SUB%20id%3D%22lingo-sub-287061%22%20slang%3D%22en-US%22%3ERe%3A%20COSU%20Configuration%20and%20Enrollment%20using%20the%20QR%20code%20enrollment%20method%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-287061%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20the%20feedback%20Matthew.%20That's%20cleared%20it%20up%20for%20me.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOne%20little%20follow%20up%20question%20%3A)%3C%2Fimg%3E%20...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20targeted%20all%20app%2Fprofile%20deployments%20to%20a%20dynamic%20AAD%20group%20based%20on%20the%20enrollment%20profile%20(as%20described%20in%20the%20docs)%3C%2FP%3E%3CP%3EThat%20works%20great%20but%20now%20we%20are%20in%20the%20position%20that%20we%20need%20to%20exclude%20some%20devices%20to%20troubleshoot%20them.%20So%2C%20from%20what%20you've%20said%20above%20I%20should%20change%20the%20Managed%20Home%20Screen%20app%20to%20%22not%20required%22%20and%20we%20should%20then%20be%20able%20to%20get%20the%20device's%20Android%20Settings.%3C%2FP%3E%3CP%3EHowever%2C%20if%20I%20do%20that%20it%20will%20remove%20it%20for%20all%20devices%20so%20I%20need%20to%20allow%20exceptions%20in%20the%20dynamic%20group%20membership%20rules.%20I've%20tried%20doing%20this%20based%20on%20device%20id%20and%20name%20but%20the%20profile%2Fapps%20still%20seem%20to%20be%20applying%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EExample%20of%20the%20dynamic%20rule%20I'm%20trying%20to%20exclude%202%20different%20devices%3A%3C%2FP%3E%3CP%3E(device.enrollmentProfileName%20-eq%20%22Contoso%20Kiosks%2001%22)%26nbsp%3B%20-and%20(device.deviceid%20-ne%20%22j2dj2e2-51d3-4d5f-8ace-153a35718256%22%20-or%20device.displayName%20-notcontains%20%223131k5afff157h23_AndroidEnterprise_11%2F1%2F1111_4%3A07%20PM%22)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-286905%22%20slang%3D%22en-US%22%3ERe%3A%20COSU%20Configuration%20and%20Enrollment%20using%20the%20QR%20code%20enrollment%20method%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-286905%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Thom%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20all%20your%20great%20questions!%20I'll%20do%20my%20best%20to%20address%20them%20all%20individually.%20See%20my%20responses%20in%26nbsp%3B%3CSTRONG%3Ebold%3C%2FSTRONG%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIs%20there%20any%20requirement%20to%20push%20the%20Intune%20Company%20Portal%20app%3F%20I%20don't%20believe%20so%20as%20we%20have%20it%20working%20without%20it%20but%20in%20your%20screenshot%20you%20have%20it%20there.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EYou%20will%20not%20need%20to%20deploy%20the%20Company%20Portal%20app%20in%20this%20scenario.%20The%20apps%20on%20the%20left%20of%20the%20screenshot%20are%20the%20apps%20that%20I%E2%80%99ve%20chosen%20to%20be%20included%20in%20the%20Kiosk%20profile%20while%20the%20apps%20on%20the%20right%20are%20%3CU%3Eall%3C%2FU%3E%20of%20the%20approved%20Managed%20Play%20Apps%20and%20web%20links%20that%20are%20in%20the%20%E2%80%9CAll%20Apps%E2%80%9D%20list.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EEnforcing%20device%20PIN%20-%20this%20doesn't%20seem%20to%20work%2C%20it%20would%20be%20great%20to%20have%20a%20video%20seeing%20how%20this%20happens%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EI%20understand%20the%20feedback%20here%2C%20however%20I%20can%20confirm%20the%20enforcement%20does%20work.%20The%20user%20experience%20at%20this%20time%20is%20that%20you%20will%20not%20receive%20any%20type%20of%20prompt%20to%20set%20a%20PIN%2C%20but%20when%20manually%20navigating%20to%20set%20a%20PIN%2C%20you%20will%20see%20the%20requirements%20are%20there%20and%20you%20won%E2%80%99t%20be%20able%20to%20set%20a%20swipe%20or%20pattern%20as%20your%20password.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWeb%20links%20-%20We%20deployed%20the%20Microsoft%20Edge%20Browser%20to%20allow%20web%20apps%20to%20open%2C%20however%20it%20nags%20the%20end%20user%20to%20sign%20in%20with%20a%20work%20account%20and%20has%20unnecessary%20UI%20(we%20don't%20want%20them%20to%20add%20new%20tabs%20or%20browse%20other%20sites).%20Are%20you%20able%20to%20control%2Fhide%20this%2C%20perhaps%20with%26nbsp%3Ban%20Intune%20App%20Configuration%20Policy%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EI%20am%20not%20currently%20aware%20of%20a%20workaround%2Fsolution%20to%20this%20behavior.%20Intune%20App%20Configuration%20Policies%20can%20only%20apply%20to%20Work%20Profile%20apps%20so%20unfortunately%20that%20wouldn%E2%80%99t%20be%20possible.%20We%E2%80%99d%20like%20to%20hear%20more%20from%20you%20on%20this%20so%20please%20feel%20free%20to%20open%20a%20support%20case%20so%20we%20can%20look%20for%20a%20better%20solution%20for%20you.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOn%20our%20test%20devices%2C%20when%20using%20the%20multi-app%20kiosk%20mode%2C%20it%20doesn't%20have%20a%20%22home%22%20or%20%22app-switch%22%20button.%20The%20only%20button%20they%20get%20is%20the%20%22back%22%20one.%20This%20makes%20it%20very%20troublesome%20to%20get%20back%20to%20the%20home%20screen%20or%20move%20between%20apps.%20Is%20that%20the%20as-designed%20behaviour%20or%20have%20I%20set%20something%20wrong%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EThis%20is%20an%20intentional%20design%20choice%20from%20Google%20to%20heavily%20lock%20down%20the%20available%20actions%20a%20user%20can%20take%20on%20the%20device.%20Feel%20free%20to%20read%20about%20App%20Pinning%20and%20Lock%20task%20mode%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fdeveloper.android.com%2Fwork%2Fcosu%23pinning%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdeveloper.android.com%2Fwork%2Fcosu%23pinning%3C%2FA%3E%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIs%20the%20%22Kiosk%20mode%22%20flexible%3F%20I%20can't%20find%20any%20documentation%20specifically%20about%20what%20restrictions%20get%20enforced%20or%20if%20they%20can%20be%20customized%20(change%20wallpaper%2C%20allow%20status%20bar%20etc)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ENot%20at%20this%20time%2C%20there%20are%20new%20features%20yet%20to%20come.%20Stay%20tuned!%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI'm%20a%20bit%20confused%20on%20what%20you%20say%20about%20exiting%20the%20Kiosk%20mode.%20I%20take%20it%20there%20is%20no%20secret%20process%2C%20e.g.%20tap%20somewhere%203%20times%20to%20enter%20an%20%22admin%20unlock%22%20code.%20If%20the%20store%20manager%20needed%20to%20get%20to%20the%20settings%20screen%20to%20modify%20something%20(especially%20during%20our%20early%20testing%20phases)%20is%20that%20possible.%20You%20say%20%22all%20you%20need%20to%20do%20is%20remove%20the%26nbsp%3B%3CSTRONG%3EManaged%20Home%20Screen%26nbsp%3B%3C%2FSTRONG%3Eapp%20deployment%22%20but%20we%20didn't%20%3CEM%3Edeploy%3C%2FEM%3E%20the%20app%2C%20we%20just%20sync'd%20it%20and%20used%20the%20kiosk%20profile%20to%20utilize%20it.%20Same%20question%20if%20you%20are%20only%20in%20%22single%20app%22%20mode.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EThe%20Managed%20Home%20Screen%20needs%20to%20be%20deployed%20as%20Required%20to%20your%20device%20group%20for%20the%20Kiosk%20experience%20to%20take%20place.%20By%20removing%20the%20deployment%2C%20the%20targeted%20devices%20will%20be%20removed%20from%20the%20Kiosk%20experience%20and%20will%20allow%20you%20to%20make%20any%20changes%20needed.%3C%2FSTRONG%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284513%22%20slang%3D%22en-US%22%3ERe%3A%20COSU%20Configuration%20and%20Enrollment%20using%20the%20QR%20code%20enrollment%20method%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284513%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20we%20are%20really%20excited%20about%20using%20this%20to%20control%20some%20of%20our%20in-store%20single-use%20tablets.%3C%2FP%3E%3CP%3EI've%20been%20testing%20it%20on%20a%20few%20devices%20and%20it's%20brilliant%20how%20quickly%20it%20works%20(especially%20compared%20to%20the%20legacy%20Android%20method%20in%20Intune)%3C%2FP%3E%3CP%3EI've%20got%20a%20few%20n00b%20questions%20that%20hopefully%20you%20can%20clarify%3C%2FP%3E%3COL%3E%3CLI%3EIs%20there%20any%20requirement%20to%20push%20the%20Intune%20Company%20Portal%20app%3F%20I%20don't%20believe%20so%20as%20we%20have%20it%20working%20without%20it%20but%20in%20your%20screenshot%20you%20have%20it%20there.%3C%2FLI%3E%3CLI%3EEnforcing%20device%20PIN%20-%20this%20doesn't%20seem%20to%20work%2C%20it%20would%20be%20great%20to%20have%20a%20video%20seeing%20how%20this%20happens%3C%2FLI%3E%3CLI%3EWeb%20links%20-%20We%20deployed%20the%20Microsoft%20Edge%20Browser%20to%20allow%20web%20apps%20to%20open%2C%20however%20it%20nags%20the%20end%20user%20to%20sign%20in%20with%20a%20work%20account%20and%20has%20unecessary%20UI%20(we%20don't%20want%20them%20to%20add%20new%20tabs%20or%20browse%20other%20sites).%20Are%20you%20able%20to%20control%2Fhide%20this%2C%20perhaps%20with%26nbsp%3Ban%20Intune%20%3CSPAN%3EApp%20Configuration%20Policy%3F%3C%2FSPAN%3E%3C%2FLI%3E%3CLI%3EOn%20our%20test%20devices%2C%20when%20using%20the%20multi-app%20kiosk%20mode%2C%20it%20doesn't%20have%20a%20%22home%22%20or%20%22app-switch%22%20button.%20The%20only%20button%20they%20get%20is%20the%20%22back%22%20one.%20This%20makes%20it%20very%20troublesome%20to%20get%20back%20to%20the%20home%20screen%20or%20move%20between%20apps.%20Is%20that%20the%20as-designed%20behaviour%20or%20have%20I%20set%20something%20wrong%3F%3C%2FLI%3E%3CLI%3EIs%20the%22Kiosk%20mode%22%20flexible%3F%20I%20can't%20find%20any%20documentation%20specifically%20about%20what%20restrictions%20get%20enforced%20or%20if%20they%20can%20be%20customised%20(change%20wallpaper%2C%20allow%20status%20bar%20etc)%3C%2FLI%3E%3CLI%3EI'm%20a%20bit%20confused%20on%20what%20you%20say%20about%20exiting%20the%20Kiosk%20mode.%20I%20take%20it%20their%20is%20no%20secret%20process%2C%20e.g.%20tap%20somewhere%203%20times%20to%20enter%20an%20%22admin%20unlock%22%20code.%20If%20the%20store%20manager%20needed%20to%20get%20to%20the%20settings%20screen%20to%20modify%20something%20(especially%20during%20our%20early%20testing%20phases)%20is%20that%20possible.%20You%20say%20%22%3CSPAN%3Eall%20you%20need%20to%20do%20is%20remove%20the%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EManaged%20Home%20Screen%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%3Eapp%20deployment%22%20but%20we%20didn't%20%3CEM%3Edeploy%3C%2FEM%3E%20the%20app%2C%20we%20just%20sync'd%20it%20and%20used%20the%20kiosk%20profile%20to%20utilise%20it.%20Same%20question%20if%20you%20are%20only%20in%20%22single%20app%22%20mode.%3C%2FSPAN%3E%3C%2FLI%3E%3C%2FOL%3E%3C%2FLINGO-BODY%3E
Microsoft

First published on TechNet on Oct 08, 2018
Hi everyone, Matt Butcher here. I’m a Support Escalation Engineer on the Intune team and today I wanted to take a minute to go through the steps to configure and enroll COSU (corporate owned single use) Android enterprise devices using the popular QR code method.

To give you a little background, back in July we announced support for Android enterprise purpose-built device management, where we can target task-based usage cases such as unattended guest kiosk experiences, inventory tracking, mobile ticketing, point-of-sale devices, etc. Devices managed in this way can enroll into Intune using a few different enrollment methods, such as scanning a QR code, which is what we’ll be discussing here. The benefit with this is that administrators can enroll these devices without needing to have user account credentials on the device. IT admins can then configure these corporate-owned devices to be used in locked-down environments, allowing only the app or apps necessary to complete the task while preventing users from accessing settings, installing other apps, or changing any device functions that might interfere with reliable operation.

For the purposes of this example, you’ll need a device running Android 7 or later that you can factory reset, and an open wi-fi network. Once you have that, just follow the steps below.

1. If you haven't done this already, start by connecting your Intune account to your Android enterprise account .

2. Next, approve any applications from the Managed Play Store that you need to be in the Managed Home Screen experience (including the Managed Home Screen & Android Device Policy ).

3. Now we need to sync those apps to Intune. Open a browser and go to the Intune portal , then navigate to Client Apps - > Setup – Managed Google Play and click Sync .

4. Once the sync is complete, we need to create an Assigned or Dynamic device group that will be used for the deployment. If using a Dynamic device group, set the membership rule to Add devices where / enrollmentProfileName / Equals / < InsertCOSUEnrollmentProfileNameHere > . I’ll be using a Dynamic device group named COSU_Dynamic_Device_Group so my rule will be Add devices where / enrollmentProfileName / Equals / COSU_Enrollment_Profile as shown below.



5. Now we need to create our COSU Enrollment Profile. From the Intune portal , navigate to Intune - > Android Enrollment - > Kiosk and Task Device Enrollments - > Create. Name the profile what you chose in your Dynamic Membership Criteria, which in our example was COSU_Enrollment_Profile .

6. Once that’s done, we’ll now create our Kiosk Profile. From the Intune portal , navigate to Device Configuration - > Profiles - > Create Profile. And configure the profile accordingly:

a. Name: Whatever you like
b. Platform: Android Enterprise
c. Profile Type: Device Owner Only – Device Restrictions
d. Navigate to the Kiosk node and select Multi-app kiosk
e. Click Add . The list of all your apps will appear on the right
f. Add your apps but do not add the Managed Home Screen.
g. If you have Web Apps, be sure to include a browser

 

 

I also recommend adding a password just to see what happens with the Android Device Policy app.

 


7. Deploy all your apps as Required to your Dynamic device group. Note that if you have Web Apps, you do not need to deploy them.

8. Factory Reset your Android device.

9. Wait for OOBE to begin, then tap the white space until you’re prompted to download QR Reader .

10. Connect to your open Wi-Fi network and wait for the QR reader to be installed (your screen will just be a camera).

11. Use QR Reader to scan the QR code attached to your COSU Enrollment Profile. As the device enrolls, wait until the Managed Home Screen experience begins. If you required a PIN, manually set it before the Managed Home Screen experience begins. If you fail to do this the policy will show as failed. This is important because the PIN requirement does not present a toast notification to the user however the settings are still enforced.

That’s it! Now your device is enrolled and ready to use.

Key Notes

    • Don't add the Managed Home Screen app to the Multi-App Kiosk profile.

 

    • If using web links, you do not need to deploy these to the device groups. Only store apps are required to be deployed.

 

    • If requiring a PIN, the user will not be prompted. The setting is enforced and you will need to configure the PIN manually.

 

    • To get out of the Managed Home Screen experience, all you need to do is remove the Managed Home Screen app deployment. You can adjust the Multi-App Kiosk Mode profile as needed, and then redeploy the Managed Home Screen app.

 

    • To get out of COSU, you will need to factory reset the device.

 

    • When troubleshooting, It is recommended to include the Android Device Policy app in your Multi-App Kiosk profile. This will allow you to verify what policies Google is sending to the device.

 

    • There is no direct communication between Intune and devices enrolled using this method. Intune sends policy information to Google which then manages policy delivery.

 

    • Device names will look like this: 30a97bfb2327b18d_AndroidEnterprise_10/2/2018_10:34 PM . Currently this cannot be changed.

 

    • Compliance will show as Not Evaluated because COSU does not support compliance policies.

 

    • In this scenario, you cannot deploy certificate profiles, and wi-fi profiles are limited to open authentication or pre-shared key



Matthew Butcher
Intune Support Escalation Engineer
Microsoft CSS

3 Comments
Occasional Contributor

Hi, we are really excited about using this to control some of our in-store single-use tablets.

I've been testing it on a few devices and it's brilliant how quickly it works (especially compared to the legacy Android method in Intune)

I've got a few n00b questions that hopefully you can clarify

  1. Is there any requirement to push the Intune Company Portal app? I don't believe so as we have it working without it but in your screenshot you have it there.
  2. Enforcing device PIN - this doesn't seem to work, it would be great to have a video seeing how this happens
  3. Web links - We deployed the Microsoft Edge Browser to allow web apps to open, however it nags the end user to sign in with a work account and has unecessary UI (we don't want them to add new tabs or browse other sites). Are you able to control/hide this, perhaps with an Intune App Configuration Policy?
  4. On our test devices, when using the multi-app kiosk mode, it doesn't have a "home" or "app-switch" button. The only button they get is the "back" one. This makes it very troublesome to get back to the home screen or move between apps. Is that the as-designed behaviour or have I set something wrong?
  5. Is the"Kiosk mode" flexible? I can't find any documentation specifically about what restrictions get enforced or if they can be customised (change wallpaper, allow status bar etc)
  6. I'm a bit confused on what you say about exiting the Kiosk mode. I take it their is no secret process, e.g. tap somewhere 3 times to enter an "admin unlock" code. If the store manager needed to get to the settings screen to modify something (especially during our early testing phases) is that possible. You say "all you need to do is remove the Managed Home Screen app deployment" but we didn't deploy the app, we just sync'd it and used the kiosk profile to utilise it. Same question if you are only in "single app" mode.
Microsoft

Hi Thom,

 

Thanks for all your great questions! I'll do my best to address them all individually. See my responses in bold.

 

Is there any requirement to push the Intune Company Portal app? I don't believe so as we have it working without it but in your screenshot you have it there.

 

You will not need to deploy the Company Portal app in this scenario. The apps on the left of the screenshot are the apps that I’ve chosen to be included in the Kiosk profile while the apps on the right are all of the approved Managed Play Apps and web links that are in the “All Apps” list.

 

Enforcing device PIN - this doesn't seem to work, it would be great to have a video seeing how this happens

 

I understand the feedback here, however I can confirm the enforcement does work. The user experience at this time is that you will not receive any type of prompt to set a PIN, but when manually navigating to set a PIN, you will see the requirements are there and you won’t be able to set a swipe or pattern as your password.

 

Web links - We deployed the Microsoft Edge Browser to allow web apps to open, however it nags the end user to sign in with a work account and has unnecessary UI (we don't want them to add new tabs or browse other sites). Are you able to control/hide this, perhaps with an Intune App Configuration Policy?

 

I am not currently aware of a workaround/solution to this behavior. Intune App Configuration Policies can only apply to Work Profile apps so unfortunately that wouldn’t be possible. We’d like to hear more from you on this so please feel free to open a support case so we can look for a better solution for you.

 

On our test devices, when using the multi-app kiosk mode, it doesn't have a "home" or "app-switch" button. The only button they get is the "back" one. This makes it very troublesome to get back to the home screen or move between apps. Is that the as-designed behaviour or have I set something wrong?

 

This is an intentional design choice from Google to heavily lock down the available actions a user can take on the device. Feel free to read about App Pinning and Lock task mode here: https://developer.android.com/work/cosu#pinning

 

Is the "Kiosk mode" flexible? I can't find any documentation specifically about what restrictions get enforced or if they can be customized (change wallpaper, allow status bar etc)

 

Not at this time, there are new features yet to come. Stay tuned!

 

I'm a bit confused on what you say about exiting the Kiosk mode. I take it there is no secret process, e.g. tap somewhere 3 times to enter an "admin unlock" code. If the store manager needed to get to the settings screen to modify something (especially during our early testing phases) is that possible. You say "all you need to do is remove the Managed Home Screen app deployment" but we didn't deploy the app, we just sync'd it and used the kiosk profile to utilize it. Same question if you are only in "single app" mode.

 

The Managed Home Screen needs to be deployed as Required to your device group for the Kiosk experience to take place. By removing the deployment, the targeted devices will be removed from the Kiosk experience and will allow you to make any changes needed.

Occasional Contributor

Thanks for the feedback Matthew. That's cleared it up for me.

 

One little follow up question :) ...

 

I've targeted all app/profile deployments to a dynamic AAD group based on the enrollment profile (as described in the docs)

That works great but now we are in the position that we need to exclude some devices to troubleshoot them. So, from what you've said above I should change the Managed Home Screen app to "not required" and we should then be able to get the device's Android Settings.

However, if I do that it will remove it for all devices so I need to allow exceptions in the dynamic group membership rules. I've tried doing this based on device id and name but the profile/apps still seem to be applying

 

Example of the dynamic rule I'm trying to exclude 2 different devices:

(device.enrollmentProfileName -eq "Contoso Kiosks 01")  -and (device.deviceid -ne "j2dj2e2-51d3-4d5f-8ace-153a35718256" -or device.displayName -notcontains "3131k5afff157h23_AndroidEnterprise_11/1/1111_4:07 PM")