On Android Enterprise dedicated devices, you have the option to install the Microsoft Managed Home Screen app, which acts as the default home screen on the device. This allows you to completely customize the home screen experience and reduce the opportunity for devices to be misused.
Microsoft Intune offers myriad configuration options for Managed Home Screen so you can tailor your user experiences, some of these configurations require Managed Home Screen to have “overlay permissions,” also sometimes referred to as “appear on top” permissions. The specific settings that require this permission are Enable screen saver, Enable virtual home button, and Automatically sign-out of MHS and Shared device mode applications after inactive. For detailed information, see Android Enterprise device settings to allow or restrict features using Intune.
Per the platform, Microsoft cannot automatically grant this permission to Managed Home Screen. As a result, if you have configured any of the settings that require this permission, your users will see prompts that guide them to grant overlay permissions. Additionally, due to recent platform changes, the device’s system settings app now needs to be allowed to run in kiosk mode. This document will show the different experiences you will see and provide steps on how to enable your device’s system settings app for kiosk mode.
Background of support issue
On the first launch of Managed Home Screen, if you have configured any of the settings that require Overlay Permissions then your users will see a pop-up asking them to grant this permission.
If you haven’t deployed the device’s system settings app to the device as required, then when a user taps Grant, the pop-up closes, but the permissions still haven’t been granted. In that case, users will see an Attention notification in Managed Home Screen’s settings tray (or its settings app, if you have configured it to appear):
When users tap Attention, they will see the following screen and you’ll notice that tapping Grant permission doesn’t do anything.
This is because the device’s system settings app is not enabled to run in kiosk mode for the device.
Steps to mitigate this issue
Due to the platform, the system settings app must be enabled in order to grant this permission. To enable the device’s system settings app, follow the steps here.
Note that you will need to know the package name of the system settings app for your relevant devices, which can vary between manufacturer and model. Typically, the package name for the system settings app on Android devices is com.android.settings. Once you enable the settings app for your devices, it will be enabled to run in kiosk mode, which will allow users to complete the permission granting.
The experience users see to grant the overlay permission varies a bit between OS versions, which is explained in the following sections. Note there may be some minor differences in text or user interface depending on your device’s manufacturer and model.
User experience on Android 8 devices
Users will either start their process from the pop-up that shows at the app’s first launch after a configuration requiring overlay permissions is deployed or will notice the Attention signal in the Managed Home Screen’s settings app or swipe-down. Once they get to the Grant permission page, the experience will be identical regardless of what screen they entered through. The following video shows the user’s journey from selecting the Attention banner in the settings tray.
User experience on Android 9 and 10 devices
Users will either start their process from the pop-up that shows at the app’s first launch after a configuration requiring overlay permissions is deployed or will notice the Attention signal in Managed Home Screen’s settings app or swipe-down. Once they get to the Grant permission page, the experience will be identical regardless of what screen they entered through. The following video shows the user’s journey from tapping Grant in the pop-up.
User experience on Android 11 and 12 devices
Users will either start their process from the pop-up that shows at the app’s first launch after a configuration requiring overlay permissions is deployed or will notice the Attention signal in Managed Home Screen’s settings app or swipe-down. Once they get to the Grant permission page, the experience will be identical regardless of what screen they entered through. The following video shows the user’s journey from tapping Grant in the pop-up.
Thanks for reading. Learn more about Managed Home Screen here. If you have any questions or feedback, comment on this post or reach out to @IntuneSuppTeam on Twitter.