I'm writing this post to draw attention to some issues I've come across with Intune recently.
1.) The first issue is that the Corporate Identifiers (IMEI's/serial numbers) are not documented accurately (Identify corporate-owned devices with IMEI or serial number ). It should be nice and clear in the docs articles, and unfortunately it's just not, and instead is misleading. IMEI DOES work to make Android Enterprise - Work profile devices be marked automatically upon enrollment as "Ownership = Corporate".
2.) Unfortunately, IMEI / SN cannot be used for the same purpose when enrolling devices as Fully Managed. This is a bit of a problem, because of the next issue....
3.) The enrollment token for Android Enterprise Fully Managed is non-revocable / non-expiring. Meanwhile the other two corporate-aimed enrollment types - Dedicated / COPE - have their enrollment profile tokens both auto-expiring and revocable. The docs articles explain when you'd want to revoke the tokens:
Revoke tokens
You can immediately expire the token/QR code. From this point on, the token/QR code is no longer usable. You might use this option if you:
- accidentally share the token/QR code with an unauthorized party
- complete all enrollments and no longer need the token/QR code
But strangely, the Fully Managed enrollment type is left in the dark with no protection either from Corporate Identifiers, or revocable/expiring tokens. Might as well point out here too that Intune's Enrollment Restrictions do not help with Fully Managed either. So essentially anyone can BYOD to Android Enterprise Fully Managed, as long as they're allowed to enroll any number of devices and haven't exceeded their maximum allowed number of devices.
I do get that BYOD devices enrolled as Fully Managed would be a fairly low threat, but it is still unclear why this gap has been left open.
