Blog Post

Microsoft Intune Blog
3 MIN READ

Frontline workers get a better experience from Microsoft and Samsung

euburrag's avatar
euburrag
Icon for Microsoft rankMicrosoft
Mar 07, 2024

Editor's note 3.3.2025: This post has been updated to provide a link to detailed guidance for using Microsoft Intune to configure permissions for the Managed Home Screen on Android Enterprise devices.

Workers on the front line are the face of your business. Selling, healing, building, serving—doing what needs to get done and collaborating with customers, partners, and fellow employees to improve your bottom line. For those workers to be successful, they need tools to do the job at hand. For this, Microsoft Intune provides Managed Home Screen (MHS), a fully curated experience for your frontline workers on Android dedicated devices. Samsung is a leading provider of Android devices for enterprise and frontline scenarios, offering a range of rugged, secure, and versatile devices that can meet the needs of various industries and use cases. MHS is used on over half of all Intune-managed Android dedicated devices.

Microsoft and Samsung have come together again to announce a new experience that builds upon our commitment to deliver the best possible at-work mobile device solutions and make MHS even better.

Today, IT administrators can use MHS, to replace the default launcher on Android devices and configure their users' experiences. MHS can be used on Intune enrolled, corporate-owned dedicated devices. These devices can be shared amongst workers and dedicated to specific tasks as well as used to access productivity tools. MHS is designed to surface only the applications and device settings that are needed and allows administrators to enforce a consistent set of user experiences and company-branding. However, to benefit from the full functionality of MHS, permissions granted by IT need to be accepted by users during the device set up.

Screenshot of setup permission pop up overlay on a Samsung Android device.

This new integration between Intune and Samsung Knox enables IT admins to grant necessary permissions automatically to MHS without end-user interaction. This streamlines the user's setup experience by removing the need for workers to accept these permissions.

MHS also supports Microsoft Entra shared device mode, which provides easy single sign-in and sign-out experiences of applicable applications. As a key component of the endpoint management toolset, IT administrators can leverage shared device mode with MHS to create a customized device sign in experience for their workers.

This simplifies and secures the setup process for MHS on corporate-owned dedicated devices and ensures users will be able to access the apps and settings they need on their devices without being distracted, confused, frustrated, or interrupted by prompts.

With this integration, easy set up and shared experiences mean faster time to work and increased productivity.

Two screenshots of a Managed Home Screen that does not include a permission pop up on Samsung Android dedicated devices showing only four apps available for use. One screenshot does not require a sign in for Contoso Art Supplies and the other is signed in by Jane Smith as the user.

Getting started

To configure permissions for the Managed Home Screen on Android Enterprise devices using Intune, reference this guide for details.

Stay up to date! Bookmark the Microsoft Intune Blog and follow us on LinkedIn or @MSIntune on X to continue the conversation.

Updated Mar 03, 2025
Version 3.0
microsoft intune
  • AndrewMcN_SFRS's avatar
    AndrewMcN_SFRS
    Brass Contributor
    Jan 06, 2025

    I have a couple of updates to add...

    There doesn't appear to be a com.microsoft.launcher.next.model.notification.AppNotificationService but there is a com.microsoft.launcher.homescreen.next.model.notification.AppNotificationService

    Is it possible that the above guidance (and the docs at MS Learn) won't do anything without the missing "homescreen"?

     

    Little slap from Samsung for those not spending enough:

    Permission Controls policy not supported in select devices | Knox Platform for Enterprise | Samsung Knox Documentation

    We had a project team buy hundreds of A8's before any consultation with Tech had taken place. This is the most frustrating news.

    • chetanshanghvi's avatar
      chetanshanghvi
      Copper Contributor
      Jan 16, 2025

      This resolved my issue too. Microsoft support struggled with this issue for over a month often pointing the blame on Samsung! Even after showing them this article, they had no clue whatsoever! It worked only after trying this from your comment. Thanks again! Microsoft support had no idea that OEM config policy type is applied as "App Config" to the device and not "Device Config". 

    • Per_VestergaardDK's avatar
      Per_VestergaardDK
      Copper Contributor
      Jan 14, 2025

      Finally I got the last notification permission to work thanks to your post. Thanks! How did you find the component name? Did you use Apk Analyzer for this ?

  • satishsinghi-365's avatar
    satishsinghi-365
    Copper Contributor
    Jul 11, 2024

    AndrewMcN_SFRS For me OOBE has always been consistent.
    Reg. Device-based App Config - Did you try Edge AllowList via Device Channel? It doesn't apply for me, tried several times

    KSP applies smoothly with other policies, didn't experience any issues there.

  • AlexWithersShine's avatar
    AlexWithersShine
    Copper Contributor
    Jul 09, 2024

    I am having issues with being able to connect to Mobile Data when inside the MHS, has anyone had any experience with this?

  • AndrewMcN_SFRS's avatar
    AndrewMcN_SFRS
    Brass Contributor
    Jun 24, 2024

    satishsinghi-365 I did not experience that.

     

    MHS kicked-in immediately after OOBE. I was pleasantly surprised as it had failed with a previous build. I am wondering if there is a reliability issue with the result of the OOBE process for Shared Mode.

     

    Device-based App Configs are working perfectly for us. Edge is the perfect example where I see it working. I see literally everything else working too.

     

    I am going to double-check the speed with which the Knox Service Plugin config is applied. I did not have the config properly assigned on my first try and saw what you saw, where it applied after MHS had already displayed the grant request. I corrected the issue at my end but did not try a rebuild.

  • AndrewMcN_SFRS's avatar
    AndrewMcN_SFRS
    Brass Contributor
    Jun 24, 2024

    My Samsung devices won't accept step 7's package name as valid.

     

    I had implemented this before seeing this blog post. I had to enter:

     

    com.microsoft.launcher.enterprise/com.microsoft.launcher

     

    Every time I used this, it has failed when there is only a package name as though that is not valid syntax.

     

    I used the app "Apk Analyzer" to help me identify the components involved.

     

    Everything seems to work right away after this but I'm not 100% confident yet. Maybe a few more tablet rebuilds or some feedback from the field to let me know it's allowing folk to setup without the grant process.

     

    It's also vital that you ensure Knox Service Plugin and the configuration profile for this are assigned to hit your devices as early on as possible. Otherwise MHS launches without this benefit.

    • chetanshanghvi's avatar
      chetanshanghvi
      Copper Contributor
      Jan 16, 2025

      Even after setting the KSP app to deploy with high priority, it's always the MHS app that launches first. We are informing users to ignore the grant option for permissions and sign-in as it will be auto-granted after some time. Seems like that "High Priority" is good for nothing! Microsoft must work with Google to honour the "High Priority" setting at least for MHS app and KSP app.

      • Per_VestergaardDK's avatar
        Per_VestergaardDK
        Copper Contributor
        Jan 17, 2025

        I agree with NiklasJenslov - I think that priority is related to updates (ex. Wifi, 5G etc) But so far my tests shows that even if KSP is installed first (and all sittings apply) some of them gets reverted when MHS gets installed (eg. Adaptive brightness). You can try to create a basic setup and start with only the KSP, then later add the MHS assignment. Could be interesting to hear if you get same results. 

  • JimmyWork's avatar
    JimmyWork
    Iron Contributor
    Jun 05, 2024

    NiklasJenslov You need to use the full line here exactly how it is written.
    com.microsoft.launcher.enterprise/com.microsoft.launcher.next.model.notification.AppNotificationService

     

    For Samsung KSP plugin config.

    Permission Controls

     

    Permission Policy: Appear on top, Alarms & Reminders

    Package or Component Name: com.microsoft.launcher.enterprise

     

    Permission Policy: Notification access

    Package or Component Name: com.microsoft.launcher.enterprise/com.microsoft.launcher.next.model.notification.AppNotificationService

     

    However sometimes it still displays grant permissions even if permissions was set.

     

    Settings that work however more permissions are given.

    Permission Configuration
    Permission Policy
    Appear on top, Alarms & Reminders, Change system settings
    Package or Component Name
    com.microsoft.launcher.enterprise
    Permission Configuration 1
    Permission Policy
    ALL
    Package or Component Name
    com.microsoft.launcher.enterprise/com.microsoft.launcher.next.model.notification.AppNotificationService

     

  • satishsinghi-365's avatar
    satishsinghi-365
    Copper Contributor
    Jun 05, 2024

    NiklasJenslov you need to create 2 Permission settings and the one for Notifications should have the app bundle exactly as described in Step 8:

    com.microsoft.launcher.enterprise/com.microsoft.launcher.next.model.notification.AppNotificationService

     

    Don't ignore the "/"

  • satishsinghi-365's avatar
    satishsinghi-365
    Copper Contributor
    Jun 05, 2024

    There are still some improvements needed for the Shared Mode to further secure the device during enrollment. 

     

    1. At the end of the enrollment stage, the device goes to a fully unlocked Home Screen with full access for a few minutes until all the policies are applied. The device remains vulnerable to tampering during this period of time. The device should remain inaccessible until all Intune policies including MHS policies are successfully applied.

     

    2. Device based App Configuration policies (tested with MS Edge - URL Allow List) do not apply. Such policies have to be deployed via App Channel to be successfully applied. This is not documented anywhere.

     

    3. At the end of the enrollment, while the MHS permission policies are still being applied, user is prompted to grant the permissions. If we wait for few minutes OR login without granting permission and then log out, the permission request goes away. This defeats the whole point of having this improvement as the user will end up tapping the permission request to grant the permissions.