Android: Enrolling Devices

Contents

This article will explain how to enrol Single and Shared Android devices onto NHSmail Intune.

The enrolment process consists of 2 phases:

Phase 1 – This is completed by LAs and the steps are outlined in this article
Phase 2 – This is completed by end users (or LAs on behalf of end users) once Phase 1 is successfully completed. Please see the Quick Start End User Guide for step-by-step instructions on how to do this.

Note:

Both phases will need to be completed to enrol devices

1. Hardware and Software Requirements

Prior to enrolling any Android devices onto Intune the following minimum device and software specifications should be validated.

Device and software requirements:

Android devices must run Android OS 8.0 or a Device must be running Android OS 9.0 or above if LA’s wish to utilise MAM.
Newer, lower specification Android phones that run the Android ‘go’ version are not supported for Android Enterprise ‘Fully Managed’ enrolment.
Android device must have a functioning camera to scan the QR enrolment code.
Devices must run a distribution of Android that has Google Mobile Services (GMS) connectivity.
Devices must have GMS available and must be able to connect to GMS.

Critical Note:

Device updates for Android devices are the responsibility of organisations.

2. Single User Android Device Enrolment

1. Login into the Intune Portal: https://endpoint.microsoft.com/

2. Next, navigate to Devices > Android Configuration Profile to setup the Android Configuration Profiles. This will need to be done before a user enrols.

3. There will be a set of configuration policies that are already set in place and are acting as a pencilled-in baseline that you will have to the ability to edit and change via the RBAC Model.

Note

Ensure that you add your Trust user group to the assignments. Otherwise, policies and apps will not get pushed to end users.

4. Once devices profiles have been added, you can then forward the enrolment token to users. Navigate to Devices > Android > Android Enrolment > Corporate Owned, Fully Managed user to see the QR code.

5. Send the QR code to the user.

Note

End users should only enrol corporate devices onto Intune using the QR code. Please ensure that end users at your organisation are aware that they should not be enrolling any personal, private devices onto Intune using the QR code.

Note

Android 8.0 and above is required to use the QR enrolment method. It is recommended that all devices are regularly updated to the latest Android version to ensure that they have the latest security patches.

6. The user will need to be manually added into the Trust specific device group.

End users’ devices should then populate in the devices section in Intune. Devices > Android > Android Devices.

3. Shared Device Android Enrolment

The setup of Android shared mode is a very similar process to the setup process required for a standard single user device. Please follow the same process for enrolling a standard device.

It’s important to note that there will be a separate enrolment profile for the shared devices. If you want to set up a shared device, you will need to apply the shared device enrolment profile to that group.

The steps below highlight the actions required to setup a shared device and how this is different to enrolling a single user device.

1. Navigate to: Device > Android > Configuration Polices.

2. Select Create a profile and then select Android Enterprise as the platform and Device Restrictions as the Profile type.

3. Enter the relevant name to your organisation. Please follow the correct naming standard which is highlighted below and then select Next.

Note

For Android configuration policies, it is important to follow the correct naming standard – ODS Code-SharedDevice-ConfigurationProfileType

Example: Trust1-SharedDevice-Device Restriction

4. You should be able to customise the policies which are relevant to your organisation. The screenshot below details some suggested pencilled in policies.