Introducing a new enrollment method for staging corporate Android devices with Microsoft Intune

[Intune_Support_Team]

By: Akriti Srivastava – Product Manager 2 | Microsoft Intune

With Intune’s May (2405) service release, we’re introducing a new enrollment method ‘Device Staging’ for the following Android Enterprise devices:

• Corporate-owned fully managed
• Corporate-owned work profile devices

The new method simplifies the enrollment experience for frontline workers (FLW), optimizing their productivity by reducing the time spent to set up the device. For more information on this enrollment method, review: Set up enrollment for Android Enterprise fully managed devices

What is ‘Device Staging’ and how is this enrollment method different?

Currently, the enrollment process for corporate devices uses a ‘Default’ enrollment token and is completed in 2 stages, first by the admin and then the user. The admin initiates the enrollment process, creates the enrollment token, and then shares it with the user. Then, the user signs into the device using their credentials and navigates through all the provisioning steps to complete enrollment. 

The new method introduces a ‘Staging’ token, the enrollment is completed in 3 stages, first by the admin, second by an admin or third-party vendor, and then the user.

In the ‘Staging’ enrollment experience, an admin initiates the process, creates the enrollment token, and then shares device staging token with a third-party vendor or admin. Then, provisioning steps are completed by the third-party admin/vendor. The device remains userless throughout the vendor stage and becomes user affiliated and ready for use only at the last step when the user signs in with their credentials.

With this method, more work is done by the vendor/admin as they perform the enrollment of the device, go through the steps to complete Google registration, and get the device ready (while your organization’s apps are automatically installed in the background).

Getting started

How to begin using the device ‘Staging’ experience

1. Sign in to the Microsoft Intune admin center.
2. Navigate to Devices > Android > Android Enrollment.
3. Under Enrollment Profiles choose either Corporate-owned, fully managed user devices or Corporate-owned devices with work profile.
4. Create a new profile.
5. Configure the token.

Stage 1- Actions performed by admin

• Creates the staging token by setting the Token type to “Corporate-owned, fully managed, via staging” within the enrollment profile and set the token’s expiration date.
  
  Screenshot of an Android corporate-owned, fully managed profile in the Microsoft Intune admin center.
  
  
• Creates either a dynamic device group or an assignment filter to assign policies and apps during the user stage for devices that will enroll with the newly-created enrollment token.
  • Important: Dynamic Device group is not supported at the vendor stage. Assignment filters must be used at the vendor stage for targeting apps and policies.
• Enrollment token (located in the enrollment profile) and the device is then sent to the third-party vendor or another admin.

A screen capture of creating the staging enrollment token within the Microsoft Intune admin center.

Stage 2- Actions performed by third-party vendor/admin

• Vendor unboxes the device, puts the battery in, and turns it on.
• Vendor goes through the enrollment process, walks through the setup wizard but doesn’t need to input credentials at the sign-in screen. Out-of-box enrollment of devices is performed using the token QR code or the token number provided by the admin.
• The vendor stage ends on the home screen with work profile created.
• The device is turned off and given to the user.

A screen capture of an Android device being enrolled through Microsoft Intune.

Stage 3- Actions to be performed by device user

• User turns on the phone, goes to the Intune app, and signs in using their credentials.
  • Note: Some screens that don’t require user input may be skipped, depending on technical feasibility. An “enrollment in progress” screen takes their place.
    
    A screen capture of an Android device completing enrollment through Microsoft Intune and navigating to the home screen.
    
    
• After completing the final enrollment steps, the device is ready to be used by the user.

Monitoring devices undergoing staging

In the Intune admin center (Devices > All devices), admins can monitor the list of devices which are in the process of staging (vendor stage) and the ones which have completed (user stage). These columns in particular will help admins to view the list and status of the staging devices: Device name, OS (enrollment mode), Primary User.

1. When the user has not completed the enrollment: When the device is still at the vendor stage. Admins can view the list of the devices which are under the process of staging.
   • Device name will have a prefix- Staging followed by serial number followed by enrollment mode followed by date and time.
     Staging_ XX1235_AnroidEnterprise_06/09/2022_4.20 AM
   • The prefix ‘Staging’ indicates that the device is still in the process of staging.

2. When the user has completed the enrollment: There will be a change in the naming convention of the devices once staging completes.
   • Device name starts with the username followed by enrollment mode followed by date and time.
     Username_AnroidEnterprise_06/09/2022_4.20 AM

Stay tuned to What’s new in Intune for the release and for further additions to this functionality! If you have any questions, let us know in the comments or reach out to us on X @IntuneSuppTeam.