Skip to content

Commit 31d4770

Browse files
author
Angela Fleischmann
authored
Merge pull request #8224 from lenewsad/ZtouchConfig2208
Added steps to enable zero touch configurations
2 parents 57f14b0 + fca807d commit 31d4770

1 file changed

Lines changed: 66 additions & 13 deletions

File tree

‎memdocs/intune/enrollment/android-dedicated-devices-fully-managed-enroll.md‎

Lines changed: 66 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ keywords:
88
author: Lenewsad
99
ms.author: lanewsad
1010
manager: dougeby
11-
ms.date: 04/21/2022
11+
ms.date: 08/16/2022
1212
ms.topic: how-to
1313
ms.service: microsoft-intune
1414
ms.subservice: enrollment
@@ -54,7 +54,7 @@ After you've set up your Android Enterprise [dedicated devices](android-kiosk-en
5454
5555
## Enroll by using Near Field Communication (NFC)
5656

57-
Create a specially-formatted NFC tag to provision NFC-supported devices running Android 8.0 or later. You can use your own app or any NFC tag-creation tool. For more information, see [C-based Android Enterprise device enrollment with Microsoft Intune](/archive/blogs/cbernier/nfc-based-android-enterprise-device-enrollment-with-microsoft-intune) and [Google's Android Management API documentation](https://developers.google.com/android/management/provision-device#nfc_method).
57+
Create a specially formatted NFC tag to provision NFC-supported devices running Android 8.0 or later. You can use your own app or any NFC tag-creation tool. For more information, see [C-based Android Enterprise device enrollment with Microsoft Intune](/archive/blogs/cbernier/nfc-based-android-enterprise-device-enrollment-with-microsoft-intune) and [Google's Android Management API documentation](https://developers.google.com/android/management/provision-device#nfc_method).
5858

5959
For corporate-owned work profile (COPE) devices, the NFC enrollment method is only supported on devices running Android versions 8.0 to 10.0. It's not supported with Android 11.0 or later.
6060

@@ -68,7 +68,7 @@ For corporate-owned work profile (COPE) devices, the NFC enrollment method is on
6868

6969
1. Turn on your wiped device.
7070
2. On the **Welcome** screen, select your language.
71-
3. Connect to your **Wifi**, and then choose **NEXT**.
71+
3. Connect to your **Wi-fi**, and then choose **NEXT**.
7272
4. Accept the Google Terms and conditions, and then choose **NEXT**.
7373
5. On the Google sign-in screen, enter **afw#setup** instead of a Gmail account, and then choose **NEXT**.
7474
6. Choose **INSTALL** for the **Android Device Policy** app.
@@ -87,13 +87,68 @@ Scan the QR code from the enrollment profile to enroll devices running Android 8
8787
2. On devices running Android 8.0, you'll be prompted to install a QR reader. Devices running Android 9 and later are pre-installed with a QR reader.
8888
3. Use the QR reader to scan the enrollment profile QR code and then follow the on-screen prompts to enroll.
8989

90-
## Enroll by using Google Zero Touch
90+
## Enroll by using Google Zero Touch
9191

92-
To use Google's Zero Touch system, the device must support it and be affiliated with a supplier that is part of the service. For more information, see [Google's Zero Touch program website](https://www.android.com/enterprise/management/zero-touch/).
92+
To use this method, zero-touch enrollment must be supported on devices and affiliated with a supplier that is part of the Android zero-touch enrollment service. For more information, such as prerequisites, where to purchase devices, and how to associate a Google Account with your corporate email, see [Zero-touch enrollment for IT admins](https://support.google.com/work/android/answer/7514005)(opens Android Enterprise Help).
9393

94-
1. Create a new Configuration in the Zero Touch console.
95-
2. Choose **Microsoft Intune** from the EMM DPC dropdown.
96-
3. In Google's Zero Touch console, copy/paste the following JSON into the DPC extras field. Replace the *YourEnrollmentToken* string with the enrollment token you created as part of your enrollment profile. Be sure to surround the enrollment token with double quotes.
94+
This section describes how to:
95+
* Create a zero-touch configuration in the admin center
96+
* Create a zero-touch configuration in the zero-touch enrollment portal
97+
98+
### Create zero-touch configuration in admin center
99+
The zero-touch iframe lets you access the zero-touch enrollment portal in the Microsoft Endpoint Manager admin center. To enable the iframe, you must first add the *update app sync* permission and enable enrollment for corporate-owned, fully managed devices. After those steps are complete, the zero-touch enrollment option becomes visible in the admin center and you can link your account and create zero-touch configurations.
100+
101+
Complete the following steps to enable the iframe and create a new zero-touch configuration. To create configurations in the zero-touch enrollment portal instead, skip to [Create configuration in zero-touch enrollment portal](android-dedicated-devices-fully-managed-enroll.md#create-configuration-in-zero-touch-enrollment-portal).
102+
103+
#### Step 1: Add required permission
104+
Add the *update app sync* permission.
105+
106+
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431)
107+
admin.
108+
2. Select **Tenant administration** > **Roles**.
109+
3. Select your role from the list.
110+
4. Select **Properties**.
111+
5. Go to **Permissions** and then select **Edit**.
112+
5. Select **Android for Work**.
113+
6. Next to **Update app sync**, select **Yes**.
114+
9. Select **Review + save** to review your changes.
115+
9. Select **Save**.
116+
117+
#### Step 2: Enable enrollment for corporate-owned devices
118+
Verify that enrollment is enabled for corporate-owned, fully managed devices.
119+
120+
1. In the admin center, go to **Devices** > **Enroll devices**.
121+
2. Select **Android enrollment**.
122+
3. Under **Enrollment profiles**, choose **Corporate-owned, fully managed user devices**.
123+
4. Verify that the setting for **Allow users to enroll corporate-owned user devices**, is set to **Yes**.
124+
125+
#### Step 3: Link zero-touch account to Intune
126+
Link a zero-touch account with your Microsoft Intune account. Upon linking the account, Intune creates a default zero-touch configuration.
127+
128+
1. In the admin center, go to **Devices** > **Enroll devices**.
129+
2. Select **Android enrollment**.
130+
2. Under **Bulk enrollment methods**, choose **Zero-touch enrollment**.
131+
3. The iframe opens. Select **Next** to begin setup.
132+
4. Sign in with the Google account you provided to your reseller.
133+
5. Select the zero-touch account you want to link, and then select **Link**.
134+
6. A default configuration is created. A screen appears with basic information about the new configuration. Intune will automatically apply the default to any zero-touch enabled device that's without an existing configuration. Select **Next** to continue.
135+
136+
> [!TIP]
137+
> The token used for the default configuration is for a fully managed device. If you want to create a zero-touch configuration for a corporate-owned work profile device or a dedicated device, see [Create configuration in zero-touch enrollment portal](android-dedicated-devices-fully-managed-enroll.md#create-configuration-in-zero-touch-enrollment-portal) (in this article).
138+
6. Add support information to assist device users during setup.
139+
7. Select **Save**.
140+
141+
Once your account is linked with Intune, zero-touch enabled devices are ready to receive the default configuration. You can view existing zero-touch configurations, edit support information, unlink the account, and link other accounts in the admin center.
142+
143+
### Create configuration in zero-touch enrollment portal
144+
145+
Add a zero-touch configuration in the Google zero-touch enrollment portal. You can use the zero-touch enrollment portal by itself to manage configurations, or you can use it in combination with the zero-touch iframe. The portal supports configurations for fully managed and dedicated devices, and corporate-owned devices with a work profile.
146+
147+
1. Sign in to the zero-touch enrollment portal with your Google account.
148+
2. Select the option to add a new configuration.
149+
3. Fill out the information in the configuration panel.
150+
4. Select **Microsoft Intune** as the EMM DPC app.
151+
5. Copy the following JSON text into the DPC extras field. Replace `YourEnrollmentToken` with the enrollment token you created as part of your enrollment profile. Be sure to surround the enrollment token with double quotes.
97152

98153
```json
99154
{
@@ -105,11 +160,9 @@ To use Google's Zero Touch system, the device must support it and be affiliated
105160

106161
"android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
107162
"com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "YourEnrollmentToken"
108-
}
109-
}
110-
```
111-
112-
4. Choose **Apply**.
163+
6. Enter your organization's name and support information, which is shown on screen while users set up their devices.
164+
165+
For more information about how to assign a default configuration or apply a configuration in the zero-touch portal, see [Zero-touch enrollment for IT admins](https://support.google.com/work/android/answer/7514005)(opens Android Enterprise Help).
113166

114167
## Enroll by using Knox Mobile Enrollment
115168
To use Samsung's Knox Mobile Enrollment, the device must be running Android OS version 8.0 or later and Samsung Knox 2.8 or higher. For more information, learn [how to automatically enroll your devices with Knox Mobile Enrollment](./android-samsung-knox-mobile-enroll.md).

0 commit comments

Comments
 (0)