Microsoft Intune
App managementConfigure Managed Android Apps with Microsoft Intune - Microsoft Intune | Microsoft Learn
In brief
The documentation adds AOSP referenced apps alongside Android Enterprise apps, including platform and profile selections and JSON-only configuration guidance.
What Intune admins need to know
Administrators managing AOSP referenced apps should use vendor- or manufacturer-provided JSON settings. Configuration Designer and Connected apps aren't supported for these apps.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Add App Configuration Policies forConfigure Managed Android Enterprise DevicesApps with Microsoft Intune - Microsoft Intune | Microsoft Learn
App configuration policies in Microsoft Intune supply settings to Managed Google Play apps and directly deployed line-of-business (LOB) apps on managed Android Enterprise devices, and to AOSP referenced apps on Android Open Source Project (AOSP) devices.
The app developer exposes Android-managedthe settings that you can configure. Assign an app configuration settings. Intune uses these exposed settingpolicy to let the admin configure features foruser or device groups to supply those settings to the app. The app configuration policy is assigned to your user groups. Theuses the policy settings are used when the appit checks for them, typically the first time the appit runs.
Important
Create an app configuration policy
Use this procedure to create an app configuration policy for managed Android Enterprise or AOSP devices.
Sign in to the Microsoft Intune admin center.
Choose the Apps > Configuration > Create > Managed devices. You can choose between Managed devices and Managed apps. For more information, see Apps that support app configuration.
On the Basics page, set the following details:
- Name - The name of the profile that appears in the portal.
- Description - The description of the profile that appears in the portal.
- Device enrollment type - This setting is set to Managed devices.
Select Android Enterprise & AOSP as the Platform.
Note
For AOSP referenced apps, select All or Corporate owned devices as the Profile type.
Select Select app next to Targeted app. The Associated app pane is displayed.
On the Associated app pane, choose the managed app to associate with the configuration policy and select OK.
Select Next to display the Settings page.
- Use configuration designer
- Enter JSON data
Note
AOSP referenced apps support JSON configuration only. Configuration designer isn't supported because Intune doesn't have an uploaded APK from which to read the app's configuration schema. Get the supported configuration keys, value types, and values from the app vendor or device manufacturer.
For details about using the configuration designer, see Use configuration designer. For details about entering
XMLJSON data, see Enter JSON data.If you need to enable users to connect the targeted app across both the work and personal profiles, select Enabled next to Connected apps.
Note
This setting only works for personally owned work profile and corporate-owned work profile devices. Connected apps isn't supported for AOSP referenced apps.
Changing the Connected apps setting to Not Configured won't remove the configuration policy from the device. To remove the Connected apps functionality from a device, you must unassign the related configuration policy.
ToFor supported Android Enterprise devices, select Credential provider to allow specific apps to act as a system credentialprovider, selectCredential provider.provider. By default, Android blocks third-party credential providers from providing credentials. For more information, see Allow an app to be a credential provider.Select Next to display the Scope tags page.
[Optional] You can configure scope tags for your app configuration policy. For more information about scope tags, see Use role-based access control and scope tags for distributed IT.
Select Next to display the Assignments page.
You can use the configuration designer for Managed Google Play apps when the app is designed to support configuration settings. Configuration applies to devices enrolled in Intune. The designer lets you configure specific configuration values for the settings exposed by the app.
Configuration designer isn't supported for AOSP referenced apps. For these apps, use Enter JSON data.
Select Add. Choose the list of configuration settings that you want to enter for the app.
If you're using Gmail or Nine Work email apps, Android Enterprise device settings to configure email has more information on these specific settings.
Some configuration settings on apps (such as apps with Bundle types) can't be configured with the configuration designer. Use the JSON editor for those values. Settings are supplied to apps automatically when the app is installed.
For AOSP referenced apps, JSON is the only supported configuration format. Follow Create an app configuration policy and use configuration settings supplied by the app vendor or device manufacturer.
- For Configuration settings format, select Enter JSON editor.
- In the editor, you can define JSON values for configuration settings. You can choose Download JSON template to download a sample file that you can then configure.
- Choose OK, and then choose Add.
Applies to: Android 11+
Connected apps isn't supported for AOSP referenced apps.
Personally owned work profile users must have Company Portal version 5.0.5291.0 or newer. Corporate-owned work profile users don't need a specific version of the Microsoft Intune app for support.
You can allow users using Android personally owned and corporate-owned work profiles to turn on connected apps experiences for supported apps. This app configuration setting enables apps to connect and integrate app data across the work and personal app instances.
By default, Android blocks third-party credential provider apps from providing credentials. Use the Credential provider setting to allow specific apps (such as a third-party password manager) to act as the system credential provider. Microsoft Authenticator is allowed automatically.
To configure credential provider permissions, go to Apps > Configuration > Create > Managed devices, and choose Android Enterprise & AOSP as the platform. Select Credential provider in the settings to allow specific apps to act as credential providers.
This setting lets you:
- **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. For example, a good policy name is **Android Enterprise prompt permissions app policy for entire company**.
- **Description**. Enter a description for the profile. This setting is optional, but recommended.
- **Device enrollment type**: This setting is set to **Managed devices**.
- **Platform**: Select **Android Enterprise*Enterprise & AOSP**.
- Select Profile Type:
- Select Targeted App. Choose the app that you want to associate a configuration policy with. Select from the list of Android Enterprise fully managed work profile apps that you approve and synchronized with Intune.
- Select Permissions > Add. From the list, select the available app permissions > OK.
@@ -1,6 +1,6 @@ --- layout: Conceptual-title: Add App Configuration Policies for Managed Android Enterprise Devices - Microsoft Intune | Microsoft Learn+title: Configure Managed Android Apps with Microsoft Intune - Microsoft Intune | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/intune/app-management/configuration/configure-managed-android breadcrumb_path: /intune/breadcrumb/toc.json uhfHeaderId: MSDocsHeader-Intune@@ -14,9 +14,10 @@ ms.collection: - Android - FocusArea_Apps_Configure ms.subservice: apps-description: Use app configuration policies in Microsoft Intune to supply settings when users run a Managed Google Play app.-ms.date: 2026-04-23T00:00:00.0000000Z+description: Use Microsoft Intune app configuration policies to supply settings to Managed Google Play, Android LOB, and AOSP referenced apps on managed devices.+ms.date: 2026-10-21T00:00:00.0000000Z ms.topic: how-to+ms.custom: msecd-doc-authoring-1030 ai-usage: ai-assisted ms.reviewer: esalter locale: en-us@@ -38,14 +39,18 @@ item_type: Content source_path: intune/app-management/configuration/configure-managed-android.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/80beb97b-18aa-44f8-9420-8f2a4cd448eb+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/a72e95ff-4b4f-4cc1-90c6-7dcba67ff05f spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/8c09e0ef-0fde-4b6d-bf1b-b517e4db7f80+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/24dc3ccd-591a-4415-a1fe-8759afafcb12 platformId: cd496ac6-5f71-0e8e-e0d2-c9e5fe088a22 --- -# Add App Configuration Policies for Managed Android Enterprise Devices - Microsoft Intune | Microsoft Learn+# Configure Managed Android Apps with Microsoft Intune - Microsoft Intune | Microsoft Learn -App configuration policies in Microsoft Intune supply settings to Managed Google Play apps and directly deployed line-of-business (LOB) apps on managed Android Enterprise devices. The app developer exposes Android-managed app configuration settings. Intune uses these exposed setting to let the admin configure features for the app. The app configuration policy is assigned to your user groups. The policy settings are used when the app checks for them, typically the first time the app runs.
+App configuration policies in Microsoft Intune supply settings to Managed Google Play apps and directly deployed line-of-business (LOB) apps on managed Android Enterprise devices, and to AOSP referenced apps on Android Open Source Project (AOSP) devices.
+
+The app developer exposes the settings that you can configure. Assign an app configuration policy to user or device groups to supply those settings to the app. The app uses the policy settings when it checks for them, typically the first time it runs.
Important
@@ -72,6 +77,8 @@ Android Enterprise has several enrollment methods. The enrollment type depends o
## Create an app configuration policy
+Use this procedure to create an app configuration policy for managed Android Enterprise or AOSP devices.
+
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
2. Choose the **Apps** > **Configuration** > **Create** > **Managed devices**. You can choose between **Managed devices** and **Managed apps**. For more information, see [Apps that support app configuration](overview#apps-that-support-app-configuration).
3. On the **Basics** page, set the following details:
@@ -79,7 +86,11 @@ Android Enterprise has several enrollment methods. The enrollment type depends o - **Name** - The name of the profile that appears in the portal.
- **Description** - The description of the profile that appears in the portal.
- **Device enrollment type** - This setting is set to **Managed devices**.
-4. Select **Android Enterprise** as the **Platform**.
+4. Select **Android Enterprise & AOSP** as the **Platform**.
+
+ Note
+
+ For AOSP referenced apps, select **All** or **Corporate owned devices** as the **Profile type**.
5. Select **Select app** next to **Targeted app**. The **Associated app** pane is displayed.
6. On the **Associated app** pane, choose the managed app to associate with the configuration policy and select **OK**.
7. Select **Next** to display the **Settings** page.
@@ -107,17 +118,21 @@ Android Enterprise has several enrollment methods. The enrollment type depends o - **Use configuration designer**
- **Enter JSON data**
- For details about using the configuration designer, see Use configuration designer. For details about entering XML data, see Enter JSON data.
+ Note
+
+ AOSP referenced apps support JSON configuration only. Configuration designer isn't supported because Intune doesn't have an uploaded APK from which to read the app's configuration schema. Get the supported configuration keys, value types, and values from the app vendor or device manufacturer.
+
+ For details about using the configuration designer, see Use configuration designer. For details about entering JSON data, see Enter JSON data.
12. If you need to enable users to connect the targeted app across both the work and personal profiles, select **Enabled** next to **Connected apps**.
Note
- This setting only works for personally owned work profile and corporate-owned work profile devices.
+ This setting only works for personally owned work profile and corporate-owned work profile devices. Connected apps isn't supported for AOSP referenced apps.
Changing the **Connected apps** setting to **Not Configured** won't remove the configuration policy from the device. To remove the **Connected apps** functionality from a device, you must unassign the related configuration policy.
-13. To allow specific apps to act as a system credential provider, select **Credential provider**. By default, Android blocks third-party credential providers from providing credentials. For more information, see Allow an app to be a credential provider.
+13. For supported Android Enterprise devices, select **Credential provider** to allow specific apps to act as a system credential provider. By default, Android blocks third-party credential providers from providing credentials. For more information, see Allow an app to be a credential provider.
14. Select **Next** to display the **Scope tags** page.
15. [Optional] You can configure scope tags for your app configuration policy. For more information about scope tags, see [Use role-based access control and scope tags for distributed IT](../../fundamentals/role-based-access-control/scope-tags).
16. Select **Next** to display the **Assignments** page.
@@ -143,6 +158,8 @@ Android Enterprise has several enrollment methods. The enrollment type depends o
You can use the configuration designer for Managed Google Play apps when the app is designed to support configuration settings. Configuration applies to devices enrolled in Intune. The designer lets you configure specific configuration values for the settings exposed by the app.
+Configuration designer isn't supported for AOSP referenced apps. For these apps, use Enter JSON data.
+
1. Select **Add**. Choose the list of configuration settings that you want to enter for the app.
If you're using Gmail or Nine Work email apps, [Android Enterprise device settings to configure email](../../device-configuration/templates/ref-email-settings-android-enterprise) has more information on these specific settings.
@@ -197,6 +214,8 @@ The following apps process the previous app configuration and only allow organiz
Some configuration settings on apps (such as apps with Bundle types) can't be configured with the configuration designer. Use the JSON editor for those values. Settings are supplied to apps automatically when the app is installed.
+For AOSP referenced apps, JSON is the only supported configuration format. Follow Create an app configuration policy and use configuration settings supplied by the app vendor or device manufacturer.
+
1. For **Configuration settings format**, select **Enter JSON editor**.
2. In the editor, you can define JSON values for configuration settings. You can choose **Download JSON template** to download a sample file that you can then configure.
3. Choose **OK**, and then choose **Add**.
@@ -209,6 +228,8 @@ When the assigned app is run on a device, it runs with the settings that you con
Applies to: Android 11+
+Connected apps isn't supported for AOSP referenced apps.
+
Personally owned work profile users must have Company Portal version 5.0.5291.0 or newer. Corporate-owned work profile users don't need a specific version of the Microsoft Intune app for support.
You can allow users using Android personally owned and corporate-owned work profiles to turn on connected apps experiences for supported apps. This app configuration setting enables apps to connect and integrate app data across the work and personal app instances.
@@ -245,7 +266,7 @@ Android's Credential Provider capability allows you to control which application
By default, Android blocks third-party credential provider apps from providing credentials. Use the **Credential provider** setting to allow specific apps (such as a third-party password manager) to act as the system credential provider. Microsoft Authenticator is allowed automatically.
-To configure credential provider permissions, go to **Apps** > **Configuration** > **Create** > **Managed devices**, and choose **Android Enterprise** as the platform. Select **Credential provider** in the settings to allow specific apps to act as credential providers.
+To configure credential provider permissions, go to **Apps** > **Configuration** > **Create** > **Managed devices**, and choose **Android Enterprise & AOSP** as the platform. Select **Credential provider** in the settings to allow specific apps to act as credential providers.
This setting lets you:
@@ -294,7 +315,7 @@ For example, an app uses the device's microphone. The user is prompted to grant - **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. For example, a good policy name is **Android Enterprise prompt permissions app policy for entire company**.
- **Description**. Enter a description for the profile. This setting is optional, but recommended.
- **Device enrollment type**: This setting is set to **Managed devices**.
- - **Platform**: Select **Android Enterprise**.
+ - **Platform**: Select **Android Enterprise & AOSP**.
3. Select **Profile Type**:
4. Select **Targeted App**. Choose the app that you want to associate a configuration policy with. Select from the list of Android Enterprise fully managed work profile apps that you approve and synchronized with Intune.
5. Select **Permissions** > **Add**. From the list, select the available app permissions > **OK**.