Zebra’s OEMConfig on Android dedicated (COSU) Shared device

Platforms

Android

Products

IntuneManaged Home ScreenZebra OEMConfig

Result

Zebra devices run a multi-app kiosk where users sign in with Microsoft Entra ID and are signed out automatically

Overview

Turn Zebra devices into shared multi-app kiosks with Intune: enroll them as Android Enterprise dedicated devices with Microsoft Entra shared device mode, lock them to Managed Home Screen and push Zebra settings with an OEMConfig profile.

Microsoft Intune has managed corporate Android Enterprise devices (Fully Managed, Dedicated and Corporate-Owned Work Profile) for quite some time. This includes Zebra Technologies devices that support the Android Enterprise management standard. Intune supports Zebra devices through native Android Enterprise APIs where available, and through the OEMConfig app and profile, which unlock the extra configuration capabilities provided by the hardware vendor. For Zebra, these are the Zebra Mobility Extensions (MX). You can read more about them from Zebra and Microsoft, and in my other post about StageNow & Mobility Extensions (MX).

OEMConfig is a standard defined by Google that uses Android app configuration to send device settings to apps written by OEMs (Original Equipment Manufacturers). Many manufacturers, including Zebra, support OEMConfig as an administrative tool for configuring their Android devices with Android Managed Configurations. This lets vendors ship new device configuration capabilities independently of the UEM platform. The UEM admin only needs to make sure the new settings are applied when needed.

When you manage Zebra devices with Intune, you can combine device management features such as Zebra's OEMConfig with Microsoft's Managed Home Screen (MHS) app on Android Enterprise dedicated (COSU) devices, with the optional Microsoft Entra shared device mode (formerly Azure AD (AAD) shared device mode). Shared device mode gives users a customized sign-in experience on a kiosk-style device, secured by compliance and Conditional Access policies.

In this post, I show how to enroll and configure Zebra devices as multi-app kiosk devices shared by multiple users, using Android Enterprise dedicated (COSU) with Microsoft Entra shared device mode (in preview in 2021, now generally available) and the OEMConfig app and profile deployed by Intune.

Prerequisites

Before you start, check that you have the following.

Configuration

With the prerequisites in place, create the enrollment profile first, then the group, apps and profiles that go with it.

Create the dedicated device enrollment profile

Sign in to the Intune admin center (intune.microsoft.com) and go to Devices > Android > Android enrollment > Corporate-owned dedicated devices:

Here you can + Create profile with one of two token types, which enroll a device in two different ways (default or shared mode):

• Corporate-owned dedicated device (default): the device is enrolled without a user account and is not associated with any user.
• Corporate-owned dedicated device with Microsoft Entra ID shared mode (preview in my 2021 screenshot): same as above, but the enrollment also installs the Microsoft Authenticator app, and Microsoft Entra shared device mode lets users sign in and out across apps.

The profile name matters, because you will most likely create a Microsoft Entra ID dynamic device group based on it (enrollmentProfileName), see step 2.

Copy the QR code (or token) from the new profile, because you will need it later for enrollment.

Note: For Android zero-touch enrollment, the QR code or token is added to a zero-touch account created by an authorized reseller partner.

Create a dynamic device group

Create a Microsoft Entra ID dynamic device group that matches the dedicated (COSU) profile name from step 1 (e.g. COSU_AAD_Shared). Rule syntax:

(device.enrollmentProfileName -match "COSU_AAD_Shared")

All device configuration profiles and apps will be assigned to this group.

Add and configure Managed Home Screen

Managed Home Screen (MHS) is an Android app available through Managed Google Play, and you can easily add it in the Intune admin center (intune.microsoft.com):

Add the MHS app, sync it, and assign it as Required to the Microsoft Entra ID dynamic group created earlier.

Note: Repeat the same steps to add other apps, for example Zebra's OEMConfig app used later in this guide.

Now create an App Configuration policy for the MHS app:

• Device enrollment type: Managed devices
• Platform: Android Enterprise
• Profile type: Fully Managed, Dedicated, and Corporate-Owned Work Profile Only
• Targeted app: Managed Home Screen

Configure the MHS app with one of two methods:

• Configuration designer lets you configure settings in an easy UI, toggling features on or off and setting values.
• JSON data lets you define all possible configuration keys in JSON.

I use the simple Configuration designer. The MHS app documentation, Using Configuration Designer, explains all configuration settings. The required and recommended ones for Microsoft Entra shared devices are:

• Sign in type: string (Microsoft Entra ID; my 2021 screenshot shows the old value AAD)
• Enable sign in: bool (true)
• Enable Auto Sign-out: bool (true)
• Auto Sign-out time: integer (e.g. 300 seconds)
• Count down time on auto Sign-out dialog: integer (e.g. 60 seconds)

Then deploy this policy to the Zebra devices (e.g. the Microsoft Entra ID dynamic device group).

Configure the multi-app kiosk

In multi-app kiosk mode, the MHS app launches automatically as the default home screen and is the only home screen app the user sees.

In the Intune admin center (intune.microsoft.com), create a new Android Enterprise > Device restrictions profile:

Under Properties > Device experience, configure:

• Enrollment profile type: Dedicated device
• Kiosk mode: Multi-app
• Home screen: the list of apps to display

Note: Multi-app kiosk mode locks the device to the apps you define, which are launched from the Managed Home Screen (MHS) app. To use this mode, first approve and assign the MHS app in Apps.

Deploy this device restrictions profile to the Zebra Android Enterprise dedicated (COSU) devices with the MHS app installed.

Deploy Zebra OEMConfig

OEMConfig and the Zebra schemas are available in Google Play. In 2021 I used the app then called Zebra OEMConfig powered by MX, which is now Legacy Zebra OEMConfig (Android 11 and earlier). For Android 11 and later, Zebra now publishes Zebra OEMConfig Powered by MX.

First, add this app in the Intune admin center (intune.microsoft.com):

When the Zebra OEMConfig app is available in the console, deploy it as Required to the Zebra devices.

You also need a device configuration profile to manage the settings on Zebra devices:

• Platform: Android Enterprise
• Profile type: OEMConfig

Note: With the Legacy Zebra OEMConfig app, you can create multiple OEMConfig profiles and assign them to the same device, see how to deploy multiple OEMConfig profiles. With the new Zebra OEMConfig Powered by MX app, Microsoft suggests one profile with all settings.

The OEMConfig profile offers two configuration methods:

• Configuration designer (shows the settings from Zebra's app schema in an easy graphical interface)
• JSON editor (opens the app schema template in a JSON editor, where you set the values for the different settings)

Note: See the full list of Zebra Managed Configurations for the OEMConfig profile.

Transaction Steps set the order in which configuration settings are applied on the device as part of one transaction.

Any setting that Intune doesn't support natively for Zebra devices, but Zebra does, should be configurable with the OEMConfig app and profile.

User Experience

Finally, enroll a Zebra device and sign in as a shared user.

Tested on a Zebra L10 Rugged Tablet (Android 10 and OEMConfig 10.1), enrolled with a QR code as an Android Enterprise dedicated (COSU) device with Microsoft Entra shared device mode.

On a new or factory-reset device, the user taps the screen 6 times to open the camera:

The camera opens to scan the QR code for device enrollment (see step 1):

Note: The manual QR code scan is not needed with Android zero-touch enrollment.

If the device has no cellular or Ethernet connection, connect it to Wi-Fi manually:

On This device belongs to your organization, tap Next:

On the next screen, Let's set up your work device…, tap Accept & continue:

Accept the Google Services terms of service:

The device starts the update process and displays the work checklist:

• Install work apps
• Register shared device

Installing work apps: Microsoft Authenticator and Microsoft Intune.

Tap Next to Register shared device, then Done to finish:

Enrollment is done, but apps, policies and profiles are still installing in the background:

The Managed Home Screen (MHS) app is installing…

Once installed, the MHS app shows the Microsoft Entra ID shared device Sign in screen:

The user signs in with Microsoft Entra ID credentials (UPN/email and password):

The multi-app kiosk opens:

Managed Settings app, Device information:

The Zebra OEMConfig app shows OEMConfig version 10.1 and the last Transaction Successful:

As expected, after a period of inactivity the auto sign-out countdown dialog appears:

The next user can sign in to the device:

Note: You can customize the wallpaper and company logo on the Microsoft Entra ID sign-in screen.