Intune: Android (Regular) Enrollment and Email

Let’s assume that you want to configure an email configuration for an Android device. Look at the picture above. That is what you will see in Intune when trying to create an email configuration for a (regular) Android enrolled device. Notice something? Yes, email is not an option (unless you’re using KNOX)! You cannot push an MDM email payload to an Android device by default.

app configuration policy options

What about an app configuration policy? Nope, you can’t do that either! As you can see above, when you try to create an app configuration policy for enrolled devices, you only have two options: iOS or Android for Work. Regular Android is not supported.

If you want users to be able to use email on their enrolled Android device, you must consider whether to have them enroll as an Android or Android for Work device. If they enroll as regular Android, they will have to configure their email application manually. The only way to auto-configure an Android device for on-premise Exchange email is to enroll the device using Android for Work (or Knox).

Side note: if you are willing to bypass enrollment altogether, you may be able to use MAM policies to auto-configure Outlook.

Intune: MAM Policies For On-Premise Exchange

Mobile application management (MAM) policies are an exciting way to manage devices. It’s a relatively new feature that Microsoft Intune has been featuring for a while now, even calling the process “no enrollment management.” That’s because the best part about MAM management is that users do not have to enroll their device. With the Microsoft ecosystem, when a user authenticates into a compatible Microsoft MAM-enabled mobile app, the MAM policies will automatically kick in, without the user having to do anything else. Mobile apps like Outlook can be protected to require PIN, prevent copy-paste, and even be completely wiped from a device without impacting any personal data.

Before this month, there was a huge catch with Intune MAM. It was only possible for companies utilizing Exchange Online. As of this month however, Microsoft has made MAM policies available for on-premises Exchange mailboxes. They released a blog post this month proposing the next steps and how they expect it to work:

https://blogs.technet.microsoft.com/exchange/2018/04/02/a-new-architecture-for-exchange-hybrid-customers-enables-outlook-mobile-and-security/

Requirements:

  1. Exchange on-premises setup. Exchange Server 2016 and 2013 supported. All other versions of Exchange must be completely removed from the environment.
  2. Active Directory Synchronization. Active Directory synchronization of the entire on-premises directory with Azure Active Directory, via Azure AD Connect.
  3. Exchange hybrid setup: Requires full hybrid relationship between Exchange on-premises with Exchange Online.
  4. Intune setup: Both cloud-only and hybrid deployments of Intune are supported (MDM for Office 365 is not supported).
  5. Office 365 licensing
  6. EMS licensing