Testing Apps on BYOD Work Profile

[tmaeda]

We are a game app development company and we use both company-owned and personally owned devices (BYOD) to test our apps.

We have been managing BYOD as Android device administrator, but recently migrated to Android Enterprise.

The Android Enterprise BYOD work profile does not allow app installation from anything other than managed google play, so we are unable to install apps from Firebase App Distribution or Microsoft App Center, which we have been using to test apps.

We tried uploading the app to Managed Google Play, but it was not sufficient for testing, as had to update the version code after each upload, and past versions could not be installed, and it took longer (than before) for the updates to take effect (Also, the app must be uploaded as a production version and cannot be used for internal test).

What we would like to know is how to test the app in the Android Enterprise BYOD work profile (as we have done in the past); it would be great if we could install the app from Firebase App Distribution, or use Google Play's internal app sharing (not available right now) would be fine.

Does anyone have any ideas? Or are there any plans for improvements on the Android Enterprise roadmap?

[Moombas]

hi @tmaeda,

we use Android Enterprise from the beginning and via the MDM we use, we can deploy any app or apk to the devices without playstore used.

I have to be honest, i never used Firebase App Distribution or Microsoft App Center and have no knowledge of them but if you don't use an MDM for such things (which i currently guess), it may be a setting to allow install apps from unknown sources in the work profile (or both if needed).

[tmaeda]

Hi @Moombas , thanks for the reply.

> we can deploy any app or apk to the devices without playstore used.
Does this refer to the EMM console?
https://support.google.com/work/android/answer/9146439
We use Intune and this feature allows us to install apps to devices, but there is a strict limit of up to 15 uploads per day. There is no explicit API and it does not seem to work for testing purposes.

Also, it does not seem to allow installation from unknown sources to the work profile in the BYOD configuration profile (from my research this seems to be a limitation of Android Enterprise).

[Moombas]

We have the possibility to set this for enterprise devices via our MDM for work profiles (one setting for the work part, one for the private part):

So, i assume it's in general possible but doesn't know much about intune.

[tmaeda]

Thanks for the info.

I previously contacted Intune and they responded that due to the Android Management API specification, there is no API to allow installation of apps from an unknown source in the BYOD work profile.
https://developers.google.com/android/management/reference/rest/v1/enterprises.policies?hl=ja#Untrus...

Do other MDMs not use the Android Management API (is that possible...)?

[Moombas]

I do not really know how they ensure that but the option is there and worked during my tests.

But you posted the relevant documentation from the API yourself (where default (if nothing else is provided) is disallow!), so it's there.

UntrustedAppsPolicy

The policy for untrusted apps (apps from unknown sources) enforced on the device. Replaces installUnknownSourcesAllowed (deprecated).

Enums

UNTRUSTED_APPS_POLICY_UNSPECIFIED	Unspecified. Defaults to DISALLOW_INSTALL.
DISALLOW_INSTALL	Default. Disallow untrusted app installs on entire device.
ALLOW_INSTALL_IN_PERSONAL_PROFILE_ONLY	For devices with work profiles, allow untrusted app installs in the device's personal profile only.
ALLOW_INSTALL_DEVICE_WIDE	Allow untrusted app installs on entire device.

[Moombas]

And just to add: Otherwise you can set it manually on each device if not restricted by the MDM (Intune in your case).

[tmaeda]

Thanks @Moombas 

I was referring to its API.
From what you said, it sounds like the problem is that Intune does not support it.
I will contact Intune again.

[jeremy]

You could allow installation from unknown sources in the Work Profile, the option should be available, at least Google makes it available. So that could be an option for you and if you enable this it should work in the work profile.