跳到主要內容

111: AOSP

Implementation Effort: Medium to High
User Impact: Medium

Overview​

Android Open Source Project (AOSP) device management in Microsoft Intune is aimed at specialized Android devices that do not use Google Mobile Services. These devices are common in logistics, manufacturing, healthcare, and other dedicated-use scenarios. From a Zero Trust perspective, AOSP management matters because organizations still need identity, app control, update discipline, and compliance signals even when the device ecosystem does not look like a standard Android Enterprise deployment with Managed Google Play.

Implementation Guidance​

  1. Use AOSP only when the hardware or operational model requires it. If a supported device can run a standard Android Enterprise fully managed or corporate-owned dedicated deployment, that option is often easier to support and secure.
  2. Confirm the exact AOSP enrollment mode supported by Microsoft Intune for the device type. Document the enrollment token process, expected user association model, and who is responsible for re-enrollment if a device is wiped or replaced.
  3. Plan app delivery early. Because AOSP devices do not use Google Play in the usual way, you may rely on line-of-business packages, vendor distribution methods, or tightly controlled browser access.
  4. Validate how the device handles certificates, Wi-Fi, VPN, kiosk mode, peripherals, and OEM-specific controls. For rugged endpoints, barcode scanners, printers, camera workflows, and hardware buttons often matter more than standard mobile UX.
  5. Apply the narrowest identity and resource access model possible. Many AOSP devices are shared or task specific, so user entitlements and device entitlements should be intentionally constrained.
  6. Test update and replacement operations in the field. AOSP devices are often remote, shift based, and business critical, so supportability is as important as enrollment success.

Reference​