Private or In-house developed Android app deployment with Microsoft Intune for Android Enterprise devices – Part 1

One re-occurring question I see in the community and from customers who reach out to me directly and ask what option do we have as an organization when it comes to in-house developed Android apps when we manage our devices with Intune. Specifically what do we do about versioning and testing new version of in-house developed apps. I will try to answer those questions in this 2 part series where part 1 will focus on the more general concept and in part 2 we will go a bit deeper and look at some specific details and more advanced aspect of in-house developed Android apps management within Intune.

As always I’m going about this from the viewpoint of an IT Pro and not as a developer.

In this series there will be some screenshots and references to things directly related to Android app development for Android and the thoughts around that is that will help you as an IT Pro to communicate to your developers on what it is they need to do or comply with for you to be able to deploy the app they have developed with Intune. Hopefully act like a bridge and explain what we as IT Pro’s administrating Intune needs from the developer in order to be able to manage in-house developed app deployments.

Another thing worth mentioning is that I’m covering Android Enterprise in this post and not AOSP or Android Device Administrator (which is end of support from Microsoft on December 31st 2024) https://learn.microsoft.com/en-us/mem/intune/enrollment/android-enroll-device-administrator

Line-of-business app

A question that could come up is why I’m not mentioning Line-of-Business apps in this post and the simple answer is that its not supported for Android Enterprise in Intune. Which makes this not a solution we can use for Android Enterprise devices.

https://learn.microsoft.com/en-us/mem/intune/apps/lob-apps-android

Managed Google Play iframe

The first thing we need to understand is that Manage Google Play iframe is the API being used when you access Managed Google Play from the Intune console. The way you interact with it is by going to Apps -> Android Apps -> Add -> Managed Google Play App

This brings you to the following view

Note.
If you want to know more about the iframe API you can read the documentation from google here:
https://developers.google.com/android/work/play/emm-api/managed-play-iframe

This essentially means that Intune taps in to the functions that iframe offers from the Intune UI and that Microsoft does not control whats shown within iframe. With that said, the best approach if you find something that does not work properly within iframe would be to create a ticket to Microsoft who in turn can reach out to google.

Managed Google Play Store

Play Store

In the Managed google play store, you can search any app that developers had made public within your market, country or for your organization. You can search by name or even by the Application ID of an app.

Example 1 – Microsoft Word

Searching using the name of the application “Microsoft Word” brings up the correct result.

Searching for the Application ID for Microsoft word which is com.microsoft.office.word also returns the correct app.

Example 2 – private app

I want to highlight the Application ID because if you are working with a developer who has made their app private from the Google Console but assigned it to your organization ID then you might not be able to find it when searching by name (thats my experience) Instead you might need to search for the Application ID to be able to see the app.

I will go in to more details in part 2 on this but here’s a quick example.

A developer (could be internal or external) has made an app private (In Google Play Console) and assigned it to your organization.

Note.
Parts of the name and Application ID have been removed from the pictures. But you will get the idea.

Searching by name does not return the application

Search using Application ID returns the correct app

Private Apps

There are 3 types of private apps from google.
https://developers.google.com/android/work/play/emm-api/private-apps

• Private Apps hosted by google
• Private Apps self-hosted
• Private Apps within iframe in the Intune console ( similar to no.1 )

In this part I wont go in to details on all of them but I’ll briefly cover Private Apps within iframe in the Intune console.

Private apps from within iframe

Another way of adding private apps is directly within iframe. When you do this, the application gets tied to the organization ID you have from google.
https://developers.google.com/android/work/play/emm-api/managed-play-iframe#private-apps

Note.
You can find your organization ID within iframe. In the right corner, click on the icon that looks like a person with a cogwheel and you will see your organiazation Name and ID.

The private app section has changed over the years and I wont go in to details about the older implementation and instead focus on the current way its being handled. However the big difference is that now a days the private app sections is using Google Play Console in the background which from what I can tell it did not do before. The reason why this is important is that we get a few benefits that we did not have in the past that are Google Play Console related which I will show in part 2 of this series.

From here you click on the + sign to add an app. You then enter the name of the application and also point to the .APK file of the application.

When uploading an .APK file the Application ID needs to be unique (more on that in part 2). If its not you’ll see and error message like this when trying to upload it through iframe ” The package name (Application ID) is already used by another application ”

This means that you or someone else already have that Application ID uploaded in Google Play and you can not use it twice. The application ID needs to be unique. If its not, then you need to update the package name which is done by the developer in build.gradle configuration file for the app.

But if it is unique, your app will be added and visible under private apps.

Once the sync has been performed, the application will show up in the list of available apps to be assigned.

Whats next in part 2

In part 2 I will focus more on the differences on having a developer account in Google Console and the account you get automatically when using iframe. There will be more information on Application ID and versioning within the Android app that needs to be correctly managed by the developer.

I will also go in to details on how we can manage “tracks” to test new versions of the app to certain groups instead of needing to deploy it to everyone or having multiple apps in the console with the only difference being that they are different versions.

Stay tuned !

That’s it for this time, Don’t forget to follow me on X (twitter) @timmyitdotcom , BlueSky @timmyit.com or connect with me on LinkedIn