Intune Android Device Enrollment Profiles Test

Microsoft Intune, together with Microsoft Entra ID, facilitates a secure, streamlined process for registering and enrolling devices that want access to your internal resources. Once users and devices are registered within your Microsoft Entra ID (also called a tenant), then you can utilize Intune for its endpoint management capabilities. The process that enables device management for a device is called device enrollment. Personal and organization-owned devices can be enrolled in Intune. Once enrolled, they receive the policies and profiles you create. A device enrollment profile defines the settings applied to a group of devices during enrollment.

You can enroll devices running on the following platforms:

  • Android

  • iOS/iPadOS

  • Linux

  • macOS

  • Windows

In an environment where multiple Android enrollment profiles are used to enroll the devices running on Android platform, it is the responsibility of the administrators to identify the enrollment profile using which maximum number of devices were enrolled. Also administrators should keep track on the expiry date of the enrollment tokens that were provided while the enrollment profiles were created. If the token had already expired, then, the devices could not be managed on Microsoft Azure Intune and hence those devices may be barred from accessing the target Azure environment. To avoid such unpleasant issues to the users owing Android devices, it is essential to keep track on the Android enrollment profiles round the clock! The Intune Android Device Enrollment Profiles test helps administrators in this regard!

This test auto-discovers the Android Enrollment Profiles created on Microsoft Azure Intune and for each enrollment profile, this test reports the enrollment mode and the number of devices enrolled. This test also reports the number of days that are left for the expiry of the token that was provided while the enrollment profiles were created. Using this test, administrators can identify the enrollment profiles on which token are nearing expiry or had already expired and also identify the profile using which maximum devices were enrolled.

Target of the Test: Microsoft Azure Intune

Agent deploying the test: A remote agent

Output of the test: One set of results for each enrollment profile created on Microsoft Azure Intune

Configurable parameters for the test
Parameters Description

Test Period

How often should the test be executed.

Host

The host for which the test is to be configured.

Tenant ID

Specify the Directory ID of the Azure AD tenant to which the target subscription belongs. To know how to determine the Directory ID, refer to Configuring the eG Agent to Monitor Microsoft Azure Intune Using Intune REST API.

Client ID, Client Password, and Confirm Password

To connect to the target subscription, the eG agent requires an Access token in the form of an Application ID and the client secret value. For this purpose, you should register a new application with the Azure AD tenant. To know how to create such an application and determine its Application ID and client secret, refer to Configuring the eG Agent to Monitor Microsoft Azure Intune Using Intune REST API. Specify the Application ID of the created Application in the Client ID text box and the client secret value in the Client Password text box. Confirm the Client Password by retyping it in the Confirm Password text box.

Proxy Host and Proxy Port

In some environments, all communication with the Azure cloud be routed through a proxy server. In such environments, you should make sure that the eG agent connects to the cloud via the proxy server and collects metrics. To enable metrics collection via a proxy, specify the IP address of the proxy server and the port at which the server listens against the Proxy Host and Proxy Port parameters. By default, these parameters are set to none, indicating that the eG agent is not configured to communicate via a proxy, by default.

Proxy Username, Proxy Password and Confirm Password

If the proxy server requires authentication, then, specify a valid proxy user name and password in the Proxy Username and Proxy Password parameters, respectively. Then, confirm the password by retyping it in the Confirm Password text box.

DD Frequency

Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency.

Detailed Diagnosis

To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option.

The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:

  • The eG manager license should allow the detailed diagnosis capability
  • Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.

Measures reported by the test:

Measurement Description Measurement Unit Interpretation

Token expiration status

Indicates the current state of the expiration of the token that was used to enroll dedicated android devices using this enrollment profile.

 

The values reported by this measure and its numeric equivalents are mentioned in the table below:

Measure Value Numeric Value
Good 0
Warning 1
Error 2
Critical 3
Expired 4

Note:

By default, this measure reports the Measure Values listed in the table above to indicate the current expiration state of the token. The graph of this measure however, is represented using the numeric equivalents only - 0 to 4.

Days until expiration

Indicates the number of days left for the expiry of the token that was used to enroll dedicated android devices using this enrollment profile.

Number

 

Enrollment mode

Indicates the current mode of this enrollment profile.

 

The values reported by this measure and its numeric equivalents are mentioned in the table below:

Measure Value Numeric Value
Corporate owned dedicated device 0
Corporate owned fully managed 1
Corporate owned work profile 2
Corporate owned AOSP userless device 3
Corporate owned AOSP user associated device 4

Note:

By default, this measure reports the Measure Values listed in the table above to indicate the current mode of this profile. The graph of this measure however, is represented using the numeric equivalents only - 0 or 4.

Enrollment token type

Indicates the type of token that was used to enroll dedicated android devices using this enrollment profile.

 

The values reported by this measure and its numeric equivalents are mentioned in the table below:

Measure Value Numeric Value
Default 0
Corporate owned dedicated device with Azure AD shared mode 1

Note:

By default, this measure reports the Measure Values listed in the table above to indicate the token type used by this profile. The graph of this measure however, is represented using the numeric equivalents only - 0 or 1.

Enrolled devices count

Indicates the number of android devices that were enrolled using this enrollment profile.

Number

Compare the value of this measure across enrollment profiles to identify the enrollment profile using which maximum number of devices were enrolled.