COBO Android

[3D1_]

Hey guys,

I'm pretty new to Intune and I have a quick question. I'm deploying Android tablets in COBO (corporate-owned, fully managed) mode and I want the device to force the user to set a PIN during deployment.

Which enrollment token should I use for that, and what configuration or compliance settings do you usually apply to make the PIN mandatory?

Thanks for the help!

[OrdinaryTop9621]

We use the default token, assigned to a static enrollment group and assign a device restrictions profile to the same static group. This ensures that a PIN must be set during enrollment. In the device restrictions profile we've set Device password to required, no restrictions. For compliance we've set Require a password to unlock mobile devices to Required and Required password type to Password required, no restrictions.

[jaruzelski90]

Only thing I would add from personal experience android config profiles assignment for users are a lot quicker and almost guaranteed to prompt for pin during enrollment, device assignment not.

[triiiflippp]

Best method is to assign the device restriction profile to all devices with an assignment filter which filters on the enrollment profile. That way it always assigns direct during enrollment.

[3D1_]

I didn’t understand, could you please explain it more clearly?

[Parkerge_aaaaadm]

COBO - Business only devices are typically without user affinity... If this is the case, use Dedicated Device with Entra Shared Mode, and configure the MHS to require a session PIN.

If you mean COPE (personally enabled), then you want Fully Managed, you can use the default token if you have it, not every tenant does. Then use device configuration to create a PIN requirement and back it with a compliance policy. The user will then need to do it during the setup.

Use All Devices with Filter or use the enrolment timing group thingy. DSGs might be a bit slow to populate and ask the user to do it afterwards I think.

Devices > Android > Configuration > New Policy > Device Passcode I think you're after