This week is all around enhancing the Work Profile experience with the most common system apps on Android devices. Getting the right system apps available within the Work Profile can enhance the user experience and the data separation. Mainly the latter actually, as for more apps the experience will be divided between a personal app and a work app. And that’s not always the best user experience. That could be useful when looking at for example the Camera app. Without adding that app to the Work Profile, all movies and pictures will be stored in the Personal Profile. This post will start with a quick overview of the most common Android Enterprise system apps, followed with the steps for managing (read: enabling) those apps. This post will end with a look at the user experience.
Note: The information in this blog post applies to personally-owned devices and to corporate-owned devices.
Overview most common Android Enterprise system apps
When looking at the default available Android Enterprise system apps within a Work Profile, that’s only a really limited set of apps. In some cases it might be useful to enable more system apps, to provide additional functionality within the Work Profile. That can help with further differentiating between personal apps and data and work apps and data. Especially useful when looking at functionality like making pictures for work. The default enabled system apps and some often used system apps are summarized in the table below. That table contains information about the app, the package name (on Samsung devices), the default status and the usage. The usage provides a short description of why it could be useful to enable the system app within the Work Profile.
| App | Package name | Default | Use | Usage |
|---|---|---|---|---|
| Calendar | com.samsung.android.calendar | No | Common | A separate agenda keeps track of work appointments and work meetings only. If needed, consider enabling Calendar. Might even become more useful when merging personal and work agenda experience becomes more common. |
| Camera | com.sec.android.app.camera | No | Common | A separate camera app stores work pictures and work videos only. If needed, consider enabling Camera. |
| Clock | com.sec.android.app.clockpackage | No | Uncommon | No real added value, as it provides the same functionality. |
| Contacts | com.samsung.android.app.contacts | Yes | Common | A separate contacts app stores work contacts only. Enabled by default. |
| Gallery | com.sec.android.gallery3d | No | Common | A separate gallery app opens locally stored work pictures and work videos only. If needed, consider enabling Gallery. |
| Messages | com.samsung.android.messaging | No | Uncommon | Not applicable. Can only be used by the owner of the device. |
| My Files | com.sec.android.app.myfiles | Yes | Common | A separate file browser app browses locally stored work files only. Enabled by default. |
| Phone | com.samsung.android.dialer | No | Uncommon | A separate dialer keeps a call log of work calls only and only relies on work contacts. If needed, consider enabling Phone. |
| Play Store | com.android.vending | Yes | Common | A separate store app provides (available and required) work apps only. Enabled by default. |
Note: Keep in mind that for most OEMs the default email, calculator and browser apps are not considered system apps. Those apps are available for download from the (Managed) Google Play Store.
Managing Android Enterprise system apps
Enabling Android Enterprise system apps is nowadays a really straight forward process. Those apps have a special app type available that can be used. To enable any additional system apps on Work Profile devices, simply follow the next seven steps.
- Open the Microsoft Endpoint Manager admin center portal navigate to Apps > Android
- On the Apps | Android apps blade, click Add to open the Select app type page
- On the Select app type page, select Android Enterprise system app and click Select
- On the App information page (as shown below in Figure 1), provide the following information and click Next
- Name: Specify the name of the app (see column App in the table above)
- Publisher: Specify the name of the publisher of the app
- Package name: Specify the package name of the app (see column Package name in table above)
Figure 1: Add Android Enterprise system app
- On the Scope tags page, configure the required scope tags click Next
- On the Assignments page, configure the required assignment (including optional filter for specific Work Profile devices) and click Next
- On the Review + create page, verify the configuration and click Create
Experiencing Android Enterprise system apps
The user experience with Android Enterprise system apps can be looked at from all different perspectives. From a true user perspective, the user probably won’t be happy at all to have even more separate apps. It only complicates their work. From a more technical user experience, simply look at the behavior on the device. Below, in Figure 2, is an overview of a Work Profile with all the mentioned system apps enabled. When using the Camera app within that Work Profile, the movies and pictures are also stored within that Work Profile. Figure 3 provides an overview of using the Gallery app within that Work Profile to browse for those movies and pictures. Below, in Figure 4, is an overview of the interaction between the Personal Profile and Work Profile. When storing work contacts, those contacts will be searchable within the Personal Profile.
Figure 2: Example after enabling all the mentioned system apps
Figure 3: Example of the behavior of the enabled Gallery app
Figure 4: Example of the behavior of the Contacts app
More information
For more information regarding Android Enterprise system apps and Microsoft Intune, refer to the following articles:
- How to enable system apps in Work Profile on a Samsung device (samsungknox.com)
- Manage Android Enterprise system apps in Microsoft Intune | Microsoft Docs
Discover more from All about Microsoft Intune
Subscribe to get the latest posts sent to your email.
First of all, thank you very much for these detailed instructions. May I share my initial findings with you and explain my use case?
We use various KIOSK profiles on Android devices with the Microsoft Managed Homescreen and had the idea of letting our users install apps from the Google Play Store themselves, depending on the intended use of the apps provided. Your article came at just the right time, as it meant we didn’t have to create a separate profile for every additional app that has to be visible in the MHS KIOSK. Our problem during testing was that apps can be installed and, if they are linked in the device configuration under ‘Device Experience’, they are also visible to the user in the KIOSK, but they can no longer be uninstalled via the Google Play Store. The uninstallation gets stuck in an endless loop.
Logically, it would be advantageous if users could install the apps they need themselves (self-management) and uninstall them again if they no longer need them or have made a mistake selectiong the correct app to install.
Do you have a solution for this?
To sum it up:
.) Google Play Store deployed to MHS/KIOSK as System App with package name from your table and is visible to the user.
.) Apps deployed as “available for enrolled devices” and linked to MHS/KIOSK config (device experience)
.) User is able to install apps from play store app but can´t uninstall them -> loop
Hi Ralph,
No sure I’m completely following the scenario. In general, when using a KIOSK configuration, the idea is to have a pretty static configuration. That is also the focus of the configuration of a KIOSK and probably the reason of the behavior that you’re experiencing. So, my question would be, are you using the correct configuration of the devices when you want to allow the user to install apps?
Regards, Peter