Change to Autoenrollment behavior

[microsoftjoe]

With Company Portal version 5.0.6523.0, we shipped a change to autoenrollment behavior. With this version, single-identity apps, including wrapped apps, will no longer be automatically enrolled for MAM policies once another app has been enrolled on the device.

This makes it critical to follow the integration instructions and ensure that your app is correctly registering accounts and returning tokens correctly from your authentication callback. Please review the documentation here and especially the exit criteria and troubleshooting sections:
https://learn.microsoft.com/en-us/mem/intune-service/developer/app-sdk-android-phase4

Wrapped apps should continue to function, since the wrapping process adds the necessary steps with DefaultEnrollment. However, please test that your apps can sign in and receive MAM policy without other apps being signed in first.

[microsoftjoe]

Note: the abovementioned behavior change has been rolled back to customer issues with DefaultEnrollment. However, it will return in the future, and I will update this discussion. In the meantime, for apps that integrate the MAM SDK directly, please review the above documentation and ensure that your app is properly integrated.

[bcaulder8]

Did the Autoenrollment changes go back in to Intune Company Portal again?

For users that are inside the Android Work Profile (have signed in to Intune Company Portal) - could autoenrollment for single-tenant applications be allowed in this case? I am not positive if you could have the multiple identities inside a Work Profile where the user is Signed In to ICP. But that might be a valid case.

[microsoftjoe]

Hi @bcaulder8,
The autoenrollment changes were gradually flighted back on, finishing around 6/10/2025.
MAM is mostly independent of MDM features like WorkProfile, so multiple identities are certainly possible there. Unfortunately, we won't be able to make such a change as you suggest.