Creating and Assigning Managed App Configuration for the Android Enterprise App

Deploying managed app config to Android Enterprise devices is supported with Lookout for Work 6.4 and higher. If you choose to do so, users do not require Microsoft Authenticator to activate, and you can pre-grant the required permissions to Lookout.

Lookout uses different managed app configuration values for Android Enterprise Work Profile devices and Android Enterprise Fully Managed Devices. If you have both types of devices in your fleet, you must assign the users to separate Entra ID groups so that you can apply the correct managed app configuration to each group.

If you do not provide managed app configuration for the Android app, users can activate Lookout for Work by using Microsoft Authenticator and manually granting permissions.

Log in to the Microsoft Intune admin center.
In the left sidebar menu, click Apps.
In the Apps blade, under Policy, click App configuration policies.
Click + Add > Managed devices.

Set the following:


Field	Value
Name	`Lookout for Work Android`
Description	(Optionally enter a description)
Device enrollment type	Managed devices
Platform	Android Enterprise
Profile Type	All Profile Types
Targeted app	Select the app you defined earlier in Intune and click OK.

Click Next.

Under Permissions, click +Add and check the following:


Permission	Permission name	Description
Contacts (read)	`READ_CONTACTS`	Allows Lookout to import the Entra ID company profile and authenticate the device against Entra ID.
Location access (fine)	`ACCESS_FINE_LOCATION`	(Optional) On Android 8.1+, access the SSID for the Wifi network, allowing Lookout to display it upon encountering a Network threat. If the permission is not granted, the name of the compromised network is listed as `<unknown ssid>`.
Phone state (read)	`READ_PHONE_STATE`	Allows Lookout to retrieve the device ID and correlate a device with its entry in Intune.
External storage (read)	`READ_EXTERNAL_STORAGE`	Allows Lookout to read external storage. Required for file system monitoring, so that Lookout can look for malware on the file system.
External storage (write)	`WRITE_EXTERNAL_STORAGE`	Allows Lookout to write to external storage. Required to remediate malware found on the SD card, as well as for backup functionality.

Click OK.
Set the Permission state dropdown for each permission to Auto grant.
Scroll down to Configuration Settings and set the Configuration settings format dropdown to Use configuration designer.
Click Add and check the following:
- MDM name
- MDM Device ID
- Global Enrollment Code
- Email
- Dual Enrollment
- HSM Key value
Click OK.
Set the following case-sensitive values:
Click Next.
On the 3. Assignment tab, under Included Groups, click + Select groups to include:
Search for and click all groups that you want to assign.
Use the same group(s) you used for initial enrollment.
Click Select.
Click Next, then click Create.
If you have a mix of work profile and fully managed devices in your fleet, repeat these steps to create a second managed app configuration.

The app configuration assigned to user groups with Android Enterprise Work Profile devices must use an MDM Device ID value of {{aaddeviceid}}.

The app configuration assigned to user groups with Android Enterprise Fully Managed devices must use an MDM Device ID value of {{AzureADDeviceid}}.

Lookout Product Documentation

Find answers about using and optimizing Lookout products.

Creating and Assigning Managed App Configuration for the Android Enterprise App

lookout-footer