RSSAmplifier

Blog

Jason Bayton

Independent Android Enterprise content for everyone

bayton.orgRSS feed ↗248 posts

Latest posts

What the last decade of Android Enterprise DPC migration could have been

I've written about DPC migration more than once over the years. Google introduced the platform APIs for wipe-free device migration between EMM vendors in Android 9.0 back in 2018. They've been sitting in the SDK ever since, and no EMM vendor I'm aware of has shipped cross-vendor migration using them. When Google publicly surfaced DPC migration within AMAPI in early 2024, I wrote : The resurfaced…

Introducing DeltaWatch: web change detection

If you've ever written documentation for a living, you know the particular flavour of horror that comes from a vendor updating a page without saying a word. A deprecated flag. A changed default. A renamed permission. A URL slug that now 301s to something vaguely related but not actually the same. The kind of change that would be a one-line entry in a sensible changelog, if the changelog existed at…

Android Enterprise lands on Android XR

After months of "coming soon", Google has published the Android Enterprise for Android XR documentation, alongside a support article detailing management capabilities for XR devices. It's been a long wait since the Galaxy XR launched late last year without enterprise support, and now we can finally see what Google has been working on. The short version: it's fully managed only at the moment, the…

How MIKA works: building an AI assistant for bayton.org

MIKA started as an April 1st project, because of course it did. But as with most things I build, the goal was never just a gag - it was to make something genuinely useful and have a bit of fun doing it. If you haven't come across it yet, MIKA - M obile I ntelligence & K nowledge A ssistant - is an AI-powered assistant that sits across bayton.org and answers questions about Android Enterprise using…

Bayton.org goes AI-first: meet MIKA

Yes, this was created for April 1st But MIKA is very much real. It's a fully functional, OpenAI-backed assistant with complete access to bayton.org content via voice and text. It no longer takes over the homepage - instead it's available as a floating orb across the entire site and a dedicated full experience at /mika/ with voice support. The questions asked of it are being used to identify gaps…

TCL Note A1 NXTPAPER hands-on

I've been spending some time with TCL's Note A1 NXTPAPER lately after backing their kickstarter a few months ago. It's a tablet-notepad hybrid positioned to rival the likes of the Kindle Scribe and ReMarkable in the notes-first space. It's not an E-Ink tablet despite the marketing leaning into that category, but the matte, paper-like display does genuinely feel different to a typical glossy…

What's new in the 2026 Android Security Paper?

Google has released the 2026 edition of the Android Security Paper, and I've spent some time comparing it with notes from the 2023 and 2024 versions I've reviewed in the past to determine both net-new content, as well as overall direction. The short version: core architecture is largely the same over the last few years. The Linux sandbox model, SELinux enforcement, hardware-backed keystore,…

MDM is dead. Long live ACE?

If you manage devices for a living, you've probably felt it; that creeping sense that the platforms you rely on - the ones built by teams of dozens, iterated over decades, sold on multi-year contracts - are ripe to have the ground shift beneath them. I can't predict the future, but I can share what happened when I decided to test the thesis myself. After shipping AMAPI Commander , a conversational…

Introducing AMAPI Commander: converse with your Android estate

If you manage or support an estate of Android devices, you already know the pain. Getting a straightforward answer about your estate typically means logging into a console, clicking through several screens, exporting a report, and wrangling it into something useful. Need to know how many devices are running an outdated security patch? That's a ticket to IT, a scheduled report, or half an afternoon…

MANAGED INFO is going licence-free

MANAGED INFO is moving to a predominantly licence-free model for almost all core capabilities. Over the last 18 months the project has grown substantially in scope, from a simple information/support surface to a flexible and capable tool for building device experiences. On a deeper level, it has integrated new functionality that isn't even visible to end users, but the capabilities it provides now…

Google Play Protect is now the custom DPC gatekeeper, and everyone is a threat by default

My DPC has been blocked by Google Play Protect For anyone landing here after searching for answers as to why you're seeing unsettling Play Protect warnings for safe, compliant apps, read this help article and submit an appeal. Read more below . Google has a habit of dropping significant changes into unassuming help centre articles, and the subject of this article regarding Device Policy Controller…

12 deliveries of AE-mas (What shipped in Android Enterprise in 2025)

Note: This is cross-posted from the Android Enterprise Customer Community 2025 was a big year for Android Enterprise. This was the year several long-missed features finally landed, Device Trust became a thing , zero-touch got a compliance and audit boost, provisioning saw a revamp, and the Android Management API quietly kept adding the sort of controls that make admins' lives easier. So, in the…

The 12 AE requests of Christmas (2025 Edition)

Christmas is upon us! Deck the halls with JSON schemas and so forth. As we wrap up 2025, we’ve seen some massive wins for the Android Enterprise and the Android Management API (AMAPI) this year; APN overrides, custom apps, and Device Trust to name a few which I've covered off over on the Android Enterprise Customer Community . But let’s be honest: while Google has been busy with tightening…

RCS Archival and you: clearing up the misconceptions

Recent headlines have sparked concern and confusion about a new Android feature that supposedly "lets your boss read all your text messages". Sensational claims like “Google starts sharing all your text messages with your employer” have understandably raised privacy concerns. In reality, Android RCS Archival is a tightly scoped enterprise feature designed for regulatory compliance - not a…

Device Trust from Android Enterprise: What it is and how it works (hands-on)

Hybrid and remote work has become increasingly more prevalent over the last several years, with bring-your-own (BYOD) providing a driving force in enabling a work-from-anywhere-on-anything approach to the modern enterprise. While you'll find no end of articles for and against flexible work practices, the reality is they're here, and they're challenging IT departments the world over on how to…

Android developer verification: what this means for consumers and enterprise

Google's August 2025 announcement of developer verification has caught quite a bit of attention in the Android community. Why? From September 2026, all apps installed on certified Android devices will have to come from a verified developer across several regions, with a global rollout the following year. Google frames the change as implementing an “ID check at the airport”, it will confirm…

AMAPI finally supports direct APK installation, this is how it works

With the release of AMAPI SDK 1.6.0-rc01 , Google has introduced long-awaited support for direct APK installation via the Android Management API (AMAPI). This new capability allows EMM solutions leveraging Google's Android Device Policy (ADP) to install and update apps on managed devices without relying on Google Play or other third-party mechanisms. Up to now, direct APK deployment was only…

The Android Management API doesn't support pulling managed properties (config) from app tracks. Here's how to work around it

I've had a use case thrust upon me this week, something I hadn't really paid much attention to as I considered and assumed it to be basic functionality. But wouldn't you know? Nope! If you're one of an increasing number of organisations trying to get to grips with Google Play's app tracks, you'll likely already understand the perceived benefits: Multiple application versions through one app…

Hands-on with CVE-2025-22442, a work profile sideloading vulnerability affecting most Android devices today

Mr. Cowell made me aware of a Medium article by Bastien Bobe , field CTO at Lookout, this week. His article gave me a good overview of a vulnerability discovered by Alan Zaccardelle that I'd previously not heard about. I'd encourage reading the linked article above for the overview and demo video of the vulnerability, but in a nutshell the issue is as follows: During work profile setup, there's a…

AAB support for private apps in the managed Google Play iFrame is coming, take a first look here

The Android App Bundle (AAB) is a modern application packaging format introduced by Google to streamline and optimise Android app distribution. Unlike the traditional APK, an AAB contains all the necessary compiled code, resources, and assets for an app only for the purpose of permitting dynamic packaging; it cannot be directly installed through Android's package manager on-device (3rd party…

What's new (so far) for enterprise in Android 16

A little earlier in the year, Android 16 beta 1 has just landed! With the first beta available, it's time to take a look at what's new, so far, in Android 16 "Baklava". This is, as last year, a non-definitive and unconfirmed list of changes. Like the work profile changes in Android 14 things can change at any point and without warning. Here we go! No bump to minimum SDK version for installation of…

Android 15: What's new for enterprise?

Android 15 launched officially for Pixel on October 15th. This was about a month and a half after the release to AOSP on September 3rd. It has been a rather odd series of events this year; Pixel typically receives the latest and greatest version of Android in tandem with its release to AOSP, and the marketing and messaging goes out in unison for Android as a whole, but with Pixel's delay it caused…

How Goto's acquisition of Miradore is eroding a once-promising MDM solution

Back in 2014, I discovered Miradore, an ITSM solution with a then-emerging Mobile Device Management (MDM) product that promised a robust set of features for managing Android devices. My initial review, Miradore Online: Free MDM , highlighted the platform's potential and its generous free tier, which made it stand out in a market otherwise dominated by costly alternatives. Miradore isn't defined by…

Google Play Protect no longer sends sideloaded applications for scanning on enterprise-managed devices

In a surprise announcement last week, Google have confirmed sideloaded applications - such as those deployed via EMM solutions - will no longer be sent to Google servers for Google Play Protect scanning on enterprise-managed devices. Why apps are sent to Google # When an application is installed from a source other than Google Play, it is not considered safe by default. Google Play Protect, as…

Mobile Pros is moving to Discord

Mobile Pros has been a slack group since inception, way back in the late 2010s. One of the biggest bug-bears for that platform is Slack's hostile approach to non-paying communities, withholding message history and denying access to attachments; it's meant a lot of valuable information over the years has vanished into the ether and put the community on the back-foot compared to other platforms in…

Avoid another CrowdStrike takedown: Two approaches to replacing Windows

In recent days, the tech community has been grappling with the aftermath of a major outage caused by CrowdStrike. This incident resulted in significant disruptions across various enterprise Windows environments, leading to downtime and operational challenges for numerous organisations, public bodies, critical infrastructure, and more. The outage has highlighted the almost impenetrable hold…

Introducing MANAGED SETTINGS

I've been supporting customers on their modern Android management journeys for several years now, and as you can imagine, the more customers you engage with, the more you notice patterns and friction points that resurface time and time again. For me, having access to system settings from within kiosk environments is one such example of those friction points, and one of the first projects for 2024…

I'm joining NinjaOne

It’s been a while since my last career update, and as interesting and diverse as the ecosystem is in opportunities to get involved with various projects*, I’m happy to be going back to FTE 😁. Over the last several months I’ve been doing a lot more with AMAPI - as you’ll no doubt see if my posting history is anything to go by - and an opportunity presented itself to join NinjaOne to help build out…

Samsung announces Knox SDK restrictions for Android 15

Android's Device Administrator (DA) APIs were a cornerstone of device management since their inception way back in Android 2.2. However, with their deprecation in 2017 with Android 9.0 (and obviously prior given AE was introduced in 5.0), Google and the wider ecosystem (👋) has encouraged a shift to the more robust and secure Android Enterprise as DA APIs have slowly faded away. Embracing Android…

What's new (so far) for enterprise in Android 15

Android 15 is live! Android 15 is now live, check out the latest article for what ultimately landed! It's that time of year again. Android 15 is available in pre-release, and combined with some of the changes I've seen committed to the developer documentation, there are a few tasty treats for organisations to come in the next dessert (Vanilla Ice-cream to don't you know). This is, as last year, a…

Google quietly introduces new quotas for unvalidated AMAPI use

Google have made one of the most significant changes to permissible use of AMAPI in the last few years, imposing new limits for the number of devices permitted to enrol without validating a solution for commercial availability (that being applying for the EMM community & validating up to a minimum of Standard solution set support). The reasoning hasn't been provided, but my own experience of…

What is Play Auto Install (PAI) in Android and how does it work?

If you have set up a modern Android device, may have come across the list of apps offered by your device just before you finish setup. This is referred to as Play Auto Install and is available to OEMs building certified Android devices. The list of recommended and required applications suggests (or mandates) a selection of applications the OEM, carrier, or Google consider useful for your Android…

AMAPI publicly adds support for DPC migration

In the last few days a new suite of APIs have appeared on Google's AMAPI developer docs page covering DPC Migration 🎉 I've written about DPC migration sporadically since 2018 when Google brought it up at their partner summit however the ambitious and frankly substantially overdue functionality has rarely been seen referenced since. Google's DPC migration solution was intended originally to…

How do Android devices become certified?

If you've taken a passing interest in Android as a product/platform in recent years, you may be familiar with GMS (Google Mobile Services) Certification - more recently rebranded to Play Protect Certification. If the concept is new to you, this certification is the combination of public requirements from the CDD ( Compatibility Definition Document ) - a reference that provides both requirements…

Mute @channel & @here notifications in Slack

I've been using Slack a good deal more recently, and much like Teams' @everyone and Google Chat's @all , Slack's @channel and @here is a recipe for notification-geddon that's significantly overused in a lot of communities. Did you know, however, you can turn these notifications off? Unfortunately it's a channel-specific change, but here's how you can do it: Right-click on the channel Click Change…

A guide to raising better support requests

Dear support, There is a problem with my devices, they won't load my app. Does this look familiar? How about: A customer reports their remote control connection is unstable, and performance is unreliable. It has been like this for some weeks. Unfortunately these two examples are inspired by some of the many support requests I've observed in the last few weeks alone , with many more examples like…

Ask Jason: How should we manage security and/or OS updates for our devices?

Damien asked, through the Mobile Pros Discord community: We have approx 5000 COPE devices with just over 4000 of them Samsung all managed using WS1 UEM. Should we use e-FOTA? If not what? What about BYOD devices? Our security team is advising us to cut access to those who don’t have a patch of 2 months old. Our minimum version is OS 12 but this would mean cutting the access to quite a few devices…

Pixel 8 series launches with 7 years of software support

Google yesterday announced the Pixel 8 series, something I almost missed being wholly occupied with the release of Android 14 and all the new enterprise docs and features that came with it. (You can see what's new here and find my notes on articles and such shared yesterday here ). There are plenty of new features exclusive to the model, but the biggest announcement as far as I'm concerned is that…

Android's work profile behaviour has been reverted in 14 beta 5.3

Earlier this morning I noted the What's new for enterprise in Android 14 doc (now under a non-preview URL 🎉) has removed references to the work profile changes I wrote about in my previous docs and articles ( 1 , 2 ). Incidentally, I also had a minor beta update (5.3) pending across my Pixels. Coincidence? No. Given the timing I assumed there may be a link between the two and thought I'd compare…

Fairphone raises the bar with commitment to Android updates

Today Fairphone announced their newest smartphone, the Fairphone 5 . I've been a FP4 user for the last year, and had an FP3+ before that, the FP5 looks like a solid upgrade both in terms of spec and the headlines Fairphone are making with this new device. They're well known for their focus on sustainability and longevity with a history of devices receiving support for several years - the FP3 (2019…

Product files: The DoorDash T8

Welcome to Product Files, a series of articles that touch on some of the more interesting aspects of running a product organisation for the last several years. As this series grows, additional links will show up here: Building Android devices Alternative form factors and power solutions The DoorDash T8 Google recently published a blog post and video by the DoorDash team that covered how the T8,…

Android's work profile gets a major upgrade in 14

This change has been reverted # Check out this article for more information. The below no longer applies to Android 14, but may be instead re-appear for Android 15 (or sooner in a QPR - quarterly patch release - if it's ready). This'll be updated at a later date. In case you missed it, my article on what's new in Android 14 covered off a subtle but significant change to the way the work profile…

Google's inactive account policy may not impact Android Enterprise customers

Back in May Google announced a change to their account inactivity policy . If you're a Google account owner you may have received an email also: If not, it was covered quite extensively by the media: ars TECHNICA tom's guide The Verge Wired and others I'd considered adding to the noise back then with an enterprise point of view, but it occurred to me there really wasn't any clarity for enterprise…

Product files: Alternative form factors and power solutions

Welcome to Product Files, a series of articles that touch on some of the more interesting aspects of running a product organisation for the last several years. As this series grows, additional links will show up here: Building Android devices Alternative form factors and power solutions The DoorDash T8 I last wrote about my job back in 2020 . I think it's about time to change that, so in this…

What's new in Android 14 for enterprise

Not too long ago Google announced the first beta of Android 14. As these things tend to go, the likelihood now of major additions is slim, and so beta 1 marks a good opportunity to review what we're likely to see when Android 14 officially launches later this year. Given the amount of lower-level developer content, I'm not going to cover everything in the API docs targeted to Android 14, so this…

Introducing Micro Mobility

TL/DR I've published the first in a series of children's books. Jump to the announcement ⏬ A s many of your reading this will know, I've been in the Enterprise Mobility Ecosystem for a very long time. 10 years, in fact, as of January just gone. Although I started as a generalist, supporting Android, iOS, Windows Mobile (loved those CAB files), Blackberry.. it's quite clear at this p oint where I…

Android Enterprise: A refresher

If you're working in a typical organisation, you're probably struggling to keep up with the ever-evolving world of mobile device management. With employees using their personal devices for work and the rapid pace of technological change, it's no wonder that many IT departments are feeling overwhelmed. That's where Android Enterprise comes in. Android Enterprise is a powerful mobile device…

What I'd like to see from Android Enterprise in 2023

I last did one of these in 2019, and very little has come to fruition from my previous list.. so although most of that still applies, it's obviously time to do one again! It's been a pretty quiet year for enterprise features in Android; not to suggest what was released wasn't welcomed (Wi-Fi features in particular were long-overdue!), but compared to years prior there were no big-hitters that…

Thoughts on Android 12's password complexity changes

The password complexity changes Google announced here and here with Android 12 for WPoPOD (work profile on personally owned devices) are rolling out to mostly-unsuspecting organisations as EMMs begin targeting API level 31 with their DPCs. I'll be honest, I didn't consider this to be much of a big deal. Having caught the announcement back last year I assumed it would be logically, thoughtfully…

Google Play target API requirements & impact on enterprise applications

Update 12/22 Google has since relaxed the timeline for when the November changes take place. Developers now have until 31/01/2023. Furthermore, permanently private applications, such as those made private in the Play console, as well as those uploaded via the API or managed Google Play iFrame, are exempt from this policy change. It's no secret many organisations struggle to keep pace with Google's…