🚀 Overview: Managing Android Devices in Non-GMS Environments

For IT Administrators, Microsoft Intune typically leverages Google Mobile Services (GMS) as the primary communication backbone for managing Android endpoints. GMS facilitates essential tasks like push notifications, app distribution via the Play Store, and security attestation. However, certain enterprise scenarios require management of devices where GMS is unavailable. This occurs most frequently in high-security “closed” or air-gapped networks, on hardware that ships without GMS (such as specific ruggedized devices or IoT hardware), or in geographic regions like the People’s Republic of China where GMS is restricted.

Operating in a non-GMS environment shifts the management paradigm from a push-based system to a polling-based system. This transition introduces specific functional limitations and latency considerations that administrators must account for when designing their mobile device management (MDM) strategy. These constraints apply across several enrollment types, including Android Device Administrator (DA) and Android Open Source Project (AOSP) management.

⚙️ Key Technical Details

App Deployment and Installation

🛡️ Manual Sideloading: In the absence of the Google Play Store, the Microsoft Intune Company Portal app must be manually downloaded and “sideloaded” onto the device. Unlike standard installations, sideloaded applications do not benefit from automated background updates. IT admins are responsible for establishing a manual lifecycle management process to ensure the Company Portal remains patched and up-to-date.

🇨🇳 Regional Requirements (China): Because the Play Store is inaccessible in China, administrators must direct users to reputable local app marketplaces to obtain the necessary management binaries. Detailed guidance for this specific workflow can be found in Microsoft’s documentation regarding Company Portal installation in China.

Functional Limitations in the Intune Admin Center

⚠️ Feature Gaps: Several core Intune capabilities are tethered to GMS components like Google Play Protect or Play Services. Without these, the following features will be disabled or non-functional:

• Device Compliance: Within compliance policies for Android Device Administrator, any settings or checks listed under Google Play Protect are unavailable and cannot be enforced.
• App Protection Policies (MAM): Conditional launch triggers—specifically Play integrity verdict, Require threat scan on apps, and Max Company Portal version age (days)—cannot be utilized to gate access to corporate data.
• Client App Types: Standard “Android” app types (Play Store links) are not supported. Admins must exclusively use the Line-of-business app (LOB) type to package and deploy APKs directly.
• Mobile Threat Defense (MTD): The efficacy of MTD solutions depends on the specific vendor. Admins must verify if their chosen provider requires GMS for threat telemetry or Intune integration in non-GMS regions.

Communication Architecture and Latency

📅 Sync Intervals and Polling: Standard GMS-enabled devices receive remote commands (like a Wipe or Lock) in near real-time via push notifications. Without GMS, devices default to an 8-hour check-in interval.

However, newer versions of the management clients offer improved polling frequencies:

• Device Administrator: If the device is running Company Portal app version 5.0.5655.0 or newer, the client attempts to check for new tasks approximately every 15 minutes.
• Android (AOSP): If the device is running Intune app version 24.02.4 or newer, it typically polls every 15 minutes, though some specific tasks may still take the full 8 hours to process.

Note: These intervals can be further impacted by OEM-specific battery optimization settings and general device usage patterns.

🛡️ Impact

The primary impact for IT Administrators is an increase in Administrative Overhead and Security Latency. Because push notifications are absent, critical security actions—such as Full wipe, Selective wipe, Remote lock, or Passcode reset—may take up to 8 hours to execute if the device is not on a 15-minute polling cycle. This delay also applies to the deployment of new or updated applications.

Deprecation Notice: Administrators should be aware that Android Device Administrator (DA) is deprecated for GMS-enabled devices. While Microsoft continues to provide support and documentation for DA on non-GMS devices (specifically Android 15 and earlier), it is recommended to evaluate AOSP management or other modern alternatives where possible to ensure long-term supportability.

Official Source: Read the full article on Microsoft.com