Microsoft Intune setup for Zebra, Honeywell and other rugged devices

Intune manages our rugged Android devices as company-owned Android Enterprise devices and sets up our Windows rugged tablets and laptops with Windows Autopilot.

Before you start

Android devices need Google Mobile Services (GMS), and the MDM authority must be Microsoft Intune.

Our ET60 and ET65 are the Android models; Zebra's Windows versions are the ET60W and ET65W.

Which enrollment type to choose

Background: Android Enterprise enrollment for rugged devices.

Create the enrollment profile

For dedicated devices, go to Devices › Enrollment › Android › Enrollment Profiles › Corporate-owned dedicated devices and select Create profile. Microsoft's menus change from time to time.

1. Enter a name, such as the site.
2. Choose the Token type: Corporate-owned dedicated device (default) for devices without user sign-in, or Corporate-owned dedicated device with Microsoft Entra ID shared mode if staff sign in and out of shared devices.
3. Set the token expiration date (up to 65 years) and optionally a naming template, for example with {{SERIAL}}, then select Review + create.
4. Open the profile and select Token. It shows a QR code and a 20-digit token. Replacing or revoking it doesn't affect enrolled devices.

For fully managed devices, use Corporate-owned, fully managed user devices, where Intune has a Default Fully Managed Profile.

Enroll the device

Start from a new or factory-reset device (Zebra reset guide; for other brands see your model's troubleshooting guide, for example EDA52).

1. On the first screen, tap repeatedly until the QR reader opens. Android 9.0 and later have the reader built in.
2. Scan the QR code on the profile's Token page. If your screen won't scan, zoom the browser in.
3. Connect to Wi-Fi when asked and follow the prompts.

Without QR, enter afw#setup at the Google sign-in screen, install Android Device Policy, then scan the code or type the token. Zero-touch needs devices from an authorized zero-touch reseller: ask your reseller whether it can register yours. Microsoft gives the JSON for the portal's DPC extras field, with your token in it.

Don't restart the device until enrollment is complete. Then check that it appears in Intune with your required apps.

Set up kiosk mode with Managed Home Screen

Create a device restrictions profile (Platform Android Enterprise, Profile type Templates). Under Device experience, set Kiosk mode:

• Single app: one app, which must be added in Intune and assigned to the device group.
• Multi-app: a limited set of apps on Microsoft's Managed Home Screen. Assign Managed Home Screen and every listed app as required to the device group, or users can be locked out with "Contact your IT admin. This phone will be erased."

For multi-app kiosks, enable Leave kiosk mode with a 4–6 digit code. To service a device, press Back until Exit kiosk appears and enter the code; opening Managed Home Screen locks it again. See also Android kiosk mode for rugged devices.

Add maker settings with OEMConfig

Scanner, key and other maker features come through the maker's OEMConfig app. Add it from Managed Google Play, then go to Devices › Manage devices › Configuration › Create › New policy, choose Platform Android Enterprise, Profile type OEMConfig, and select the app.

Assign one OEMConfig profile per non-Zebra device. Profiles over 500 KB aren't deployed, and two profiles setting the same top-level group both go into Conflict. Intune can also deploy Zebra LifeGuard firmware updates to dedicated and fully managed devices (Tenant administration › Connectors and tokens › Firmware over-the-air update). It needs extra Intune licensing and Zebra's LifeGuard entitlements. Zebra's side: StageNow and OEMConfig.

Enroll Windows rugged devices with Autopilot

Autopilot sets up the maker's Windows installation without reimaging, joins Microsoft Entra ID and enrolls the device in Intune. First the device is registered to your tenant:

• By the maker or reseller, Microsoft's preferred route. Getac registers devices once you give it your tenant ID and domain and accept its consent; Panasonic offers a TOUGHBOOK Autopilot Enrolment and Provisioning service.
• By you: run Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv in PowerShell, or -Online during setup (Shift + F10, then powershell.exe). Import the CSV (up to 500 rows; edit it in Notepad, not Excel) under Windows Autopilot devices and select Sync. Microsoft recommends this only for testing or limited scenarios.

The newer Windows Autopilot device preparation needs no registration; it needs Windows 11 24H2 or later (22H2/23H2 with KB5035942) and supports only Microsoft Entra join. The Toughbook 55 mk3 and G2 mk3 manuals list a DFCI Configuration menu in the Setup Utility, which lets Intune control some of its settings. Getac says its SmartUpdate tool integrates with Intune and asks you to deregister a device from Autopilot before a repair.

Common problems

• QR reader doesn't open: reset the device and tap the first setup screen repeatedly.
• Enrolled but no policies: a device restarted during enrollment can look enrolled without policies. Reset it and enroll again.
• Fully managed sign-in blocked: exclude the Microsoft Intune cloud app from Conditional Access policies that require compliance.
• Repaired Windows device shows another company's sign-in: Getac explains that the replacement motherboard is registered to another organization and refers you to Microsoft Support.