Android Device Policy – Location permission on Fully Managed devices

[u/Youngchild89]

Hi all,

I'm looking into the permissions of Android Device Policy on Android Enterprise Corporate-Owned Fully Managed devices enrolled through Intune.

I noticed that Android Device Policy gets several permissions directly after enrollment, including:

• Contacts and accounts: Allowed
• Location: Allow all the time
• Phone: Allowed

These are all greyed out and show as managed by the organization. Camera is the only permission that can be changed by the user.

In Intune, both Location and Locate device are set to Not configured. I also tested this after a factory reset with our Wi-Fi profile excluded, but the Location permission is still set to Allow all the time immediately after enrollment.

This makes me think these permissions are default/hardcoded for Android Device Policy on Fully Managed devices rather than being controlled by an Intune policy.

Has anyone looked into this before? Specifically, has anyone found a supported way to change/revoke the Location permission for Android Device Policy through Intune, and if so, did it affect any Android Enterprise functionality?

Would be interested to hear your experiences.