Silent Deployment of Mobile Endpoint Agent on Android Devices with Microsoft Intune
This guide explains how to silently deploy the ThousandEyes Endpoint Agent to your Android devices (Samsung, Zebra and Honeywell - currently on Open Beta - ) using Microsoft Intune. The agent automatically installs on enrolled devices, grants necessary permissions, applies critical battery settings, and registers with the ThousandEyes platform, all without requiring end-user interaction.
Prerequisites
Admin access to your Microsoft Intune portal.
Your target devices (Honeywell, Samsung, or Zebra) enrolled in Intune as Android Enterprise Fully Managed or Dedicated.
Your ThousandEyes account Connection String.
For Samsung devices only: Knox Platform for Enterprise Standard Edition
Mobile Endpoint Agent v-1.4.1 or higher
Step 1 - Verify Device Enrollment and Grouping
Ensure your devices are properly enrolled and organized into a dedicated group. This allows you to target policies precisely.
A. Verify Device Enrollment
In Microsoft Intune, navigate to Devices > Android.
Find your target device(s) in the list.
Confirm that the Ownership column shows
Corporateand the OS isAndroid (fully managed).
If your devices are not enrolled: Please follow the official Microsoft documentation for Enrollment.
B. Create a Dynamic Device Group for Your Devices
This is a best practice that automatically groups all your devices from a specific manufacturer.
Navigate to Groups > New group.
Group type: Security
Group name: [Manufacturer Name] Android Devices (e.g., Honeywell Android Devices, Samsung Android Devices, Zebra Android Devices)
Membership type: Dynamic Device
Click Add dynamic query.
Create a rule with the following syntax, replacing [Manufacturer Value] with the appropriate value:
Property: deviceManufacturer
Operator: Equals
Value:
For Honeywell: Honeywell
For Samsung: Samsung
For Zebra: Zebra Technologies
Click Save, then Create. The group will automatically populate with all devices from the specified manufacturer in your tenant.
Step 2 - Step 2: Add Required Apps from Managed Google Play
Before you can configure or assign apps, Intune must be made aware of them.
Navigate to Apps > Android.
Click + Create and select Managed Google Play app.
Search and Approve the following two applications:
ThousandEyes Endpoint Agent
Add one or all of the following, depending on your device manufacturer:
For Honeywell: Honeywell UEMConnect
For Samsung: Knox Service Plugin
For Zebra: Zebra OEMConfig (by Zebra Technologies)
After approving/selecting both, click the Sync button at the top of the Android apps page to force Intune to update its app catalog immediately.
Step 3: Assign Apps for Automatic Installation
Assign both apps to your device group so they install automatically on the devices.
In the Apps > Android list, click on ThousandEyes Endpoint Agent.
Navigate to Properties > Assignments > Edit.
Under the Required section, click + Add group and select your [Manufacturer Name] Android Devices group.
Click Review + Save.
Repeat these same steps for the OEM-specific apps you approved in Step 2:
For Honeywell: Honeywell UEMConnect
For Samsung: Knox Service Plugin
For Zebra: Zebra OEMConfig
Step 4 - Create and Assign the OEMConfig Policy
This policy is used to exempt the agent from battery optimization and allows Scheduling Exact Alarms. The specific OEMConfig app and JSON will vary by manufacturer.
Create a Device configuration by going to Devices > Configuration > Create.
Platform: Android Enterprise
Profile Type: Templates > OEMConfig
Apply the profile information:
Name: [Manufacturer Name] OEM Config (e.g., Honeywell OEM Config, Samsung OEM Config, Zebra OEM Config)
Description: Device configuration used to control sensitive permissions and make the app exempt from battery optimisations for [Manufacturer Name] devices.
Select an OEMConfig app:
For Honeywell: Honeywell UEMConnect
For Samsung: Knox Service Plugin
For Zebra: Zebra OEMConfig Powered by MX
Configure settings with: JSON editor.
Apply the following JSON, specific to your device manufacturer:
For Samsung Devices
Replace YOUR_LICENSE_KEY with your actual Samsung Knox License key.
{
"kind": "androidenterprise#managedConfiguration",
"productId": "app:com.samsung.android.knox.kpu",
"managedProperty": [
{
"key": "schemaVersion",
"valueString": "42.0.0"
},
{
"key": "profileId",
"valueString": ""
},
{
"key": "transactionTs",
"valueString": ""
},
{
"key": "kpePartnerLicenseKey",
"valueString": "YOUR_LICENSE_KEY"
},
{
"key": "kpePremiumLicenseKey",
"valueString": ""
},
{
"key": "verboseMode",
"valueBool": true
},
{
"key": "doPolicies",
"valueBundle": {
"managedProperty": [
{
"key": "doPoliciesIsControlled",
"valueBool": true
},
{
"key": "doAppMgmt",
"valueBundle": {
"managedProperty": [
{
"key": "doAppMgmtIsControlled",
"valueBool": true
},
{
"key": "doAppMgmtBatteryWhitelist",
"valueString": "com.thousandeyes.endpointagent"
},
{
"key": "doAppMgmtAutoLaunchApp",
"valueString": "com.thousandeyes.endpointagent"
},
{
"key": "doAppMgmtIsPermissionControlled",
"valueBool": true
}
]
}
}
]
}
},
{
"key": "profilePermissionControl",
"valueBundleArray": [
{
"managedProperty": [
{
"key": "profileSpecialAccessPermission",
"valueStringArray": [
"107"
]
},
{
"key": "profileSpecialAccessComponentName",
"valueString": "com.thousandeyes.endpointagent"
}
]
}
]
}
]
}For Zebra Devices
{
"kind": "androidenterprise#managedConfiguration",
"productId": "app:com.zebra.oemconfig.release",
"managedProperty": [
{
"key": "pkgConfig",
"valueBundleArray": [
{
"managedProperty": [
{
"key": "packagePackageNameName",
"valueString": "com.thousandeyes.endpointagent"
},
{
"key": "packagePermissions",
"valueBundleArray": [
{
"managedProperty": [
{
"key": "permissionName",
"valueString": "android.permission.SCHEDULE_EXACT_ALARM"
},
{
"key": "permissionState",
"valueString": "1"
}
]
}
]
},
{
"key": "packageFeatureVariances",
"valueBundleArray": [
{
"managedProperty": [
{
"key": "packageVarianceType",
"valueString": "2"
}
]
},
{
"managedProperty": [
{
"key": "packageVarianceType",
"valueString": "15"
}
]
},
{
"managedProperty": [
{
"key": "packageVarianceType",
"valueString": "16"
}
]
}
]
}
]
}
]
}
]
}For Honeywell Devices (Open Beta):
{
"kind": "androidenterprise#managedConfiguration",
"productId": "app:com.honeywell.oemconfig",
"managedProperty": [
{
"key": "schemaVersion",
"valueString": "1.0.0"
},
{
"key": "mdm_configuration",
"valueBundle": {
"managedProperty": [
{
"key": "Battery Optimizations Modes Whitelist",
"valueString": "com.thousandeyes.endpointagent:0"
}
]
}
},
{
"key": "system_configuration",
"valueBundle": {
"managedProperty": [
{
"key": "Grant Run Time Permissions",
"valueString": "com.thousandeyes.endpointagent:android.permission.SCHEDULE_EXACT_ALARM"
}
]
}
}
]
}
Assignments Tab: Assign this policy to your [Manufacturer Name] Android Devices group.
Click Review + Save.
Step 5 - Create and Assign the App Configuration Policy (Permissions & Settings)
This policy delivers your account settings to the ThousandEyes app and uses standard Android Enterprise commands to grant the required runtime permissions.
Navigate to Apps> Manage apps > Configuration.
Click** + Create > Managed devices**.
Basics Tab:
Name: ThousandEyes - App Permissions and Settings
Targeted app: Click Select app and choose ThousandEyes Endpoint Agent.
Settings Tab:
Auto-Grant the following permissions:
READ_PHONE_STATEACCESS_BACKGROUND_LOCATIONACCESS_COARSE_LOCATIONACCESS_FINE_LOCATION
Configuration settings format: Choose Use JSON editor.
Paste the following JSON, replacing
YOUR_CONNECTION_STRINGwith your actual ThousandEyes account Connection String.
{
"kind": "androidenterprise#managedConfiguration",
"productId": "app:com.thousandeyes.endpointagent",
"managedProperty": [
{
"key": "connection_string",
"valueString": "YOUR_CONNECTION_STRING"
},
{
"key": "skip_terms_of_service",
"valueBool": true
},
{
"key": "device_name",
"valueString": "{{SerialNumber}}"
},
{
"key": "auto_register_agent",
"valueBool": true
}
]
}Assignments Tab: Assign this policy to your [Manufacturer Name] Android Devices groups.
Click Review + Save.
Step 6 - Trigger Agent Registration and Start Services
After all required policies are deployed and show as successfully applied to your devices, you can start the agent registration process and enable agent services.
Verify policy adoption
Go to Devices > Managed devices > Configuration.
Select the policy you created.
Open Device/User status.
Confirm that the deployment status for your target devices is Successful.
Restart devices to trigger registration
Go to Devices > Android devices > Bulk device actions.
For OS, select **Android **(fully managed / work profile).
For Device action, select Restart.
Choose the devices you want to restart.
Select** Next**, then select Create.
After the devices restart, the ThousandEyes Endpoint Agent will automatically complete registration and start its background services.
Step 7 - Verifying the Agent Installation
After the device syncs, the entire process will complete automatically.
To verify the installation on Intune: Check the status of both configuration policies for a target device.
To verify the installation on the device and ThousandEyes UI, follow the instructions here
Last updated