Android Apps (Managed Google Play)

Deploy Android apps from Managed Google Play through the RealmJoin Portal: prerequisites in Intune, required permission, activation and subscribing apps.

The RealmJoin Portal brings Android to your app management. You can now deploy Android apps from Managed Google Play next to your Windows and macOS packages, in the same portal and with the same RealmJoin-managed groups.

Doing this by hand in Intune takes several steps: approve the app in Managed Google Play, wait for the sync, create groups and set up the assignments. With RealmJoin it takes one: paste a Google Play link. RealmJoin approves the app, syncs it into Intune, creates the Required, Available and Uninstall groups and assigns them for you. A few minutes later the app is ready to roll out.

From then on, Android apps are handled like every other managed package:

• One place for every platform. Your support and admin staff work with Windows, macOS and Android apps in the same portal, without switching to the Intune admin center.
• Familiar assignments. Add users or devices to the app's groups from the app page, exactly as for Windows and macOS packages.
• Always up to date. Google Play delivers updates automatically, so there is no version maintenance on your side.
• Built-in safety checks. RealmJoin checks that the app exists on Google Play and is not already in your tenant before anything is created.

How Android apps differ

Android apps work differently from the rest of the Package Store:

• There is no RealmJoin catalogue for Android. You pick any app on Google Play and paste its store link.
• Apps are always deployed as Intune managed apps (Managed Google Play store apps). Deployment via the RealmJoin Agent is not available.
• Google owns the version lifecycle. Updates are delivered by Google Play, so there are no versions, no Preview group and no Update Group for Android apps.
• Name, icon and description come from Google Play and cannot be changed in the RealmJoin Portal.

This is the first iteration of Android app management in RealmJoin. Scope and handling may still change.

Prerequisites

Complete all of the following before asking for the feature to be activated. RealmJoin checks the Managed Google Play connection when the feature is switched on and refuses activation if it is missing.

1

Connect Intune to Managed Google Play

This is done once per tenant by an Intune Administrator or Global Administrator.

1. Open the Microsoft Intune admin center.
2. Go to Devices → Enrollment → Android → Prerequisites → Managed Google Play.
3. Tick I agree and select Connect to Google now.
4. Sign in with the Google account that should own your Managed Google Play enterprise and complete the wizard.

Managed Google Play under Devices → Enrollment → Android (connected, status Setup)

Tenant administration → Connectors and tokens → Managed Google Play only shows the connection status and the scope tag for synced apps. It no longer offers the option to connect a Google account.

After connecting, the status shows Setup together with the linked account. On Tenant administration → Connectors and tokens → Managed Google Play the status must no longer show Not provisioned.

If you use a scope tag on that page, make sure the admins working with Android apps are assigned to it. Otherwise they cannot see the synced apps in Intune.

2

Grant the Graph permission to the RealmJoin Portal

The RealmJoin Portal app needs the Microsoft Graph application permission DeviceManagementConfiguration.ReadWrite.All. It is used to read the Managed Google Play connection status and to approve and sync apps into your Managed Google Play enterprise.

This permission cannot be granted from the Features tab in the RealmJoin Portal yet. Run the following script instead. Replace <YOUR-TENANT-ID> with your Entra ID tenant ID.

Grant-RealmJoinAndroidPermission.ps1

<#
.SYNOPSIS
    Grants the RealmJoin Portal app the Microsoft Graph application permission
    "DeviceManagementConfiguration.ReadWrite.All" (required for Android deployment via Managed Google Play).

.NOTES
    Run as Global Administrator or Privileged Role Administrator of the target tenant.
    Requires the Microsoft Graph PowerShell SDK:  Install-Module Microsoft.Graph -Scope CurrentUser
#>

$TenantId    = "<YOUR-TENANT-ID>"                         # e.g. 00000000-0000-0000-0000-000000000000
$PortalAppId = "b0130885-16be-4c6f-83de-5b1042b5d2e3"     # RealmJoin Portal
$GraphAppId  = "00000003-0000-0000-c000-000000000000"     # Microsoft Graph
$Permission  = "DeviceManagementConfiguration.ReadWrite.All"

Connect-MgGraph -TenantId $TenantId -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All" -NoWelcome

$portalSp = Get-MgServicePrincipal -Filter "appId eq '$PortalAppId'"
if (-not $portalSp) { throw "RealmJoin Portal service principal not found in tenant $TenantId. Onboard RealmJoin first." }

$graphSp = Get-MgServicePrincipal -Filter "appId eq '$GraphAppId'"
$appRole = $graphSp.AppRoles | Where-Object { $_.Value -eq $Permission -and $_.AllowedMemberTypes -contains "Application" }

$existing = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $portalSp.Id -All |
    Where-Object { $_.ResourceId -eq $graphSp.Id -and $_.AppRoleId -eq $appRole.Id }

if ($existing) {
    Write-Host "$Permission is already granted to RealmJoin Portal." -ForegroundColor Green
}
else {
    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $portalSp.Id `
        -PrincipalId $portalSp.Id -ResourceId $graphSp.Id -AppRoleId $appRole.Id | Out-Null
    Write-Host "Granted $Permission to RealmJoin Portal." -ForegroundColor Green
}

Disconnect-MgGraph | Out-Null

The script can safely be run more than once; it does nothing if the permission is already granted. Allow a few minutes for the new permission to take effect.

The Features tab may offer to downgrade DeviceManagementConfiguration.ReadWrite.All to DeviceManagementConfiguration.Read.All because it is no longer needed for health scripts. If you use Android apps, do not downgrade. Android app deployment stops working without the write permission.

3

Request activation

Android app deployment is a tenant feature that is activated by RealmJoin on request. Send a short request to [e-mail] and include your tenant ID or name.

The feature requires Intune deployment to be active for your tenant as well.

Add an Android app

1

Open the Package Store and select Android

In the RealmJoin Portal, open the Package Store and select Android in the OS filter. The filter only appears once the feature is activated.

Android OS filter in the Package Store

2

Copy the app's Google Play link

Find the app on Google Play and copy the link from the browser's address bar, for example for Microsoft Teams:

https://play.google.com/store/apps/details?id=com.microsoft.teams

Pasting only the package name (com.microsoft.teams) works as well.

3

Paste the link and subscribe

Paste the link into the Google Play link field and select Use Intune (managed). RealmJoin checks that the app exists on Google Play and that it is not already subscribed in your tenant, then opens the app's subscription page. Select Continue to start the subscription; there is nothing else to configure.

Google Play link pasted. If the app already exists, the portal links to it instead

Subscription page of a Managed Google Play app

4

Wait for the subscription to finish

RealmJoin now processes the subscription in the background and shows its progress:

1. The app is approved in your Managed Google Play enterprise and an Intune sync is started.
2. RealmJoin waits until the app appears in Intune. This can take a few minutes.
3. The deployment groups are created and assigned to the app.

Subscription in progress

When it is done, the app page shows the created groups and assignments.

Subscribed app with its RealmJoin-managed groups

The app is also listed under Packages; set the Platform filter to Android to show only Android apps.

Packages list filtered to Android

Deploy the app

RealmJoin creates three Entra ID groups per Android app and assigns them in Intune. The names follow your tenant's group naming template; with the default template they look like this (example for Microsoft Teams):

Group	Intune assignment	Purpose
app - Android - Microsoft Teams	Required	The app is installed automatically.
app - Android - Microsoft Teams (available)	Available	Users can install the app from the managed Play Store.
app - Android - Microsoft Teams (uninstall)	Uninstall	The app is removed from the device.

Add users or devices to these groups from the app's page in the RealmJoin Portal, the same way as for other packages (see Package Configuration and Assignments). Android apps get no Preview or Update group, because Google Play delivers updates.

Troubleshooting

Message in the RealmJoin Portal	What to do
Android deployment is not enabled for this tenant.	The feature has not been activated yet. See Request activation.
Managed Google Play is not connected	Intune is not connected to Managed Google Play. See Connect Intune to Managed Google Play.
… missing the DeviceManagementConfiguration.ReadWrite.All permission …	Run the permission script and wait a few minutes.
This app was not found on Google Play.	Check the link. It must be a play.google.com/store/apps/details?id=… link of a publicly available app.
… is already subscribed / is already being subscribed	The app already exists in your tenant or its subscription is still running. Open the existing app instead.

If a subscription does not finish, RealmJoin retries it automatically. If the app still does not appear after some time, check the Last sync status under Tenant administration → Connectors and tokens → Managed Google Play in Intune and contact [e-mail].