Android enterprise APK stuck at Initiated in kiosk mode due to Play ProtectSolved

Hi @wyatt_simmons ,

For Android Enterprise Device Owner devices, Hexnode can silently install enterprise apps without user interaction. However, Google Play Protect runs at the Android system level. If Play Protect flags an APK as unrecognized or unverified, Android may display a security prompt during installation. In kiosk mode, that prompt may not be accessible, so the installation cannot complete.

In Hexnode, this can appear as the app remaining at “Initiated” or “Pending”, or with messages such as “The user may have aborted the app installation session.”

Since the app is already configured as a required app and a kiosk app, check the following:

1. Go to Policies > Android > Restrictions > Advanced.
2. Under Allow App Settings, enable:

   • Install apps
   • Install apps from unknown sources

3. Save and associate the policy with the affected devices.

Temporarily exiting kiosk mode does not delete app data, app settings, or existing configurations. It only gives you access to the regular Android interface for troubleshooting.

Regards,
Isabel Lora
Hexnode UEM

We already had the app added in both places, and the policy has Install apps and Install apps from unknown sources enabled. We also tried exiting kiosk mode, and that didn’t wipe anything. But even after assigning the policy again, the app is still stuck at Initiated.

I tested the APK on an unmanaged device as well. It installs manually, but I get the Play Protect warning before the installation. Since the other enterprise apps are installing normally, this seems to be specific to this APK.

Yes, that makes it look more like an issue with the APK itself. The Install apps from unknown sources setting allows enterprise APKs to be installed, but it does not override Google Play Protect. If Play Protect is flagging the APK, Android can still require confirmation before completing the installation.

I’d suggest submitting the APK through Google’s Play Protect appeal process so Google can review the APK. Once the warning is cleared, try the installation again through Hexnode.

One other thing to check: if the device shows “Access Denied” or “Blocked package”, run a device scan in Hexnode and check the Applications subtab for blocked packages. If the required package is listed there, add its bundle ID under Kiosk Lockdown > Android Kiosk Lockdown > Background Apps. This applies to blocked-package issues and would not bypass a Play Protect warning.

Regards,
Isabel Lora
Hexnode UEM