Android required app not installing silentlySolved

Hello @remy-parker ,

For Android Enterprise devices, Required App installations and app restrictions depend on specific policy configurations.

First, ensure the policy attached to the device does not block the app installation components required by Managed Google Play:

1. Navigate to Policies > Android > Restrictions > Advanced Restrictions > Allow App Settings.

2. Enable Install apps.

3. Enable Google Play Store.

4. Save the policy and associate it with the target devices.

If either Install apps or Google Play Store is disabled, Hexnode UEM and Managed Google Play cannot silently install required applications.

To prevent users from installing unauthorized apps, you can use either of these approaches:

• App allowlisting: Navigate to Policies > Android > App Management > Blocklist/Allowlist and allowlist only your required app and any essential system apps. This hides or blocks unapproved apps on supported Android Enterprise devices.

• Android Kiosk Mode: Navigate to Policies > Kiosk Lockdown > Android Kiosk Lockdown and configure a Single App or Multi-App Kiosk. This is the recommended approach if the device needs to be strictly locked down to a controlled app experienc

Regards,
Simon Scott
Hexnode UEM

The app was still not installing silently through the Required Apps policy. The device displayed a Hexnode notification stating the app needed to be downloaded. Tapping it opened Google Play, where I had to press “Install” manually. On other Android Enterprise setups, this same type of app installs by itself.

For a Managed Google Play app deployed via a Required Apps policy, silent installation should execute automatically on Android Enterprise devices, provided the enrollment and Managed Google Play account setup are healthy.

If the device routes you to Google Play for manual installation verify the following:

• Confirm the device’s date, time, and time zone are strictly accurate.

• After correcting the system clock, re-initiate work profile creation (for Profile Owner) from the Enrollment Details section under the device details page in the Hexnode UEM portal.

• Ensure the policy applied during setup does not block account changes before the work profile or managed Google account finishes provisioning.

• If you are utilizing Android restrictions, ensure Modify Accounts/Users is allowed until provisioning completes.

An incorrect system clock breaks Google authentication and SSL/TLS validation during Managed Google Play account creation. When this happens, silent app installation fails and falls back to manual installation prompts.

Correcting the device’s date and time fixed it. After re-initiating work profile creation, the Managed Google Play account finished setting up, and the required app installed silently without launching Google Play.

I then locked the device into kiosk mode, but I hit a new issue: when the user signs into the app, it attempts to open a browser for verification. Is it because the browser was not allowed in kiosk policy?

Yes. In this case, you need to add the browser used for authentication as a Background App in your Android kiosk policy.

Here is the standard workflow to resolve this:

1. Run a device scan and review the device’s Applications tab to identify the blocked package.
2. Identify the exact browser package name the main application is attempting to launch.
3. Go to Apps > +Add Apps > With Bundle ID and add the package.
4. Open the kiosk policy applied to the device.
5. Navigate to Kiosk Lockdown > Android Kiosk Lockdown > Background Apps.
6. Add the browser app and save the policy.

Background apps run behind the kiosk interface without appearing as normal, user-accessible icons in the kiosk launcher. This is required when a kiosk app depends on a third-party browser or supporting app for authentication, scanning, printing, or payment processing.

I plan to keep most devices in kiosk mode, but a smaller set of devices will use app allowlisting instead. Can background apps be configured for devices with allowlist policy too?

No. Background Apps is a kiosk-specific configuration in Hexnode UEM and is not available under allowlist policy.

Allowlisting dictates which apps are visible or permitted to run, but it does not provide the hidden background execution behavior of Android Kiosk Mode. If those devices require a supporting browser to run silently in the background, kiosk mode remains the required setup for them as well.