I still come across a surprising number of Android phones and tablets enrolled in Microsoft Intune through the old "Android device administrator" method. Device Admin has been deprecated for years, yet it hangs on in plenty of environments because of legacy setups, processes that change slowly and BYOD scenarios. After December 31, 2024, Microsoft ends all Intune support, bug fixes and new features for device administrator management on Google Mobile Services (GMS) devices, and that makes this approach a dead end. If you haven't moved to Android Enterprise by then, your devices run unsupported and you lose important security and management capabilities.

Device administrator loses Intune support on GMS devices after 2024

Device administrator used to be the default way to manage Android, but it has officially been legacy for years. From 2025 on, Intune will technically still let you manage these devices. For GMS-based devices, though, Microsoft will provide no more support, no bug fixes, and no new features. Non-GMS scenarios aren't affected, but most organizations rarely have them. On top of that, Google has removed more Device Admin functionality with every Android release, and Android 12 and 13 already dropped key controls and policy support. What's left are devices that are unsupported, less secure and missing controls such as password enforcement or a full remote wipe.

Practical tip: Start by finding out what you actually have. In the Intune admin center, go to Devices → All devices and filter for devices whose "Management Type" is still "Android device administrator". Build a complete inventory and clean out test and retired devices before you plan the migration. You'll probably be surprised by what turns up.

Local processes (handoffs, awkward BYOD enrollment) can slow the migration down, but the biggest brake is usually that nobody explains it clearly to users. Tell them early that this isn't just a technical upgrade. It's required to stay supported and secure.

Android Enterprise offers four enrollment options for different use cases

Android Enterprise is now the standard for managing Android devices in companies and schools. Which enrollment type fits depends on how the device is used:

  • Personally-owned work profile: For BYOD, keeps work and personal data separate
  • Corporate-owned work profile: For company devices that may also be used privately
  • Fully managed: Company-only devices with no personal area
  • Dedicated devices: Kiosk, shared or single-purpose devices

Microsoft's documentation has a good overview and step-by-step instructions for each option (overview, deployment guide).

The migration helper does the heavy lifting but leaves a few traps

Microsoft now offers a migration helper that makes moving from device admin to work profile management easier (details here). It lives in Intune under Devices → Android → Android enrollment. The tool finds eligible devices, sends notifications to users and supports self-service migration. The device has to be compatible with Android Enterprise, and enrollment restrictions must not block it.

One thing that trips people up is that Intune's enrollment restrictions still permit new device admin enrollments while the migration is running. So I always check under Intune admin center → Devices → Enrollment → Device platform restriction that "Android device administrator" is blocked. That way no new legacy enrollments sneak in during the migration window.

# Check if Device Admin enrollment is still allowed (PowerShell Graph SDK, requires Intune Admin role)
Get-IntuneEnrollmentPlatformRestriction | Where-Object { $_.Platform -eq "androidDeviceAdministrator" }

Prerequisites: PowerShell 7, Microsoft.Graph.Intune module, Intune Administrator role or higher.

How you communicate decides how well this goes. The migrations I've seen run most smoothly were the ones where users knew what was coming, what would change and what the company could (and couldn't) see afterwards. With BYOD users this matters even more, so be open about privacy and where the data boundaries are.

A simple diagram shows the typical migration process

The Mermaid flowchart below shows how a device moves from device admin management to an Android Enterprise work profile, covering both the admin and the user steps.

flowchart TD
    Start["Device with Device Admin" ] --> Visibility["Identify device in Intune" ]
    Visibility --> Notify["Notify user" ]
    Notify --> Migrate["Start migration helper" ]
    Migrate --> Enroll["Re-enroll device with Work Profile" ]
    Enroll --> Done["Device now managed with Android Enterprise" ]

Figure: Migration process from device administrator to Android Enterprise work profile.

I recommend starting the move now instead of waiting for December

The end of 2024 may sound like there's still time, but migrations like this always take longer than planned, especially once users have to re-enroll their devices. If you have any Androids left under device admin management, take inventory first, review your enrollment restrictions and work out a transition plan that includes clear communication. From what I've seen, the technical side is the easy part. The bottleneck is getting users on board, communicating well and changing processes. If you move now, you won't suddenly find yourself without support, and your Android fleet ends up better managed and more secure.