Install AFW Account error

[TehArchitect]

I have a LG Nexus android phone I am having issues with, I have 3 other identical phones that have worked fine. This one will not install the AFW account under the systems manager app. I have tried factory resetting  the phone many times with the same result. Google is also displaying a message that says I was signed out of my account and I need to re sign-in.

Any help would be greatly appreciated.

Thanks

[PhilipDAth]

I have seen this happen randomly on many phones.

Try going into the SM app on the phone and click the Afw account link, so it tries to sign up for an account again.  This usually fixes it.

[JoshH]

Hi, I am having this problem also, clicking the AFW link in settings in the SM app does nothing. It just says its activating then closes but the AFW icon remains as an orange triangle.

I also am having an error approving new apps from the Meraki dashboard, I just get 'Error Approving App'.

Under MDM settings i have got a meraki managed android for work account enrolled - Should I try unrolling and re enrolling? Will this break anything already enrolled with AFW accounts?

Thanks!

[PhilipDAth]

I have a support case open with a related issue. A fix is due to be released during January. Hopefully it will fix your issue as well.

[Brickcounter]

Any ideas when this fix will be released in January ? I cannot now seem to add any of our Motorola devices into the SM which kind of makes it not very usable. The 'install AFW account' just remains at a yellow triangle even after another request to add it again is made. Are Android devices just poor cousins to Apple here?  I guess it must be much harder to develop such systems for Android with the large variety of devices and how they are setup.

[PhilipDAth]

I just requested an updated ETA on my support ticket (02207637) for the deployment of this fix.  I'm not expecting to get an answer but you never know ...

[Ponceme]

I opened a case for this as well. This is holding back a major mobile deployment atm.

[DCooper]

Stay tuned. Escalations bumped this bug up so you should be hearing from them in a day or two. If not ping me! Currently your the only case with the issues so if others are experiencing the same issue please open a ticket.

[Ponceme]

I opened a ticket as well. Case 02309495. I was able to get two devices to somehow enable the afw account (I kept attempting to manual add it and it took) but now on this third device it wont take at all.

[DCooper]

Ok, if you get a chance reference @PhilipDAth case 02207637 which has the bug information in it. If they troubleshoot and find it to be the same issue they will tie your case to it. This does help us out internally. Thanks!

[Ponceme]

Done!

[PhilipDAth]

@DCooper how you can say only one person is experiencing the issue when already two of us have posted it is affecting us, and our case numbers?

I have also verified the issue with another Organisation, but did not bother logging a ticket for that one.

The process (or complete lack of it) for development and support to interact enough with each to give customers updates on their ticket is - terrible.

I would appreciate your "Kudo" on my post tomorrow - not because I want to win swag - because I want to highlite this serious internal issue inside of Meraki so we can try and get it fixed to save other customers the frustration.

https://community.meraki.com/t5/Community-Announcements/Happy-New-Year-What-are-your-Networking-Reso...

[DCooper]

I said "Currently your the only case with the issues". Which doesn't mean your the only person or company with the issue as I am sure others may affected that may not be a part of this community or have an open case. It was just the only documented ticket with the issue that had the bug information tied to it. 

[Brickcounter]

So I noticed that the SM Meraki app on the play store was re-issued yesterday. I now get version 4.0.5 when I install it from the Add Device section of Systems Manager. However the same problem still occurs for me on a Motorola G5, in that is unable to apply the AFW account. Even after many attempts . It does appear to work ( after a few attempts ) on the Motorola E4 however. 

So this is my experience on various Motorola devices in Device Owner Mode :

Moto G4 - Has never worked

Moto G5  - Used to work very well. Now cannot add the AFW account ( Android 7.0 )

Moto E4 - Now works . ( Android 7.1.1 )

I hope there is more that Meraki can do on this issue.

[DCooper]

@BrickcounterI would recommend opening up a ticket  if you haven't for this issue your experiencing.

[DanDanDan]

Just had the same problem on 20 Moto G5 

If you push out Google Play Services (with a google account or install the apk via custom apps) should fix he problem on most devices.

This is because the Play Store needs to be on 11+ for AFW  account to be pushed out and the Moto G5 is on 7.0. Install google play services fixes this.

Hope it helps

[Ponceme]

Thanks however there was a bug at the time of this post that was not allowing AFW to be deployed at all. They release a new version of the Manager with the fix. Its been working great and setting up real quick.

[Brickcounter]

Still not working for me on Moto G5 devices. I have a support case opened with Meraki at the moment as suggested above .

But I note that 'Google Play Services' is only on 9.8.79 on the Moto G5 . 

The article :

https://documentation.meraki.com/SM/Deployment_Guides/Android_Enterprise_Deployment_Guide_(Android_f...

says it should be 11.0.4 so maybe that is the issue

[Brickcounter]

@DanDanDan  You are correct. I side loaded latest version of 'Google play services' from APKmirror and the Moto G5 now gets the AFW account. Kudos to you.

Bit of a faff having to sideload an app first but gets the job done

[Mr_Grinch]

Forgive me for sounding like a total buffoon (I mainly work on the "Other Side" - I was dragged by the collar into Android) but if you have to get a new app to get SM to work properly with AfW, and you use AfW to install the apps you need (in a Device Owned situation - which we want to be) this is a circular firing squad, no?

[Brickcounter]

@Mr_GrinchI cannot comment on how Apple devices work - I don't have any of those. I can see how this may look like a 'Catch 22' situation but with Android it is possible to manually download the Google Play services app and install it without the need for a google account or before the AFW account is added. You need to jump through some hoops first but worth the final outcome to get a working 'device owned mode' Android phone.

[Mr_Grinch]

I have the same issue with Samsung Galaxy S6 (Android 7.0)

I'm about to test with a Galaxy S7. Will post updates with results.

[Mr_Grinch]

Same thing with Galaxy S7 with Android 7.0 - won't set up AfW from SM

[PeterJames]

Device: Pixel 2 XL

Android: 8.0
Google Play Services: 11.9.47 (For both local and work profile).

Type of Enrolment: BYOD / Work Profile

Problem: 'Install AFW account' -> Will not install.

[Ponceme]

Are you setting this in Device Owner mode or Work Profile?

[PeterJames]

@Ponceme Work Profile. Updated post.

[Ponceme]

Thanks, I don't have any BYOD in my environment. However I did set it up once for testing. If you set the AFW (Google Email) on the Device and then push it, then go into Google Accounts on the Phone and manually enter the Email Account for AFW, I think that's how I got mine to work. Good Luck.

[PeterJames]

@Ponceme Thanks.

I do not actually have any google or managed meraki accounts setup, just auto-enrolment. Lets see if that makes a difference.

E.g.

Thank you,
Peter James

[Ponceme]

for AFW profile to work, there needs to be an associated Google or Meraki Managed account. A Meraki managed account is a gmail account that is linked to Meraki... i.e. *****@gmail.com. This will be associated with every device or you can create other ones. Once you enroll a device, then go to clients and associate the new device with the gmail account as device owner. 

[PeterJames]

@Ponceme 

Changed the below Meraki setting, re-installed the SM App. Moved to install work SM App. Still no joy as below.

[Ponceme]

did you assign the account to the device in the Client Page?

[PeterJames]

@Ponceme Yes. But when I went on to the client page it was already assigned.

I will try re-installing the App again with no accounts to see what shows up on the client page.

[Ponceme]

You cant change that owner to the @gmail.com account you set up?

[PeterJames]

@Ponceme The client page has no option to change / edit / remove the Owner of the device.

[PeterJames]

@Ponceme Interesting, no option to assign to a user.

[Ponceme]

Go to Organization>MDM

What does it say under Android For Work

[PeterJames]

@Ponceme

Enrolled: Yes

Type: Meraki managed

Admin email: *Removed*@gmail.com

But I want to use Meraki Managed, or no accounts as these will be shared devices. What I have found interesting is that on the client page there is a line:


This is also the case for my Nexus 5 that does not work.

[PeterJames]

Google: Android enterprise Help

https://support.google.com/work/android/answer/6174145?hl=en

- "Devices with Android 5.0 Lollipop and later that have work profile support."

[Ponceme]

That Gmail is the Managed Profile. 

[Ponceme]

Open a Case with Meraki, they will ask you to go through the whole setup process from start to finish in a video. However, they will look at your configuration first.

[PeterJames]

@Ponceme Thank you!

I had asked for support from their sales team initially but gained no reply. My goal is to understand the good / bad and the ugly with it.

They have confirmed my setup is correct.

Thank you,
Peter James

[Ponceme]

Weird, I was able to get the profile to work without a problem. Android 7.1.1 Samsung Tab E.

My production units are in Device Owner Kiosk Mode and its working amazing. No though process to get to the application the users need as well as no chance for them to do anything except work on the device.

[MarkC]

Also having the same issue with a couple of Motorola G4's and G5's that were working but after a format and remove from Meraki wont install AFW.

[MRCUR]

I'm also having this issue with an Android 5.1 device. I installed the SM app via ADB and set the owner to SM with the Meraki provided ADB command from here: https://documentation.meraki.com/SM/Device_Enrollment/Enabling_Device_Owner_Mode_using_Android_Debug...)

The devices enrolls correctly but never asks for authentication. I also cannot select the Meraki managed AfW Gmail account as the owner for the device in Dashboard. Support says that without an AfW account on the device, Sentry WiFi won't work (which is really the only reason I'm trying to get this device enrolled). 

[LSTM-Jim]

I'm having the same issue too installing through ADB to Android 5.1.1 device.

Trying to force SM to "Install AfW Account", reports in the event log:

Feb 12 09:24

Generate AfW account response received

-

status: Success

However the status remains:

Android for Work Account:

No

Device has been reset and re-enrolled several times to try and resolve. Logged a ticket and currently waiting for a follow up.

[apnnel]

I have the same issue with our Android 5.1.1 devices. What I do to workaround is temporarily add a generic google account to get a play services update first (from version 7.5.71 to 11.9.75.)  I've opened a case as well, 02421916.

So normal procedure - install & make SM admin with ADB, then add a regular google account. Let it sit for a while, eventually the Play services update will download and install (verify from application manager). At that point I remove the generic google account, then I can open up SM and do the enrollment without fuss.  

One method that may be faster is to go ahead and do the SM enrollment before adding the regular google account.  After it's added, go into SM and tap the yellow triangle to request the AFW account. It might just be my imagination but it seems to make the play services update happen sooner, if I'm in a hurry.

[MRCUR]

@apnnel This worked for me to get an AfW account installed as well. I tried updating GPS via ADB but it didn't work, so I added a generic account and then it updated. Unfortunately Sentry WiFi still won't work for us, so perhaps AfW accounts aren't the underlying issue there. 

[Andrew]

Well,

I guess I'm trying this now.

I have a case 03177528 that I just open.
I have several Acer Iconia One 10 tablets that fail at AfW install and/or fail to ever boot up again after SM is installed.

I get an endless cycle of startup, optimizing apps, startup...

[apnnel]

For what it's worth, I can no longer get AfW accounts to install on any of my 5.1.1 devices. I'm not having issues booting up though, everything else seems to work fine. Unfortunately I don't have any android 7+ devices to test at the moment. I have a case open as well, I need to collect logs and send them in.  I'm going to try it with an older SM apk and see if it makes any difference.

[apnnel]

Just tested with systems manager version 4.0.6, and the afw account installs just fine. 

[Andrew]

So, I did successfully sideload SM and got the AFW account to install.

However, the device still gets caught in the startup cycle I described once I power it down and restart it.

So, I guess it was partially successful, but it still seems like the SM install effectively bricks the device.

Any thoughts?

[Cyrilm]

same issue here   : 

https://community.meraki.com/t5/Endpoint-Management-Systems/problems-when-installing-missing-applica...

[FOX]

I Still has this issue in 2019... I can solve it by doing the following :

On the system manager > Monitor > Overview --> Click on Sync button next to Android Enterprise Apps

Save it, reload the settings in Meraki SM app on the phone

Second is :

System Manager > Monitor > Devices

click on youre device, Edit details and change the owner. Save it

Change the owner back in details to the original one and reload the settings in Meraki SM.

Click on the triangle again and it should be working.

[Austin]

I struggled with this for awhile, so wanted to pass on how I overcame it.

I was having an issue where the profile would be pushed and everything would be successful, except I couldn't install the AFW, so none of the authorized apps in the Play Store would download (the user didn't have an Android Enterprise account). I finally noticed that, when I looked at the device owner in System Manager > Owners, he had three of the red G symbols next to his name, indicating he had many Android Enterprise accounts. 

I deleted the owner, created him again, wiped the phone, and when I authenticated with his user, AFW installed and all of the apps in the Play Store finally downloaded.

[Andrei_Gogiu]

We were enrolling devices in Device Owner Mode option A (When prompted for a Google account during device setup, enter afw#meraki. This will automatically install the SM app.) And we encountered this issue described here. We were unable to deploy any apps on the managed phones due to that.

After several attempts, we tried enrolling devices using Device Owner mode option B (In the device's setup wizard, tap the screen 6 times then scan this QR code. The SM app will be auto-installed and auto-enroll the device in the default Network.) and this worked for us.

The issue seems to be related to the version of Play services on newer phones.