This enrollment error could be an outdated version of Android

[spalmesano0]

Reported by pingali on Slack.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

Pull request overview

Updates the Android enrollment error messaging on the OTA enrollment page to suggest that failures to fetch an enrollment token may be due to an unsupported Android version.

Changes:

• Updated the error description shown when fetching the Android enrollment token fails (fully managed flow).
• Updated the error description shown when fetching the Android enrollment token fails (non-fully managed Android flow).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.84%. Comparing base (77639d5) to head (db4ee86).
⚠️ Report is 44 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #43021      +/-   ##
==========================================
- Coverage   66.85%   66.84%   -0.01%     
==========================================
  Files        2578     2578              
  Lines      206880   206869      -11     
  Branches     9166     9168       +2     
==========================================
- Hits       138312   138289      -23     
- Misses      55995    56007      +12     
  Partials    12573    12573              

Flag	Coverage Δ
backend	68.61% <ø> (-0.01%)	⬇️
frontend	54.78% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[MagnusHJensen]

You need to fix what the AI suggested, else the page is broken for all occurrences.

On a further note, I'm not entirely convinced this is true.
The code path for creating an enrollment token, does not take any device data into consideration, so I would have a hard time seeing how Android/Google could say it can't create one, due to Android 14.

As these enrollment tokens aren't unique to a certain device per say.

Here us the code for what we send on this request:

fleet/server/mdm/android/service/service.go

Lines 589 to 611 in c287bd0

	enrollmentTokenRequest, err := json.Marshal(enrollmentTokenRequest{
	EnrollSecret: enrollSecret,
	IdpUUID: idpUUID,
	})
	if err != nil {
	return nil, ctxerr.Wrap(ctx, err, "marshalling enrollment token request")
	}
	personalUsageSetting := "PERSONAL_USAGE_ALLOWED"
	if fullyManaged {
	personalUsageSetting = "PERSONAL_USAGE_DISALLOWED"
	}
	token := &androidmanagement.EnrollmentToken{
	// Default duration is 1 hour
	AdditionalData: string(enrollmentTokenRequest),
	AllowPersonalUsage: personalUsageSetting,
	PolicyName: fmt.Sprintf("%s/policies/%d", enterprise.Name(), android.DefaultAndroidPolicyID),
	OneTimeOnly: true,
	}
	token, err = svc.androidAPIClient.EnterprisesEnrollmentTokensCreate(ctx, enterprise.Name(), token)
	if err != nil {

[spalmesano0]

You need to fix what the AI suggested, else the page is broken for all occurrences.

Ah, just saw that and committed those. I guess I thought the two different quote sections were for line breaks.

On a further note, I'm not entirely convinced this is true. The code path for creating an enrollment token, does not take any device data into consideration, so I would have a hard time seeing how Android/Google could say it can't create one, due to Android 14.

Tough for me to test, since all my Android devices are on supported versions. From what the customer reported, it sounded like these errors may be showing because of an outdated device.

What would happen if an old Android device could load this page? Would it still be able to enroll in Fleet?

[MagnusHJensen]

It can fine load the page and generate the token.

It also successfully enroll via the Work profile flow

[spalmesano0]

I'll close this then, since it doesn't seem appropriate to add the error message.