{
  "displayName": "Enterprise App - Device Identity Config",
  "description": "Pushes Serial Number and IMEI to the enterprise app via Managed Config. Intune substitutes {{SerialNumber}} and {{IMEI}} with actual device values before delivery. App reads values via RestrictionsManager — no READ_PHONE_STATE permission required.",

  "platform": "Android Enterprise",
  "profileType": "Fully Managed, Dedicated, and Corporate-Owned Work Profile",

  "targetedApp": {
    "packageId": "com.yourcompany.yourapp",
    "_note": "Replace with your actual app package name"
  },

  "configurationSettings": [
    {
      "key": "device_serial",
      "valueType": "String",
      "value": "{{SerialNumber}}",
      "_note": "PRIMARY identifier. Intune injects actual serial. Works on ALL Android versions."
    },
    {
      "key": "device_imei",
      "valueType": "String",
      "value": "{{IMEI}}",
      "_note": "SUPPLEMENTAL. Intune injects actual IMEI. Works on ALL Android versions including 10+."
    },
    {
      "key": "device_name",
      "valueType": "String",
      "value": "{{DeviceName}}",
      "_note": "Human-readable device name for logging and admin console display."
    },
    {
      "key": "intune_device_id",
      "valueType": "String",
      "value": "{{DeviceId}}",
      "_note": "Intune device GUID. Useful for cross-referencing Graph API records."
    },
    {
      "key": "enrolled_upn",
      "valueType": "String",
      "value": "{{userPrincipalName}}",
      "_note": "Enrolled user email/UPN. For logging only — not used for whitelist check."
    }
  ],

  "assignments": {
    "target": "All Devices",
    "_note": "Or assign to a specific Entra ID device group if needed."
  }
}