{
  "displayName": "Enterprise App - READ_PHONE_STATE Permission (Android 6-9 only)",
  "description": "Grants READ_PHONE_STATE permission to the enterprise app on Android Enterprise Fully Managed devices running Android 6-9. Allows the app to read IMEI directly via TelephonyManager. Has no effect on Android 10+ where IMEI access is blocked at OS level regardless of permissions.",

  "platform": "Android Enterprise",
  "profileType": "Fully Managed, Dedicated, and Corporate-Owned Work Profile",

  "permissionGrantPolicies": [
    {
      "_note": "This is the recommended approach for Android Enterprise Fully Managed.",
      "_note_2": "Set permission grant policy to Auto Grant for READ_PHONE_STATE.",
      "appPackageId": "com.yourcompany.yourapp",
      "_replace": "Replace with your actual app package name",
      "permissions": [
        {
          "permission": "android.permission.READ_PHONE_STATE",
          "action": "autoGrant",
          "_what_it_allows": [
            "TelephonyManager.getImei()       — read IMEI (Android 8+, blocked on 10+)",
            "TelephonyManager.getDeviceId()   — read IMEI (Android < 8, deprecated)",
            "Build.getSerial()                — read Serial Number (Android 8-9, blocked on 10+)",
            "Build.SERIAL                     — read Serial Number (Android < 8, deprecated)"
          ],
          "_android_version_behaviour": {
            "Android 6-7 (API 23-25)": "autoGrant works. App can read IMEI via getDeviceId(). Serial via Build.SERIAL.",
            "Android 8-9 (API 26-28)": "autoGrant works. App can read IMEI via getImei(). Serial via Build.getSerial().",
            "Android 10+ (API 29+)":   "autoGrant has NO effect. IMEI/Serial still blocked. Use App Config Policy instead."
          }
        }
      ]
    }
  ],

  "omaUriSettings": [
    {
      "_note": "Alternative OMA-URI approach if permission grant policy UI is not available.",
      "_note_2": "Use this if your Intune version requires manual OMA-URI configuration.",
      "name": "Grant READ_PHONE_STATE to enterprise app",
      "description": "Auto-grants READ_PHONE_STATE permission on Android 6-9 for IMEI access",
      "omaUri": "./Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/com.yourcompany.yourapp/AppSettingPolicy/android.permission.READ_PHONE_STATE",
      "dataType": "String",
      "value": "Grant",
      "_replace_package": "Replace com.yourcompany.yourapp with your actual package name"
    }
  ],

  "assignments": {
    "target": "All Devices",
    "_note": "Or scope to a device group containing only Android 6-9 devices if you have mixed fleet."
  }
}