Configure Surface Duo 2 with OEMConfig

A lot of device manufacturers use Android Operating System. Some of these OEMs (Original Equipment Manufacturers) offer specific device configurations for their devices. Before Android Enterprise, each OEM needed to provide custom images and patches, and configurations. EMM (Enterprise Mobility Management) vendors had the issue of which OEM they should support. Before supporting an OEM, the EMM needed to implement an option to configure the OEM-specific configuration options. For that reason, Google introduced the OEMConfig, a managed configuration for OEM using an app that applies vendor-specific configurations to a device.

Microsoft Surface Duo and Duo 2 did not have a device configuration previously, but in 2022, the Microsoft Surface Duo 2 got the option to configure hardware options with OEMConfig.

When you are creating a configuration, you might ask yourself, how to find out the configurable options for a specific device? And in our example, how will it look for our Surface Duo 2? But before we’ll answer this. Let’s go a small step back and discover how OEMConfig works.

To apply an OEMConfig, you need to install an OEMConfig app first. This app uses a specific application configuration that allows setting the hardware-related settings on the device. For Microsoft Surface Duo 2, the app is called “Microsoft Surface OEMConfig”. Please note that the application needs to be added from Managed Google play if it was not done before.

Every application can have a configuration. The OEMConfig-related applications, are unique. The vendor apps offer the possibility to configure device-related settings. Please keep in mind, it does not create these settings as a “regular” application configuration. OEMConfig is using a device configuration profile instead, as you can see below.

To create an OEMConfig profile, select a name and the app. In our example, it will be A_MS_Surface_Duo2_Config as the profile’s name and Microsoft Surface OEMConfig as the OEMConfig application as the screenshot below shows.

If this is done, the configuration settings of the Surface Duo2 devices are listed and ready for configuration. Here are the options:

Camera
Microphone (MIC)
NFC
Wireless LAN
Bluetooth

Let’s focus on a device that is already enrolled in Microsoft Endpoint Manager (MEM) / Intune. I enrolled our Surface Duo 2 as a “fully managed device with work-profile”, formerly known as COPE (corporate owned, personally enabled–you can find more information on the Android terminology here: Android Enterprise terminology | Google Developers)

In our example, I created a group, “A_MS_COPE”, which hosts all the Surface Duo 2 Devices. With this group, you can assign compliance policies, app assignments, and other configurations, but in our example, we need this group to install the “Microsoft Surface OEMConfig” application prior to the assignment of our OEMConfig Policy.

To install the “Microsoft Surface OEMConfig” application, we need to assign it to the group containing the Surface Duo 2 devices. As a mandatory component to process hardware-related settings, we will install the app as required.

Now, we’ll block Bluetooth on the Surface Duo 2 Device with the help of the OEM Configuration. Using the profile ” A_MS_Surface_Duo2_Config”.” created above, we need to open the configuration dialog to adjust the Bluetooth option with the Microsoft Surface OEMConfig section. Select “false” in the Bluetooth option.

Lastly, we need to assign the configuration to our group of Surface Duo 2 devices. In the assignments section, select Add groups and add the “A_MS_COPE” group.

You can check if the configuration policy was applied by selecting the Surface Device and then App configuration in the devices section. Remember, even if it created the OEMConfig as a configuration profile, it is an app configuration.