Zebra devices with Intune: LifeGuard OTA firmware updates, OEMConfig and errors to watch

Zebra's rugged Android devices enroll in Intune like any corporate-owned Android Enterprise device, but three Zebra-specific pieces decide whether a rollout goes smoothly: the right OEMConfig app, the LifeGuard Over-the-Air (LG OTA) connector for firmware, and knowing what each one's statuses mean. In this post I'll set up all three and explain the errors you'll meet.

How the pieces fit together#

Intune creates and monitors firmware deployments through Zebra's APIs; Zebra's services check entitlements and compatibility, host the updates and install them. So some errors are Intune's, many are Zebra's.

Prerequisites#

• Enrollment type: LG OTA updates are supported on Android Enterprise corporate-owned dedicated (COSU) and fully managed (COBO) devices.
• Managed Google Play connected to the tenant.
• Licences: Microsoft lists LG OTA as requiring Microsoft Intune Plan 2 or an additional subscription, plus the Zebra licences and entitlements for LifeGuard.
• Roles: the Mobile apps permission (app configuration policies) and the Android FOTA permission (firmware deployments).
• Android versions: Microsoft notes that Zebra devices don't support Android 12, so plan for Android 11 and Android 13 or later.

Step 1: Enroll the Zebra devices#

Use the standard Android Enterprise flows: a dedicated profile for shared, kiosk-style devices or a fully managed profile for single-user devices, enrolled by QR code, NFC, token or zero-touch. If you stage devices with Zebra's StageNow tool, follow Zebra's documentation for handing them over to Android Enterprise enrollment. Name each enrollment profile clearly and build a dynamic device group from it, as Microsoft's dedicated-device guide shows with the enrollmentProfileName property:

(device.enrollmentProfileName -eq "Zebra-Warehouse-Dedicated")

LG OTA deployments target devices, not users, and don't support assignment filters. For kiosk lockdown, see dedicated devices and Managed Home Screen.

Step 2: Configure Zebra settings with OEMConfig#

OEMConfig is Google's standard for delivering manufacturer settings through app configuration. Intune shows the schema Zebra's app publishes and sends your values without validating them, so schema questions go to Zebra. Pick the app that matches the Android version:

1. Approve the app in Managed Google Play and assign it as required to the Zebra device group.
2. Create a configuration profile for Android Enterprise with the profile type OEMConfig and select the Zebra app. Stay under Intune's 500 KB profile size limit.
3. Intune doesn't guarantee the order of separate OEMConfig profiles (a Google Play limitation). When order matters, use Zebra's Transaction Steps inside one profile.

Step 3: Connect Zebra LifeGuard OTA#

1. In the Intune admin center, open Tenant administration › Connectors and tokens › Firmware over-the-air update and select Zebra.
2. Select Connect and consent to data sharing with Zebra. The authorization link is valid for 10 minutes; Refresh creates another.
3. Authorize Intune in the Zebra portal. Record the Zebra account email you used: Zebra support needs it and Intune doesn't store it.
4. Back in Intune, the enrollment token appears in the panel. Select Show Token before Copy, or you copy asterisks.

Step 4: Enroll devices with the LG OTA service#

1. Add Zebra Enrollment Manager and Zebra Common Transport Layer from Managed Google Play and assign both as required to the device group.
2. Create a managed-devices app configuration policy for each app, granting Phone state (read) as Auto grant. In the Enrollment Manager policy, also set Action to Claim Device and Claim Device Token to the copied token.
3. On Android 11, enable one Zebra system app depending on the build: com.symbol.tool.stagenow on builds earlier than 11-20-18.00-RG-U00, com.zebra.devicemanager on 11-20-18.00-RG-U00 or 11-20-18.00-RG-U02, none on later builds.
4. Allow at least 15 minutes, or sync from the Intune app on the device; supported devices then register with Zebra.

Step 5: Create a firmware deployment#

Go to Devices › By platform › Android › Manage updates › Android FOTA deployments and select Create deployment:

• Release and model: Latest or a Custom release for one model; other models in the group are skipped.
• Deployment schedule: Run as soon as possible (runs for 28 days) or Scheduled with time zone, start and optional end.
• Installation schedule: an install window in the same time zone. Delay installation until only works on Android 10 and earlier.
• Device conditions: minimum battery (30–100%), charger required, network type.

Deployments are fire-and-forget. They can't be edited, only devices eligible at creation time are sent to Zebra, devices added to the group later are left out, and a device can be in only one deployment at a time.

Statuses and errors to watch#

Deployment status isn't device status: once its end date passes, a deployment shows Completed even if some devices failed. Always open View report and filter by status.

Verify#

• OEMConfig: the profile's Monitor › Device status shows success, and the per-device view has no failed rows.
• Deployment: status moves through Creation in progress, Created and Deployment in progress; the device report lists completed devices, and the device's build number matches the target release.
• Reporting: covers eligible devices only and refreshes hourly.

Tips & gotchas#

• Pilot each release on a small device group per model. To change a deployment, cancel it and create a new one.
• Battery and charger conditions often keep devices waiting; set the install window for when devices sit in their cradles.
• Related: Samsung Knox and OEMConfig and the Android enrollment error reference.

References#

• Zebra LifeGuard Over-the-Air Integration with Microsoft Intune (Microsoft Learn)
• Deploy OEMConfig profiles to Zebra devices in Microsoft Intune (Microsoft Learn)
• Zebra OEMConfig Powered by MX managed configurations (Zebra TechDocs)
• Zebra LifeGuard OTA: Response Code 4009 (Zebra Knowledge Center)