Deploy the Chromebook App Filter on Shared Device Mode (SDM) devices using Intune

The Chromebook App Filter provides real-time filtering and seamlessly integrates with Linewize Filter, ensuring your policies are consistently applied. This article outlines the steps to install the Chromebook App Filter on devices in Shared Device Mode (SDM) using Microsoft Intune.

Alternatively, see how to install the Chromebook App Filter on single-user devices.

Before you begin

• Ensure you have managed devices.
• Your devices must meet the Qoria Filter minimum system requirements.

1. Create an enrolment policy

1. Sign in to Microsoft Intune Admin Center.
2. Go to Devices > Android > Device onboarding > Enrolment.
3. Select Corporate-owned dedicated devices.
4. Select Create policy to create a profile with the Token type set to Corporate-owned dedicated device with Microsoft Entra shared mode.

2. Create groups

You can use any Intune Groups for app configuration and deployment. Dynamic Groups automatically add devices to the group upon enrolment, removing the need to add devices manually.

Add Dynamic Groups, with the Property set to the name of the enrolment policy created during Create an enrolment policy.

3. Set the device mode

1. Go to Devices > Android devices > Configuration.
2. Select Create to create a new profile.
   • For Platform, select Android Enterprise.
   • For Profile type, select Templates > Device restrictions.
3. In Configuration settings > Device experience:
   • For Device experience type, select Kiosk mode (dedicated and fully managed).
   • For Kiosk mode, select Multi-app.
   • (optional) To add the Android Filter app to the device’s home screen:
     • Select Add.
     • Search for and select Qoria Filter.
     • Select to add the app to the home screen.
4. In the Dedicated devices section, change the MHS sign-in screen toggle from Not configured to Enabled.
5. In the Assignments step, select Add groups and select the group set up during Create groups.
6. Review the settings before selecting Create.

4. Deploy the Qoria Filter app deployment rules

1. Go to Devices > Android Apps.
2. Assign these apps to the group you set up during Create groups:
   • Managed Home Screen: Allows the Qoria Filter app to run.
   • Microsoft Authenticator: Allows the Qoria Filter app to query the Entra user and retrieve credentials for authentication.
   • Qoria Filter: Filters the traffic from the installed browser.
   • Any browser that will be used.

5. Create the application registration

1. Sign in to the Microsoft Entra Admin Center.
2. Create an application registration with Qoria Filter as the Name.
3. Copy the Application (client) ID from the Overview page.
4. Add a redirect URI:
   • For Configure platforms, select Android.
   • For Package name, enter com.qoria.uc.android.edu
   • For Signature hash, enter DerKHNf9otWK42NDRZp3lshQ5sQ=

6. Create a certificate

1. Sign in to Linewize Filter.
2. Go to Configuration > Self Service Certificates.
3. Complete the required fields:
   • Country (C): Select a country from the list.
   • State/Province (ST): Enter your state.
   • Locality (L): Enter your city.
   • Organisation (O): Enter your school’s name.
   • Common Name (CN): Enter your school’s domain name.
   • Key size (bits): Select a key size, or use the default. Larger keys provide stronger security.
   • Validity for (days): Enter the number of days the certificate remains valid. We recommend rotating certificates every two years.
4. Select Generate.
5. Copy the Signing Certificate and Signing Certificate Key for use in the next step.
6. The certificate downloads automatically.

7. Create an app configuration policy

1. In Microsoft Intune Admin Center.
2. Go to Apps > Configuration.
3. Select Create > Managed Devices.
4. In the Basics step:
5. Add a Name for the profile.
   • For Platform, select Android Enterprise.
   • For Profile Type, select Fully Managed, Dedicated and Corporate-Owned Work Profile Only.
   • For Targeted app, select Qoria Filter.
6. Select Next.
7. In the Settings step:
   • For Configuration settings format, select Use configuration designer.
   • From the list of available configuration keys, select only the keys that contain Linewize in the name, as well as Hardware Id, then select OK. Note: Linewize Bypass Domains, Linewize Additional Device IDs, and Linewize Device Mac are optional and are not required for a valid configuration.
   • Configure the selected settings as follows:
     • Linewize App Mode
       • Select Android_Companion from the dropdown.
     • Linewize Device Identifier
       • Enter the Linewize Filter Device ID that the device will register with.
     • Linewize Device Name
       • Enter the Linewize Filter Device Name.
     • Linewize Region
       • Select the region where your Linewize Filter is hosted: 
         syd-1 – US/NZ Region 
         syd-2 – AU Region 
         uk-1 – European Region
     • Linewize User Name
       • For domain-joined devices, select variable as the value type and choose UserName.
       • For non-domain-joined devices, select string and enter a manual username or email address.
     • Linewize Auth Secret
       • Enter the preshared key from your Linewize Filter configuration. Go to Configuration > Agent Downloads and select Copy Preshared Key.
     • (Optional) Linewize Additional Device Identifiers
       • If you have Linewize Filter Appliances, enter any Linewize Filter Device ID that are not the primary one.
     • Hardware Id
     • Select variable as the value type and choose Intune Device ID or
     • Select string and enter a custom identifier. Note: The Hardware Id can be any value and is primarily used as a device identifier.
8. In the Assignments step:
   • Select Add groups and assign the required device or user groups.
9. Review the configuration, then select Review + Create.
10. Select Create to add the App Configuration Profile to Intune.

8. Add the Qoria Filter app

1. Sign in to Microsoft Intune Admin Center.
2. Go to Apps > Android, select Add.
3. Under App Type, select Managed Google Play App from the dropdown.
4. Search for and select Qoria Filter Tip: If you can’t see the app, search for com.qoria.uc.android.edu instead.
5. Select Sync in the App pane to sync with the Managed Google Play service.
6. Go to Apps > Android, select Qoria Filter from the list.
7. Go to Properties > Edit.
8. Select Add group, select the User group checkbox, then click Select.
9. Review the settings before selecting Create.

9. Add a trusted certificate

1. Go to Devices > Android devices > Configuration.
2. Select Create > New Policy.
   • For Platform, select Android Enterprise.
   • For Profile type, select Trusted certificate.
   • Select Create.
3. In the Basics step:
   • Add a name for the certificate.
   • (Optional) Add a description.
4. Select Next.
5. In the Configuration settings step:
   • Upload the certificate file downloaded during Create a certificate.
6. In the Assignments step:
   • Select Add groups, then select the required user or device group.
7. Review the settings before selecting Create.

10. Create an always-on VPN policy

1. Go to Devices > Android devices > Configuration.
2. Select Create > New Policy.
   • For Platform, select Android Enterprise.
   • For Profile type, select Device Restrictions.
3. Select Create.
4. In the Basics step:
   • Add a name for the profile.
5. Select Next.
6. In the Configuration settings step:
   • Select the Connectivity dropdown.
   • For Always-on VPN (work profile-level), select Enable.
   • For VPN Client, select Custom.
   • For Package ID, enter com.qoria.uc.android.edu
   • Leave Lockdown mode turned off.
7. Select Next.
8. In the Assignments step:
   • Select Add groups, then select the required user or device group.
9. Review the settings before selecting Create.