It's been a productive few months! As I melted into my chair during the heatwave this week, it occurred to me I've not sent out a newsletter in a while (once again). The last update touched on the prospect of an agentic takeover in the MDM/EMM/UEM/etc space, but we're not there yet (perhaps next quarter..) so in the meantime knowing I'm safe in a job I've continued working on a bunch of tools and resources. There's also some important news on how Android apps get distributed that's worth being aware of, as it may just affect your workflows.

Here's the round-up, starting with the projects. Grab a coffee.

The app generators: build a selection of apps from your browser

This is the big one, so it goes first. I've put together a small family of browser-based generators that take a configuration and hand you back a signed, deployable Android app - no Android Studio, no build tooling, no keystore wrangling, no code knowledge what. so. ever.

Fill in a form, you get an APK or AAB ready to push through your EMM. There's presently four generators to choose from:

• Kiosk App Generator - replace the system home screen on dedicated devices with a tiled launcher of just the apps your users need, themed and wallpapered to match, admin-escape support, folder support, the whole shebang. Aimed at Android Enterprise dedicated estates, but works anywhere you want a locked-down multi-app surface.
• Web App Generator - wrap any website in a signed APK using a native WebView. Set display mode, orientation, theme colour and per-app permissions, then ship it. Handy for distributing internal web apps, or anchoring a kiosk to a single destination without dragging a whole browser along. Google offer a web app generator through their managed Play iFrame, of course, but this one offers a little more.
• Contacts App Generator - produce a managed contacts app from VCF, CSV or JSON sources. It writes contacts into an app-owned Android account, so you get an internal directory on devices without standing up Exchange, LDAP or CardDAV just for that.
• Document App Generator - a branded document-library app with embedded or URL-backed PDFs, EPUBs, images, markdown, HTML, CSV and more. Stored privately, synced by policy, and updated through EMM managed configuration.

Why? Because there's demand, and because I fancied the challenge. I have folks in the ecosystem reaching out on a regular basis - particularly for kiosk solutions - but over time these 4 projects crop up more than any other.

The goal was to incorporate the most common feature requests per project, and end up with an output an organisation could either use directly, or take the free source code and build upon to their specific needs.

So far the feedback has been positive, take a look over on gen.bayton.org if you'd like to see them in action, or bayton.org/projects to read more about the projects.

APK Inspector: signing details without the command line

New as of last week. Drop in an .apk and APK Inspector pulls out the package name, signing certificate details, versions, permissions.. a bunch of stuff.

The whole thing runs locally in your browser. Your APK is never uploaded; refresh the page and it's gone. The SHA-256 it produces, rendered as a URL-safe base64 checksum, is the exact value you'd drop into PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM for a custom DPC QR code.

Why? I've been doing some custom app (AMAPI) work recently, and running commands over CLI with non-technical people is a pain. Now I can point them to a page to upload, then copy/paste signing certificates, package checksums, version data.. it's saving a bunch of time.

Feel free to give it a go, I've tested it with well over 100 APKs so far and caught the few parsing bugs I found. I trust it'll be pretty solid now.

A WIP home for the system app database v2: sysapps.bayton.org

The system app database on bayton.org isn't new - but a static site can only do so much. So there's now sysapps.bayton.org, a v2 playground for what will eventually become a fully rebuilt, standalone version of the service.

Freed from the constraints of static generation, the standalone version brings far greater filtering, proper data search, and room for features and functionality the on-site version simply can't support. It's a work-in-progress preview at this stage - go have a poke around, and tell me what you'd want from a grown-up version of it.

One of my favourite new features is bundles, which I'm using to collect apps with similar use cases or functions together, allowing for a greatly improved experience for someone who, for example, needs to find the default camera apps across a few OEMS.

As with v1 (still live), all application data is provided by contributors who choose to install Package Search, and toggle on system app sync (which - for clarity - only ever uploads system, preloaded applications. No user data, no downloaded apps).

MIKA: ask the site instead of searching it

MIKA - Mobile Intelligence & Knowledge Assistant - started life as an April Fools' bit and quickly turned out to be real and genuinely useful. MIKA's an AI assistant that has ingested the entire bayton.org content library and answers questions about Android Enterprise directly, citing sources so you can check nothing's being made up.

MIKA lives as a floating orb across the whole site, with a dedicated full experience (including voice) at /mika/. As a bonus for me, the questions people ask are quietly pointing out the gaps in my documentation - so MIKA is also helping decide what gets written next.

Fun fact, Mika (Mikael) is also my (not so little) son, so this was something fun for us to spin up together

DeltaWatch: webpage change monitoring system that helps me stay up-to-date

If you write documentation for a living, you know the specific horror of a vendor changing a page without a word - a deprecated flag, a changed default, a renamed permission. I've been hand-watching a pile of pages (Google's AE docs, AMAPI references, OEM product pages) for the better part of a decade, and the weak link was always me remembering to look.

So I spent a few weeks spinning up DeltaWatch - a web change detection platform. Point it at a URL, tell it which bits you care about, and it tells you when something changes. Pattern matching, multiple format support, set-and-forget. It's live now at deltawatch.ing, sign-up takes about fifteen seconds, and the free tier has no time limit.

DeltaWatch has a couple of paid tiers to unlock faster checks and more of them, a site crawler for finding new docs and resources passively, and more.

Paid tiers help offset my time and effort writing, videoing, working with folks in the ecosystem, covering server costs, buying devices.. it all gets reinvested into the ecosystem.

And now, what's new in Goog-land!

Heads-up: how you distribute Android apps is changing

Two related changes from Google that are worth being aware of, because between them they close off paths a lot of people still rely on:

• The Play Developer Console no longer accepts APK uploads. If your process anywhere assumes you can pop an APK up to the Play Console, that will no longer work going forward, though do note it's still possible - if you use the Google Play iFrame embedded within your EMM - to continue adding APKs there presently. This equally feels like it might be on borrowed time, though, so I would strongly consider looking at moving to AAB support, which is now supported everywhere APKs were traditionally supported.
• Externally hosted APKs are no longer supported. The externally-hosted route - long the escape hatch for apps you didn't want sitting in Google's Play Store - is gone. I wrote up a short take on what that means on LinkedIn.

What's new in Android 17

Android 17 (API level 37) landed on Pixel devices this month, with other OEMs expected from late Q3. I've written up the enterprise-relevant changes in full, but a few highlights for managed estates:

• Agentic automation controls - admins can now disable AI agent automation on fully managed devices and the personal side of COPE; it's blocked inside work profiles by default.
• Cross-profile loopback blocked - apps can no longer use 127.0.0.1 to talk across profiles. No opt-out.
• Theft protection on by default - Theft Detection Lock and Remote Lock are enabled on new, reset and upgraded devices.
• Local network permission mandatory - ACCESS_LOCAL_NETWORK is now required for apps targeting API 37 that reach printers, IoT, casting or on-prem services. Admins can pre-grant it.
• Certificate Transparency on by default - internal CAs that don't publish to CT logs will need network-security-config exemptions.

The full write-up covers post-quantum keystore support, the SMS OTP delay, large-screen orientation, ECH and the rest.

Still warming up: the managed configuration tool

One more in the pipeline - a managed configuration tool that's currently pending release on Google Play.

I've updated Package Search recently to improve the layout of managed config detected in apps on a device, but it's quite a limited experience. To top that, I've recently finished up working on a managed config tool with much broader capabilities for troubleshooting.

I'll post about that over on LinkedIn and the website when it's live.

That's the lot (for now)

If you made it to the end here, I appreciate it! If you get the opportunity to try anything mentioned today, or have feedback/ideas you want to share, I'd love to hear from you.

Feel free to reach out any time!

Until next time, have a great weekend! Jason