In the case of Android-managed device app configuration, we need to make the apps we want to configure available. Within the endpoint manager admin center, select Apps, then Android. You can see I have already selected a bunch of Android apps from the Managed Google play store. To add an app, click the add button, select Managed Google Play app from the app type drop-down and click the select button. Next, choose the app, making sure it does support managed configuration. I've already selected PowerPoint, so I won't select it again.

To set up a configuration policy, click app configuration policies from the app overview page menu. When we go to create a new app configuration policy, the add button lets us choose whether to use managed devices or managed apps. I'll select managed devices. I'll give the policy a name and description. We're already in the managed devices enrolment scenario, so the enrolment type field is disabled. The platform will be Android Enterprise, and I'll go with all profile types. Next, I'll select the app to be configured. 

I can only select an app I've already associated from the managed Google play store. The settings tab is where we configure the app. You can upload configuration settings in JSON format using the provided template or specify settings with the configuration designer. Above configuration, you can specify access to the device's capabilities by adding permissions. You can specify auto grant, auto deny, or prompt the user for each added permission. As usual, the context menu on the right allows you to delete permissions and configurations. Click next to assign the configuration by a combination of inclusion and exclusion of groups and users. Before creating the policy, you can review the settings and permissions. I'll add permission settings for the camera and external storage.

In the case of creating a configuration policy for managed apps, you select apps from a list of apps that support configuration for either Android or iOS. The managed app policy creation process is similar to the device-managed process but without specifying the platform. There is a list of public apps to choose from or you could select your organization's custom apps.

The actual settings are key-value pairs. You'll need to find out the settings and possible values for the app you're configuring. This information is typically found in the app's documentation supplied by the vendor. The assignments and creation steps are the same as for managed devices.