Decide the Android app's distribution future before private publication

Source facts

A private Managed Google Play app published directly through Intune cannot later be made public. Its package name must be unique across Google Play, not merely within the organization. The uploaded APK must not be marked debuggable. After publication, the private app must be selected and synchronized into Intune. Microsoft Learn.

Applicability

Apply this decision to an internal Android application before its first direct private publication through the Intune interface. Involve the application owner and build maintainer, not only the administrator who will upload the package.

DSE recommendation

Ask the owner to state whether distribution is permanently internal or might become public. Resolve that question before committing the package identity to this route. Review the release build’s package name and debug setting as explicit handoff items. Keep the approved artifact and publication decision together so a later team does not mistake an upload convenience for a reversible distribution choice.

Verification

Use the approved build in the authorized publishing workflow, then verify the resulting private app identity and its appearance after synchronization. Follow with a restricted assignment test on a representative managed device. Record an upload rejection separately from a synchronization delay or installation failure. Recheck the artifact identity whenever the build pipeline changes; do not substitute a similarly named app to bypass a rejected package.

Official references

Microsoft Learn: Add and Assign Managed Google Play Apps to Android Enterprise Devices.