Android: config profiles not resent when a host variable (IdP) changes

[AndreyKizimenko]

Fleet versions

• Discovered: 4.89.0-rc.2607071932
• Reproduced: 4.89.0-rc.2607071932

Web browser and operating system: Android 16 (Samsung SM-S906U1, work profile)

---

💥 Actual behavior

When a host's IdP attributes change (via SCIM), Android configuration profiles that use the corresponding $FLEET_VAR_HOST_END_USER_IDP_* variables are not resent to the host. The profile keeps its previously-delivered (now stale) substituted value.

Confirmed live: after changing the end user's IdP info, the host's certificate template was automatically resent (correct, per #37406) but the Android configuration profile using the same IdP variables was not.

🛠️ Expected behavior

Like Apple/Windows profiles and certificate templates, an Android configuration profile that references a host variable should be automatically reset to pending and resent when that variable's value changes for the host.

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Enroll an Android host with an IdP identity (SCIM).
2. Add an Android config profile that uses an IdP variable in a string value, e.g. {"shortSupportMessage":{"defaultMessage":"user $FLEET_VAR_HOST_END_USER_IDP_USERNAME"}}; assign to the host/team; confirm it delivers verified.
3. Change that end user's IdP attribute (e.g. update username/department/groups via SCIM).
4. Observe: a cert template using IdP vars is reset to pending and resent, but the Android config profile is not reset and keeps the old value.

🕯️ Root cause

Two gaps (both required for auto-resend, cf. how certs/Apple/Windows do it):

1. Android profile → variable associations are never recorded. mdm_configuration_profile_variables has an android_profile_uuid column, but no rows are ever written for Android profiles. The batch path calls batchSetLabelAndVariableAssociations(ctx, tx, "android", tmID, mappedIncomingProfiles, nil) — passing nil for the variables (server/datastore/mysql/android.go ~L1861) — and the single-create path (NewMDMAndroidConfigProfile) records no associations either.
2. The SCIM variable-change resend has no Android query. triggerResendProfilesUsingVariables (server/datastore/mysql/scim.go ~L1261) resets host_mdm_apple_profiles, host_mdm_windows_profiles, host_mdm_apple_declarations, and host_certificate_templates on affected variables — but never host_mdm_android_profiles.

DB evidence (repro instance) — rows in mdm_configuration_profile_variables by entity: apple=9, windows=3, cert templates=3, android profiles=0 (despite an assigned Android profile using 8 host variables).

🕯️ More info (optional)

• Certificate templates work because they implement both halves: associations via SetCertificateTemplateVariables and a dedicated host_certificate_templates query in triggerResendProfilesUsingVariables (added in Android certificates: Support all host vital variables and resend certificate when they change #37406).
• Companion issue for the same gap in Android managed app configuration: Android: managed app configuration not resent when a host variable (IdP) changes #49004.
• In scope for Android: support all FLEET_VAR_HOST_ variables in configuration profiles #41968.