Updates on Private apps in Managed google play seems to be a problem when running a device configured as a dedicated device (kiosk mode multi apps). We experience that users are forced to exit kiosk mode and do the update on LOB apps manual from the vendor app(Google Play) on the device after a new version of the app been uploaded in the Managed Google Play iframe within Intune. Is this intended that the device must be taken into IT for maintains for updating/deployment with the new version of private apps deployed Managed Google play? Or am I missing something here? Isn't there a possible way to get private apps to auto-update on the devices and without leaving kiosk modem?

logging out of the Shared Device Mode session keeps the outlook app and team's app logged in for the next user session. That is a big security issue. This is blocking the use of this mode generally. Shared Device Mode Should offer a single sign-on and single sign-out.
Like mentioned in here:
https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-android-shared-devices

Shared device sign-out and the overall app lifecycle
When a user signs out, you'll need to take action to protect the privacy and data of the user. For example, if you're building a medical records app you'll want to make sure that when the user signs out previously displayed patient records are cleared. Your application must be prepared for this and check every time it enters the foreground.

When your app uses MSAL to sign out the user in an app running on device that is in shared mode, the signed-in account and cached tokens are removed from both the app and the device.

Configuration: Android Device in Shared Device Mode (Dedicated) With a couple of Microsoft apps pushed like Outlook and Teams.

As per https://twitter.com/byteben/status/1305433715284340736

The Advanced Diagnostic Reports in the Windows 10 MDM settings page allows the user to "Create Report". The IT Helpdesk then have to instruct the user to find the report in Public Documents and deliver it to the helpdesk via email/Teams or another method.

Having the option to "View Report" will allow Admins to diagnose the report instantly during a Teams support call without having to tell users how to retrieve it.

Having the option to remotely retrieve the report too via the Intune Management Extension would be useful. This means the admin doesn't need to remote control the device or ask the user to create and send the logs at all.

Support the ability to specify custom logs and/or locations of logs a device support admin would have the option to to collect at any time.

Currently, you may or may not have the ability to collect logs if a Win32 app fails (for example), depending on which way the wind is blowing. However, there are many other instances of needing to look at logs for devices you do not have physical access to and do not want to disturb the user.

It's very frustrating to have a need to look at logs on a device when trying to troubleshoot different issues, but then cannot obtain them because there's not failed apps. You shouldn't have to force an app install failure to obtain logs. It's a lot of wasted time and is such a terrible workaround.

Proper support for obtaining logs at any time via a log-specific area would be great.

I love the addition of win32 apps to be packaged and deployed through Intune, however these applications don't install during the enrollment status page nor do they count towards the number of apps needed to install. They tend to install after the user is on the desktop, which isn't ideal when you're wanting the user to be 100% good to go by the time they get to the desktop.

Also I would like for the status page to show and apply powershell scripts before login, certain configurations are best done before the desktop has loaded (such as configured OneDrive to auto login) but if the OneDrive client launches before the script to configure it runs it just sits there and doesn't login. Could be solved for by having all the scripts run before the desktop loads.

As per https://twitter.com/byteben/status/1305433715284340736

The Advanced Diagnostic Reports in the Windows 10 MDM settings page allows the user to "Create Report". The IT Helpdesk then have to instruct the user to find the report in Public Documents and deliver it to the helpdesk via email/Teams or another method.

Having the option to "View Report" will allow Admins to diagnose the report instantly during a Teams support call without having to tell users how to retrieve it.

Having the option to remotely retrieve the report too via the Intune Management Extension would be useful. This means the admin doesn't need to remote control the device or ask the user to create and send the logs at all.