Does Passbeam work with Android?

Yes. The Intune step creates profiles for both Android Enterprise modes, next to the Windows, iOS and macOS ones. Fully Managed, Dedicated and Corporate-Owned Work Profile are for company-owned devices. Personally-Owned Work Profile is for BYOD. They use the same SCEP and Wi-Fi settings as the others.

In Intune these are separate profile types, and choosing the wrong one is the mistake to avoid. A Personally-Owned Work Profile SCEP profile installs on nothing on a fully managed device, and the other way round. Passbeam tells you which profile type to choose for each.

Two Android settings the guide points out. On fully managed and dedicated devices, Android asks the user to approve each use of the certificate. On a kiosk there's nobody to approve it, so the Apps step has to grant access silently. And a dedicated device has no user, so it needs a device certificate. A user certificate's {{UserPrincipalName}} has nothing to fill it in, and the profile fails to install.

You may notice that Intune can't revoke a certificate issued through a device-owner profile. That doesn't affect offboarding. Passbeam revokes the certificate itself, and the device is refused the next time it authenticates.

With another MDM, the enrolment challenge works on Android the same as anywhere else, as long as the MDM can deliver a SCEP certificate to the device.

If something doesn't work on a particular device or Android version, raise a ticket with the model and the profile you used.