Hi,
I’m trying to use Microsoft Intune Company Portal on GrapheneOS / Android 17, with one requirement: no Google Play in Owner, only inside the Android Enterprise work profile.

What works:

Company Portal creates a managed work profile.
Settings → Apps → All apps` shows separate Personal / Work sections.
I can install sandboxed Google Play inside the Work profile via GrapheneOS App Store.
Company Portal is registered as Managed Profile Owner:

User 14: admin=com.microsoft.windowsintune.companyportal/com.microsoft.omadm.client.PolicyManagerReceiver,
ManagedProfileOwner(parentUserId=0)

But the profile never fully activates.

dumpsys user shows:

parentId=0
Type: android.os.usertype.profile.MANAGED
mShowInLauncher=1
mStartWithParent=true
mShowInSettings=1
Flags: DISABLED|INITIALIZED|MANAGED_PROFILE|PROFILE

Symptoms:

No Work tab in launcher
No Work/pause Quick Settings tile
Work apps only accessible via Settings → Apps → All apps → Work

Company Portal eventually shows "Your device now has a profile just for work" but nothing further happens.

What I tried:

Compatibility Mode for Company Portal
Device Admin enabled
Google Play installed only in Work profile
reboot / force stop / reopen CP
several clean re-enrollments

ADB package access to the managed profile is blocked on Android 17 with SecurityException, so the older install-existing --user <work-id> workaround doesn’t work for me.

Has anyone managed to get Intune working on current GrapheneOS/Android 17 without installing Google Play in Owner including a proper Work launcher tab and pause toggle?

Thanks!