MDM on Grapheneos?

Johnny-Bravo

Does Grapheneos allow for remote system management by Mobile Device Management (MDM) software?

If so, which MDM software works well with Grapheneos, and is (preferrably) open source, and / or trustworthy?

de0u

Johnny-Bravo This may be useful: https://discuss.grapheneos.org/d/4411-does-gos-play-well-with-mdm-for-corporateenterprise-environments

headwind-mdm

de0u

We have a lot of users asking how to install MDM on GrapheneOS. Currently, I know the only way to use MDM on GrapheneOS - install the MDM agent and grant the Device Owner permissions by the ADB utility, which is difficult and not acceptable by most users.

In the link provided, it was written: "GrapheneOS does have all the AOSP stuff present for managed devices and managed profiles". But I was unable to start AOSP's ManagedProvisioning app by tapping 6 times on a welcome screen.

Is there a way to install MDM on GrapheneOS? If there isn't, can our team contribute to GrapheneOS and implement Managed Provisioning?

P.S. MDM on fully managed devices does not require Google Play services, so GrapheneOS-based devices CAN be managed by MDM. The only issue is the MDM installation.

GrapheneOS

headwind-mdm There isn't a better way to do it yet but we'd like for it to be supported. It would need to be integrated into our SetupWizard2 app.

P.S. MDM on fully managed devices does not require Google Play services, so GrapheneOS-based devices CAN be managed by MDM. The only issue is the MDM installation.

GrapheneOS does support Google Play via sandboxed Google Play, but it's optional and unprivileged so it can't do the special device management stuff that it usually does.

headwind-mdm

GrapheneOS Thank you for the explanation. We'll try to implement MDM provisioning in a custom build of GrapheneOS. If we succeed, is there any workflow to commit our update to the official GrapheneOS code?

GrapheneOS

headwind-mdm You can submit a pull request here:

https://github.com/GrapheneOS/platform_packages_apps_SetupWizard2

Filed an issue about it here:

https://github.com/GrapheneOS/platform_packages_apps_SetupWizard2/issues/35

We have a build guide for GrapheneOS here:

https://grapheneos.org/build

headwind-mdm

GrapheneOS I've submitted the pull request implementing QR code based MDM setup. Hope to finalize it and see it in the official GrapheneOS distribution soon.

By the way, since this feature makes GrapheneOS capable to be used on corporate-owned devices, this could be a good chance to increase the popularity of the OS by proposing it to system administrators as a great and secure alternative to Google-powered Android ROMs. Once the feature becomes available, we can issue a press release about that. What do you think?

NetRunner88

headwind-mdm

It is a fairly good program, I have tried it last year, the web interface is great, everything is on par.
But the phone launcher, omg. That's really ugly.
Isn't there is a way to solely use the work profile of Android ? There is nothing speaking of it in the documentation.

GrapheneOS

headwind-mdm It needs to be resubmitted for Android 15 QPR2 whhich was released in March. The pull request got automatically closed by GitHub from us deleting the legacy 15 branch that's no longer used. We forgot that would happen and that we should edit each PR targeted 15 to point at 15-qpr2 first.

headwind-mdm

NetRunner88 Headwind MDM doesn't support work profiles. You can try installing another MDM system supporting them, as the new SetupWizard2 code potentially allows provisioning the device with a work profile (I didn't test it, though).

However, as far as I know, work profiles require strong integration with Google's Android Enterprise framework, which GrapheneOS doesn't have. So I doubt work profiles will work. Anyway, this is worth trying.

de0u

headwind-mdm NetRunner88 This recent post may be of interest: https://discuss.grapheneos.org/d/797-mdm-work-managed-device-work-profile/2

Cyb3r0ps

I've been using GrapheneOS since 2019, and I'm always on the lookout for compatibility with MDM As a system administrator, I manage a bunch of devices in my company, so if anyone knows when the GrapheneOS team plans to implement this, please let me know.

GrapheneOS

@headwind-mdm We've been focused on Android 15 QPR2 and the new hardware virtualization app but we can get to this soon.

headwind-mdm

GrapheneOS I did :) https://github.com/GrapheneOS/platform_packages_apps_SetupWizard2/pull/39

GrapheneOS

headwind-mdm Thanks, missed that somehow. We took an initial look through it but didn't finish reviewing it yet and there will need to be some changes. Some of it could be done ourselves though.

headwind-mdm

GrapheneOS Sure, please comment on the Github PR if there are any issues, our team is happy to fix them.

headwind-mdm

GrapheneOS I see that there was some recent activity in the SetupWizard2 repository, but the pull requests are still pending. Please let me know if you need any assistance with adjusting the code.

headwind-mdm

GrapheneOS I submitted another pull request for the MDM support. The code has been tested on GrapheneOS 15-qpr2 and the conflicts are resolved, so this version could be merged smoothly. See details here: https://github.com/GrapheneOS/platform_packages_apps_SetupWizard2/pull/40

billhani

When can it be expected? I’m very interested in it.

billhani

are there any news because of MDM integrity ?