MDM on Grapheneos?

GrapheneOS

headwind-mdm There isn't a better way to do it yet but we'd like for it to be supported. It would need to be integrated into our SetupWizard2 app.

P.S. MDM on fully managed devices does not require Google Play services, so GrapheneOS-based devices CAN be managed by MDM. The only issue is the MDM installation.

GrapheneOS does support Google Play via sandboxed Google Play, but it's optional and unprivileged so it can't do the special device management stuff that it usually does.

headwind-mdm

GrapheneOS Thank you for the explanation. We'll try to implement MDM provisioning in a custom build of GrapheneOS. If we succeed, is there any workflow to commit our update to the official GrapheneOS code?

GrapheneOS

headwind-mdm You can submit a pull request here:

https://github.com/GrapheneOS/platform_packages_apps_SetupWizard2

Filed an issue about it here:

https://github.com/GrapheneOS/platform_packages_apps_SetupWizard2/issues/35

We have a build guide for GrapheneOS here:

https://grapheneos.org/build

headwind-mdm

GrapheneOS I've submitted the pull request implementing QR code based MDM setup. Hope to finalize it and see it in the official GrapheneOS distribution soon.

By the way, since this feature makes GrapheneOS capable to be used on corporate-owned devices, this could be a good chance to increase the popularity of the OS by proposing it to system administrators as a great and secure alternative to Google-powered Android ROMs. Once the feature becomes available, we can issue a press release about that. What do you think?

NetRunner88

headwind-mdm

It is a fairly good program, I have tried it last year, the web interface is great, everything is on par.
But the phone launcher, omg. That's really ugly.
Isn't there is a way to solely use the work profile of Android ? There is nothing speaking of it in the documentation.

GrapheneOS

headwind-mdm It needs to be resubmitted for Android 15 QPR2 whhich was released in March. The pull request got automatically closed by GitHub from us deleting the legacy 15 branch that's no longer used. We forgot that would happen and that we should edit each PR targeted 15 to point at 15-qpr2 first.

headwind-mdm

NetRunner88 Headwind MDM doesn't support work profiles. You can try installing another MDM system supporting them, as the new SetupWizard2 code potentially allows provisioning the device with a work profile (I didn't test it, though).

However, as far as I know, work profiles require strong integration with Google's Android Enterprise framework, which GrapheneOS doesn't have. So I doubt work profiles will work. Anyway, this is worth trying.

de0u

headwind-mdm NetRunner88 This recent post may be of interest: https://discuss.grapheneos.org/d/797-mdm-work-managed-device-work-profile/2

Cyb3r0ps

I've been using GrapheneOS since 2019, and I'm always on the lookout for compatibility with MDM As a system administrator, I manage a bunch of devices in my company, so if anyone knows when the GrapheneOS team plans to implement this, please let me know.

GrapheneOS

@headwind-mdm We've been focused on Android 15 QPR2 and the new hardware virtualization app but we can get to this soon.

headwind-mdm

GrapheneOS I did :) https://github.com/GrapheneOS/platform_packages_apps_SetupWizard2/pull/39

GrapheneOS

headwind-mdm Thanks, missed that somehow. We took an initial look through it but didn't finish reviewing it yet and there will need to be some changes. Some of it could be done ourselves though.

headwind-mdm

GrapheneOS Sure, please comment on the Github PR if there are any issues, our team is happy to fix them.

headwind-mdm

GrapheneOS I see that there was some recent activity in the SetupWizard2 repository, but the pull requests are still pending. Please let me know if you need any assistance with adjusting the code.

headwind-mdm

GrapheneOS I submitted another pull request for the MDM support. The code has been tested on GrapheneOS 15-qpr2 and the conflicts are resolved, so this version could be merged smoothly. See details here: https://github.com/GrapheneOS/platform_packages_apps_SetupWizard2/pull/40

billhani

When can it be expected? I’m very interested in it.

billhani

are there any news because of MDM integrity ?

Task079

Hey anymore news in regards of headwind mdm working on graphene os or which pixel models it works on interested in implementing it to protect journalists I work with. Please let me know the status on this moving forward thank you.

headwind-mdm

@GrapheneOS Can you please clarify how could we proceed with merging MDM support in the official GrapheneOS build?

GrapheneOS

headwind-mdm Major changes to it will be required but we haven't had time to fully review it and provide feedback. Our lead developer spent some time reviewing it but has been forcibly conscripted into the military of a country that's at war and therefore we haven't been able to make progress on it. We have a lot of catch up work and other high priority work which will need to get done because of this. There's also the launch of Android 16 this month and we'll need to migrate to it.

Task079

GrapheneOS understandable and sorry to hear about the lost of a developer. Hopefully there will be an opportunity for you guys to catch. I believe mdm being allowed to work on graphene os is the final solution to allowing companies that want more privacy to be allowed to protect their information and employees from phones being intercepted.