MS Intune company portal with work profile not working

ray

@tetto @wild
So I don't need to create a work profile first?

What I did previously is that I created a work profile using shelter, then copy the apps, company portal, teams, outlook, google play services, this was working until the company required the devices to be compliant, that's where I wasn't able to proceed.

In this case, I believe the process you performed was everything in the owners profile, installed the company portal, went through the first steps then migrated everything to the work profile that the company portal created and it worked.

Thanks for the clarification, I am trying to test this right now.

wild

ray yeah, creating it with shelter makes shelter the app that owns the work profile. Company portal doesn't like that.

Just like tetto, I was also keeping my screen awake. Forgot to mention that.

ray

wild @tetto it looks like I ran into the same issue as everyone else that get permission denied. (Doing this without shelter)

I'll so some more research next week.

wild

I would do more research but I don't want to undo my work profile to redo it.. I'm wondering if there was an update after we set up our work profiles that changed how work profiles work and now it's not possible anymore.

If anyone is able to get it working with the latest updates can you let us know?

B0b3r

wild
I think your guess was right. I checked when the first person reported it as not working ( @Yoga5841 on 11.04.2025) and went through the commits of the release 6 days earlier. Found this commit:
https://github.com/GrapheneOS/platform_frameworks_base/commit/7d9c83bc9a5b09a8e982f375a7a4a17a0f32de8f

Based on the comment (and my understanding of it), adb debugging is being disabled by default since this build and thus installing apks via adb is not working anymore (which is also explicitly mentioned).
https://github.com/GrapheneOS/platform_frameworks_base/blob/7d9c83bc9a5b09a8e982f375a7a4a17a0f32de8f/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java#L10412

As far as my understanding goes, downgrading is not possible as this would go against the security model.
The only possibility would be re-installing with an older image, the problem now is that the official GrapheneOS Servers do not store the images that long... The oldest version I was able to access was 2025041100 which already has this patch, so we are 1 week too late.

I saw that there is a 42GB file for this version on archive.org, but I have not yet checked if it contains compiled builds and if they are also signed. Do not install GrapheneOS images from 3rd parties which are not signed by the official key! :-)

wild

B0b3r damn, great detective work. Good thing I didn't remove my work profile to do more testing.

I guess the only hope now is this: https://github.com/GrapheneOS/platform_frameworks_base/pull/147

Luckily I was able to add HeliBoard in my work profile, because I'm not a fan of the default keyboard. This won't be possible in the future even if that pull request gets merged.

But Yoga5841 also reported that shelter itself wasn't able to add applications to its own work profile. Shouldn't that have nothing to do with ADB?

Yoga5841

wild But Yoga5841 also reported that shelter itself wasn't able to add applications to its own work profile.

My bad, I meant that I was unable to use adb to add apps to the shelter profile. The shelter app is able to add new apps.

binarymelon

wild I guess the only hope now is this: https://github.com/GrapheneOS/platform_frameworks_base/pull/147

It's a shame it wasn't implemented prior to locking down ADB, but at least it looks like it's being worked on. I definitely picked the wrong time to attempt de-googling.

B0b3r

binarymelon I digged a bit more and the locking down of ADB actually comes from Google:
https://android.googlesource.com/platform/frameworks/base/+/2095d130b4d7f2ba1a3284abb58ca894817f5f4a

The signature of the image I tested from archive.org is valid according to the command from the CLI installer. I still would not trust it myself and would prefer the direct source. As it is no real solution in the end anyway (it will require a re-install), it seems like we have to wait for the merge of that pending pull-request.

ray

B0b3r
Thank you for digging into this, I guess we will wait until this issue is resolved by GOS Devs for our further testing.

Felttie

Hi all. I am also in situation where company requires a work profile to get teams and work email working. I hope in close future there is "easy" way to get it running somehow. I was planning to move from Apple to Grapheneos, and i already bought PIxel9 Pro, but i noticed this microsoft intune issue, so i need to stay with apple still some time.

drewdatrip

Felttie this too was my plan. Wish I had found this thread prior my purchase. Really hoping this issue can be sorted as I was looking forward to attempting to migrate from Apple for work and personal.

imcyberpunked

@wild As for installing apps after successfully getting company portal working, you mentioned it wouldn't work until addressed here https://github.com/GrapheneOS/platform_frameworks_base/pull/147 Would this also cause apps to not update? I'm currently running into an issue whereby all the apps added via adb work profile creation, these apps will not update for me in the Google Play Store, I keep getting a "Blocked by IT Admin" message.

imperfect

imcyberpunked disable the app store (to avoig getting erros) and keep the apps installed in another profile (have them in my main). If you have an app specific for you company (as in not public), I guess you are out of luck.

wild

imcyberpunked I just disabled auto update in my work profile play store. The aurora store in my main profile will update the apps. For example, I have outlook on my main profile, this gets updated by aurora which will also update the outlook in the work profile. So you need to keep two copies of apps installed.

imcyberpunked

wild Ahh I see and understand now, perfect! I got my apps updating this way... Would this mean I also need the sandboxed Google play services installed on my personal Owner profile as well to keep it updated on the work profile? Would the work profile require this to be updated? If so I'd imagine it would be defined by an Intune policy that has this requirement but hopefully not. imperfect Thanks for the tip, I have this disabled now to avoid the conflicting issues.

imperfect

imcyberpunked the graphene app store has permissions to update it's apps in the work profile. So you do not have that issue with the sandboxed google apps.

wild

imcyberpunked like imperfect said, anything installed by the graphene app store doesn't have that issue. So after the initial set up, you can remove the sandboxed play store/services from your personal profile. The graphene app store in the work profile will update those. For the other things, you can use aurora from your personal profile.

imcyberpunked

@wild @imperfect Thanks!

g0mml

Any news on the relevant commit on github?

« Previous Page Next Page »