Hey all. New Graphene user here (as of two days ago). Hit my head against the wall until something worked –– solution is only possible due to this thread, specifically @wild's method.
Note: the below solution is just working as of now (6/30/25), and the solution was for Android Device Manager (not Intune), though it might still work.
Problem: As laid out previously in this thread, Android Device Manager can't access GMS / Play Services / Play Store, which is needed for authentication. In the past, you could just use adb to install-existing on the new user profile, but google updated android to prevent that. If you get through these problems, a new one is presented where the new profile Play Store is seen as an unknown app, and if your org's policy requires it to install profile apps, it might not be allowed to.
Solution:
1.) Make sure you delete any existing work profile, as well as the Android Device Policy application
2.) Reboot your phone
3.) Install the Android Device Policy (you don't need to grant any extra permissions) AND any Google Apps you wish to use from the Play Store / Aurora (not tested) –– this doesn't have to come after rebooting your phone / you don't need to reinstall anything if it already exists
4.) On your comp, setup this shell file
_#!/bin/bash
INTERVAL=0.5
PACKAGES=(
com.google.android.gms #needed
com.android.vending #needed
com.google.android.gm #gmail
com.google.android.calendar #calendar
com.google.android.apps.docs #docs
com.google.android.apps.docs.editors.sheets #sheets
com.google.android.apps.docs.editors.slides #slides
com.google.android.keep #keep
com.google.android.contacts #contracts
com.google.android.apps.nbu.files #files
com.google.android.apps.chrome #chrome
com.google.android.apps.tachyon #meet
)
echo "⏳ Watching for Work profile creation..."
while true; do
USERS=$(adb shell pm list users 2>/dev/null)
WORK_LINE=$(echo "$USERS" | grep -i "Work profile")
if [[ -n "$WORK_LINE" ]]; then
USER_ID=$(echo "$WORK_LINE" | sed -n 's/UserInfo{([0-9]):./\1/p')
if [[ -n "$USER_ID" ]]; then
echo "✅ Work profile detected with user ID: $USER_ID"
echo "🚀 Injecting ${#PACKAGES[@]} apps into the work profile..."
for pkg in "${PACKAGES[@]}"; do
echo "📦 Installing: $pkg"
adb shell cmd package install-existing --user "$USER_ID" "$pkg" >/dev/null 2>&1
if [[ $? -eq 0 ]]; then
echo "✅ $pkg installed successfully"
else
echo "⚠️ Failed to install $pkg (may not exist in owner profile)"
fi
done
echo "🎉 Injection complete. You can now return to your phone and continue provisioning."
exit 0
fi
fi
sleep "$INTERVAL"
done_
2.1) Only the first two packages are needed –– the rest you can add or delete based on your needs. Note: my org requires a number of google apps to be installed, but this method still worked without installing all of them
2.2) if you're new to shell scripts, then just create a file with that script (vi or nano) in your platform-tools directory, go to the directory, run _chmod +x filename, and later run ./filename
3.) Go to Settings -> Passwords, passkeys & accounts -> add your org account
4.) After going through login and all, the app will crash
5.) run the shell script
6.) Go to a GSuite app, switch to your org account, click manage account, proceed with login
7.) After the user is provisioned, but before it's completed, you should be successfully able to install both the play app / services, and clone the gsuite apps to your new work profile
8.) profit
basically @wild was right, it was just tricky timing. the script allows everything to be injected after the user is provisioned but after it's finalized, which prevents the new adb system error. it's working now –– i'll keep y'all updated!