MS Intune company portal with work profile not working

Bryinn

oogieboogie What do you define as working normally in this case? I am not entierly sure how I would test that.
I guess it worked as normally as the other attempts I had with other methods.

oogieboogie

Bryinn Sorry, I meant were you able to successfully access work apps until the reboot, where login stopped working?

in my method (work uses Gsuite, so i needed android device policy instead of Intune), I didn't need to reboot the device. i was able to successfully successfully sign in and access my work apps, and access continued after reboot.

Bryinn

oogieboogie Ah I see.
Work apps did not allow me to sign in to them because the device was not properly onboarded, and the company has a policy against non-managed devices. I do not believe I checked before the restart unfortunetaly.

oogieboogie

rawDawg if still a problem, might check if any of the permissions in Intune can be disabled (like Modify system settings) or the work profile version of play store permissions can be disabled (like Install unknown apps). unsure –– haven't had the same problem for the Android Device Policy / GSuite apps.

boris

rawDawg after some tedious (ai-assisted) powershell scripting I managed to successfully inject 9 out of 11 apps I was trying to get in the work profile, and I believe I'll be able to push the limits even further, right now I'll be doing some further testing, I'll share the PS code used latter.

g0mml

boris

Can you share the script?

oogieboogie

oooo so just got a pixel 9a –– idk if this was the trouble with other people, but on android 15 (previously just had a 6a running android 14), they output the user ID's diff so my prev script couldn't recognize it.

here is an udpated version, still following the same steps (1.) make sure adb is in your path; 2.) create script and chmod +x it; 3.) delete any existing work profile, make sure apps you want installed already are + edit script as normal; 4.) try to login to work profile; 5.) after crash, open up a work app, try to sign-in, start script, get taken to settings, should inject)

the main problem snag i'd imagine, which i kinda ran into, is that it's such a short interval that it will be blocked by adb if you're installing too many apps (despite shortening the interval). also, i tried to inject play store as having rights to install unknown apps, but despite it correctly setting it to allow, it still didn't work. with that said, all i really need is gmail + calendar, so it's good enough for me rn! code:

`#!/bin/bash
INTERVAL=0.05
PACKAGES=(
com.google.android.gms # Play Services
com.android.vending # Play Store
com.google.android.gm # Gmail
com.google.android.calendar # Calendar
com.google.android.apps.tachyon # Meet
com.google.android.apps.chrome # Chrome
com.google.android.apps.docs # Docs
com.google.android.apps.docs.editors.sheets # Sheets
com.google.android.apps.docs.editors.slides # Slides
)

echo "⏳ Waiting for Work profile..."
while true; do
USERS=$(adb shell pm list users 2>/dev/null)
WORK_LINE=$(echo "$USERS" | grep -i "Work profile")
if [[ -n "$WORK_LINE" ]]; then
USER_ID=$(echo "$WORK_LINE" | cut -d'{' -f2 | cut -d':' -f1)
if [[ -n "$USER_ID" ]]; then
echo "✅ Work profile user $USER_ID detected. Injecting ${#PACKAGES[@]} apps..."
for pkg in "${PACKAGES[@]}"; do
adb shell cmd package install-existing --user "$USER_ID" "$pkg"
done
echo "🎉 Done."
exit 0
fi
fi
sleep "$INTERVAL"
done
`

boris

oogieboogie If you could modify the script so that all install commands are executed at once within a single adb shell instance it will be able to push many more apps to the work profile, I managed to push 16 apps to the work profile by using this method. The install command in my PS script looks something like this:
$cmd = @"
pm install-existing --user $UserId com.google.android.gms & \
pm install-existing --user $UserId com.android.vending & \
pm install-existing --user $UserId app.grapheneos.gmscompat & \
pm install-existing --user $UserId app.grapheneos.gmscompat.lib & \
pm install-existing --user $UserId app.grapheneos.gmscompat.config & \
pm install-existing --user $UserId com.android.contacts & \
pm install-existing --user $UserId com.android.dialer & \
pm install-existing --user $UserId com.microsoft.office.outlook & \
pm install-existing --user $UserId com.microsoft.emmx & \
pm install-existing --user $UserId com.microsoft.teams & \
pm install-existing --user $UserId com.azure.authenticator & \
pm install-existing --user $UserId com.fortinet.android.ftm & \
pm install-existing --user $UserId com.microsoft.ipviewer & \
pm install-existing --user $UserId com.microsoft.office.officehubrow & \
pm install-existing --user $UserId com.microsoft.scmx & \
pm install-existing --user $UserId com.android.documentsui & \
wait
"@
adb shell "$cmd"

other than this modification to the install command I used basically the same aproach you did. I suppose the code could be further optimized by using the same adb shell instance even for detection of the user profile, but I did not find it necesary.

temp89649681

Managed to get a script working in my case, Pixel 7 on 2025090200 patch level at time of install. The script was originally from @oogieboogie and includes fixes from @wild , @rawDawg , and @boris .
As per usual, before running the script you need to know what apps the Company Portal will install by default, this can be known by doing a complete setup on a separate device. Then, edit the script with the needed apps' identifiers. Following the steps given by wild but before hitting "Accept & Continue" I connect the device over ADB and start the script to detect when the profile is created.
INTERVAL=0.25

echo "⏳ Watching for Work profile creation..."
while true; do
USERS=$(adb shell pm list users 2>/dev/null)

WORK_LINE=$(echo "$USERS" | grep -i "Work profile")
if [[ -n "$WORK_LINE" ]]; then
USER_ID=$(echo "$WORK_LINE" | sed -n 's/UserInfo{$[0-9]\+$:.*/\1/p')

if [[ -n "$USER_ID" ]]; then
echo "Installing"
(
echo pm install-existing --user $USER_ID app.grapheneos.gmscompat #Graphene required service
echo pm install-existing --user $USER_ID app.grapheneos.gmscompat.lib #Graphene required service
echo pm install-existing --user $USER_ID app.grapheneos.gmscompat.config #Graphene required service
echo pm install-existing --user $USER_ID com.android.vending #Play Store
echo pm install-existing --user $USER_ID com.google.android.gms #Google Play Services
echo pm install-existing --user $USER_ID com.microsoft.office.outlook #Microsoft Outlook
echo pm install-existing --user $USER_ID com.microsoft.teams #Microsoft Teams
echo pm install-existing --user $USER_ID com.google.android.contacts #Google Contacts
echo pm install-existing --user $USER_ID com.google.android.apps.nbu.files #Google Files
echo pm install-existing --user $USER_ID com.microsoft.scmx #Microsoft Defender
echo pm install-existing --user $USER_ID com.microsoft.emmx #Microsoft Edge
) | adb shell

echo "🎉 Injection complete. You can now return to your phone and continue provisioning."
exit 0
fi

fi

sleep "$INTERVAL"
done

rawDawg

temp89649681 great news! Will test this out soon! I think i'll put this on github and give credit where it's due unless someone else wants to?

tetto

As of 25NOV2025 on a new Pixel 9 with Graphene build 2025112100, I can confirm:
1) Trying to enroll using Company Portal as-is with no workarounds (scripts, adb, etc) still does not work.
2) Using adb to slip in apps during the device enrollment/work profile creation with Company Portal does work, with one important note:

The window to use adb to load apps as Company Portal is creating the work profile is maybe 1 second. This is significantly different than when I posted my success story a few month back. At that time, I was copying + pasting the adb commands one-by one to load apps. It took me probably 30 seconds but I had no issue doing so. Now, the work profile is "locked down" about 1 second into the profile creation process, then you get 'permission denied' errors with the adb commands. To me, this makes using a script a necessity.

I played with the Interval setting of the script and found 0.05 seconds to be the sweet spot. I went through the process several times to test each interval setting. Since literally milliseconds of time makes a difference, the number of apps varied each time even with the same interval setting, but here's the max number of apps I saw installed successfully:
Interval - Apps
0.50 - 4
0.06 - 5
0.05 - 8
0.04 - 7
0.03 - 7

Here's a list of steps, mostly as a reminder for myself when I have to do this again in a few years:
#Prep

Prepare computer with adb (I chose live booted Ubuntu)
On the owner profile, install any apps you'll want later in the work profile
Prepare script/list of work apps to install (I used temp89649681's iteration)

#Execute

Enable USB debugging and connect phone to computer
Run 'adb devices' to verify the phone is listed
Download Company Portal but don't launch it yet
Enable Exploit Protection mode for Company Portal
Add Company Portal as a Device Admin App
Launch Company Portal and start enrollment
Once enrollment gets to the screen with 'Agree and Continue', run the script
Work profile gets created and the script slips in however many apps it can
Complete enrollment process and away you go!
Note: it got to step 3 'verifying device settings' and acted like something wasn't compliant. I let it sit for ₅ minutes and it cleared itself, allowing me to continue.

Thanks to all who contributed to this! It's wholesome to see people come together to figure out something like this :)

Darki

Hello,
I've successfully onboarded my device into Intunes, I've injected following packages:

app.grapheneos.gmscompat
app.grapheneos.gmscompat.lib
app.grapheneos.gmscompat.config
com.google.android.gms
com.android.vending
com.microsoft.office.outlook
com.microsoft.teams

I see more packages to install (Edge, defender, authenticator). Currently, additional packages can't be installed due to "Install unknown apps" option of play store is disabled. I understand that I need to install those packages in my main profile, edit the script and onboard the device again.

But what if in the future, IT add a new app to install? Do I need to remove the work profile, edit the script and onboard my device again?

drewdatrip

Checking in to see if this has been solved with a native build update rather than some hackery. Desperately want to switch back but need intune company portal for work.
Thanks

tetto

and I just discovered you can make shortcuts to work apps on the owner home screen now! No more going all the way into settings to launch a work app.

Tap and hold a blank area of the home screen > Apps List > 'Work' tab > Tap and drag the work app to drop the shortcut where you want.

Reunite1590

I added some multi-threading to the script and now you can install as many apps as you wish! I also truncated lines into one to make it faster (hopefully). You can open it in vim, go to first line of your script and press capital j until all lines are truncated.

truncated version:

#!/bin/sh
INTERVAL=0.05

echo "⏳ Watching for Work profile creation..."
while true; do
	USERS=$(adb shell pm list users 2>/dev/null)

	WORK_LINE=$(echo "$USERS" | grep -i "Work profile")
	if [[ -n "$WORK_LINE" ]]; then
		USER_ID=$(echo "$WORK_LINE" | sed -n 's/UserInfo{\([0-9]\+\):.*/\1/p')

		if [[ -n "$USER_ID" ]]; then
			echo "Installing"
			adb shell pm install-existing --user $USER_ID com.android.vending & adb shell pm install-existing --user $USER_ID com.google.android.gms & adb shell pm install-existing --user $USER_ID com.microsoft.office.outlook & adb shell pm install-existing --user $USER_ID com.microsoft.teams & adb shell pm install-existing --user $USER_ID com.cisco.wx2.android & adb shell pm install-existing --user $USER_ID com.microsoft.office.excel & adb shell pm install-existing --user $USER_ID com.microsoft.office.word & adb shell pm install-existing --user $USER_ID com.x8bit.bitwarden & adb shell pm install-existing --user $USER_ID com.cisco.anyconnect.vpn.android.avf & adb shell pm install-existing --user $USER_ID com.hibob & adb shell pm install-existing --user $USER_ID org.mozilla.firefox & adb shell pm install-existing --user $USER_ID com.brave.browser & adb shell pm install-existing --user $USER_ID com.android.chrome & adb shell pm install-existing --user $USER_ID com.azure.authenticator
			echo "🎉 Injection complete. You can now return to your phone and continue provisioning."
			exit 0
		fi

	fi

	sleep "$INTERVAL"
done

regular version (might work, didn't test):

#!/bin/sh
INTERVAL=0.05

echo "⏳ Watching for Work profile creation..."
while true; do
	USERS=$(adb shell pm list users 2>/dev/null)

	WORK_LINE=$(echo "$USERS" | grep -i "Work profile")
	if [[ -n "$WORK_LINE" ]]; then
		USER_ID=$(echo "$WORK_LINE" | sed -n 's/UserInfo{\([0-9]\+\):.*/\1/p')

		if [[ -n "$USER_ID" ]]; then
			echo "Installing"
			adb shell pm install-existing --user $USER_ID com.android.vending &
			adb shell pm install-existing --user $USER_ID com.google.android.gms &
			adb shell pm install-existing --user $USER_ID com.microsoft.office.outlook &
			adb shell pm install-existing --user $USER_ID com.microsoft.teams &
			adb shell pm install-existing --user $USER_ID com.cisco.wx2.android &
			adb shell pm install-existing --user $USER_ID com.microsoft.office.excel &
			adb shell pm install-existing --user $USER_ID com.microsoft.office.word &
			adb shell pm install-existing --user $USER_ID com.x8bit.bitwarden &
			adb shell pm install-existing --user $USER_ID com.cisco.anyconnect.vpn.android.avf &
			adb shell pm install-existing --user $USER_ID com.hibob &
			adb shell pm install-existing --user $USER_ID org.mozilla.firefox &
			adb shell pm install-existing --user $USER_ID com.brave.browser &
			adb shell pm install-existing --user $USER_ID com.android.chrome &
			adb shell pm install-existing --user $USER_ID com.azure.authenticator
			echo "🎉 Injection complete. You can now return to your phone and continue provisioning."
			exit 0
		fi

	fi

	sleep "$INTERVAL"
done

Reunite1590

I tried it again because I forgot how horrible the stock keyboard is and it works with non truncated version.

« Previous Page