MS Intune company portal with work profile not working

g0mml

FYI: I tried it using bash using the latest script with an interval of 0.01s and was not able to inject anything.

There has been some movement on github though:
https://github.com/GrapheneOS/platform_frameworks_base/pull/147

like-a-gos

FYI: I tried it using bash using the latest script with an interval of 0.01s and was not able to inject anything.

Yes, I was able to inject using bash successfully about two weeks ago but now it is not working. I wonder if this not working now that we are based on aosp 17.

cadaverco

burningfeelings Hey there burningfeelings, I have all finance apps in another profile simply for segregation purposes, but not sure what you mean by banking apps are "glorified trackers"

Could you elaborate on what privacy concerns you have with banking apps? How are they any more intrusive than say a social media app if you don't give the app access to microphone, camera, location, local files, sensors, etc.?

How do you "abolish" tracking on the apps you use? Is there something I'm missing besides restricting what permissions they have?

Also what do you do about notifications? I ended up caving and enabling sandboxed google play services because otherwise notifications didn't work for any app besides signal. (I tried 'You have mail!' for awhile which queries protonmail on your behalf and notifies you of any new emails without needing google play services, but I still had no solution for snapchat which I heavily rely on for communication w friends)

temp4685687

like-a-gos Yeah, recently the script injection method no longer works. When running the script I am get this error below. It's a shame as after an update, Intune somehow detected that my "device is rooted" and I have to remove the work profile.

System.Management.Automation.RemoteException
Exception occurred while executing 'install-existing':
java.lang.SecurityException: Shell does not have permission to access user 10
 com.android.server.am.ActivityManagerService.handleIncomingUser:14773 android.app.ActivityManager.handleIncomingUser:5618 com.android.server.pm.PackageManagerShellCommand.translateUserId:4124
        at com.android.server.am.UserController$$ExternalSyntheticBUOutline1.m(R8$$SyntheticClass:0)
        at com.android.server.am.UserController.handleIncomingUser(UserController.java:3467)
        at com.android.server.am.ActivityManagerService.handleIncomingUser(ActivityManagerService.java:14773)
        at android.app.ActivityManager.handleIncomingUser(ActivityManager.java:5618)
        at com.android.server.pm.PackageManagerShellCommand.translateUserId(PackageManagerShellCommand.java:4124)
        at com.android.server.pm.PackageManagerShellCommand.runInstallExisting(PackageManagerShellCommand.java:2037)
        at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:268)
        at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97)
        at android.os.ShellCommand.exec(ShellCommand.java:39)
        at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onShellCommand(PackageManagerService.java:7088)
        at android.os.Binder.shellCommand(Binder.java:1102)
        at android.os.Binder.onTransact(Binder.java:960)
        at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4910)
        at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:7072)
        at android.os.Binder.execTransactInternal(Binder.java:1417)
        at android.os.Binder.execTransact(Binder.java:1364)

Johnnyloans

temp4685687 Intune somehow detected that my "device is rooted" and I have to remove the work profile.

The fix was here:

fid03

As to your issue temp,

My experience with removing profiles is: that user # is gone. #10 is the next profile after owner.
So, your old work profile was probably 10. Now I think you need a new number.

(Based on my experience with GOS never re-using user #s after a profile is deleted, so maybe there's a limitation there.)

degoogler

temp4685687 For what it's worth this is the exact same issue I am running into. I checked with "adb shell pm list users" that the work profile is indeed user #10, so this appears to be a permissions issue not so much a "user does not exist" issue.

[Edit] I am now using the old workaround of installing Shelter to create the work profile and having Intune setup fail to complete and it's working for now but this setup tends to fail on me in a week or less. Interestingly the profile Shelter created is #12 even though I made sure to delete #10 after the Intune setup failed.

AncientWisdom

Gah.... I woke up this morning and saw Teams wasn't working (after phone update) and without thinking uninstalled it thinking re-installing might fix the issue, and only then remembered I can't reinstall it...
Came here to look for the steps to get it working again and now I see it's not working in Android 17... Fark me 🤯

fid03

AncientWisdom wasn't working

I could make a hundred guesses, but if you posted this looking for advice on how to potentially solve the issue, people will need more information on what's happening beyond "not working". There are no reports of it not working with Android 17. If you got the message about the device being rooted, then you need to disable secure app spawning for the Intune app.

Norman

I can confirm MS Teams is working for me on a non-Owner profile with the following exploit protections disabled:

Memory tagging (because Microsoft is a small company that can't make their applications memory safe)
Native code debugging (you can leave this on blocked but it sometimes causes issues)
Dynamic code loading via storage (set to allowed)

bedub1

Is there a plan to get this working natively in GrapheneOS, without these scripts and work-arounds?

de0u

bedub1 Is there a plan to get this working natively in GrapheneOS, without these scripts and work-arounds?

I do not believe the GrapheneOS project has announced any plan to invest developer resources in this area.

I believe the project did express interest in community-contributed code, as long as it were of high quality. I believe some code was submitted that did not get very far in review, and that revisions were not submitted.

One thing to keep in mind is that there is a substantial testing and support burden. There are multiple MDM products, and most of them require somebody to pay for administrator access to configure profiles and deploy them onto devices. So it's possible that as a practical matter even if awesome-looking code were contributed then the GrapheneOS project would need ongoing access to MDM administrator portals.

AncientWisdom

fid03 "Not working" meaning can't use the scripts to inject the apps during InTune setup in Android v17

cartsa

Hello all.

I am a new owner of the pixel 10a, so my starting point was a freshly installed graphene os.

Like many of you, I need to have an enrolled work profile using company portal.

I tried using the method shared by @entangled.

However, as also reported by @temp4685687, I ran into the work profile being immediately "locked down", as indicated by the following error message, which repeated for each individual package:

System.Management.Automation.RemoteException
Exception occurred while executing 'install-existing':
java.lang.SecurityException: Shell does not have permission to access user 10
 com.android.server.am.ActivityManagerService.handleIncomingUser:14772 android.app.ActivityManager.handleIncomingUser:5618 com.android.server.pm.PackageManagerShellCommand.translateUserId:4124
        at com.android.server.am.UserController$$ExternalSyntheticBUOutline1.m(R8$$SyntheticClass:0)
        at com.android.server.am.UserController.handleIncomingUser(UserController.java:3467)
        at com.android.server.am.ActivityManagerService.handleIncomingUser(ActivityManagerService.java:14772)
        at android.app.ActivityManager.handleIncomingUser(ActivityManager.java:5618)
        at com.android.server.pm.PackageManagerShellCommand.translateUserId(PackageManagerShellCommand.java:4124)
        at com.android.server.pm.PackageManagerShellCommand.runInstallExisting(PackageManagerShellCommand.java:2037)
        at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:268)
        at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97)
        at android.os.ShellCommand.exec(ShellCommand.java:39)
        at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onShellCommand(PackageManagerService.java:7091)
        at android.os.Binder.shellCommand(Binder.java:1102)
        at android.os.Binder.onTransact(Binder.java:960)
        at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4910)
        at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:7075)
        at android.os.Binder.execTransactInternal(Binder.java:1430)
        at android.os.Binder.execTransact(Binder.java:1377)

Hopefully, someone finds a new way to enroll successfully.

r_saravanan

Hi, came across this yesterday - Pixel 7, Android 17 (Panther) build, same issue. I tried installing InTune directly into the owner account as well - same result (SecurityException). Will play around more later in the day, but this is my biggest blocker to switching fulltime to Graphene. :(

r_saravanan

I'm willing to assist with debugging/running commands, etc. and my time - if I can get someone to tell me what to do.. I think we all just need a way to get the 'approved' apps from company setup, then we can be free of Google's limitations on to a more secure OS.

r_saravanan

AncientWisdom yes

« Previous Page