MDM/EMM & GrapheneOS compatibility

DeletedUser177

I'm wondering whether GrapheneOS is capable having a device enrolled in MDM or EMM such as Microsoft Intune, Google Workspace, Zero Touch Enrollment, Samsung SDS and other 3rd party & open source MDM/EMM solutions, without having to build from source. I am hoping the answer is no, that GrapheneOS isn't compatible, for reasons I can elaborate upon further once I receive a response. But in short, an employer forcibly employee devices while no corporate apps were used on the device in a BYOD environment. We all know and likely concur that the employer should provide the device and forced enrollment is unethical and invasive. They're ruthless. I cannot have that happen to my personal device, again. Pm list users on a previous device revealed I was running as user 'B' and not '0', when there was no indication of a secondary profile installed. I ended up having to sift through 100 000 log lines from the Mobile Verification toolkit from Amnesty International and can extrapolate on what my findings were. The 'DumpsysActivities.json' file revealed some very disturbing results --Zero touch enrollment primarily. Keep in mind there is no corporate data on the device and it belongs to me so using this tool isn't illicit or unethical. Anyways, I suspect the only way to get MDM to work on GrapheneOS would be to use ADB and DPM commands and install an MDM apk. If there is a means to enroll a device, please advise on ways in order to prevent enrollment including but not limited to NFC "bump" enrollment, Google workspace, Intune, Samsung SDS (highly sophisticated), QR code, Zero touch etc. Any experiences with successful and unsuccessfull enrollment attempts would be great.

DeletedUser237

From the previous thread about it, it looks like you can't enroll it, yet there's an attempt to fix it.

As for your 'issue' at hand I think you're trying to solve it from the wrong angle. I don't see why you'd need to enroll the device in their MDM. If it is for MS Auth it works without it. If it is for Outlook (teams do not need mdm) simply refuse to install it.

DeletedUser177

DeletedUser237
DeletedUser237

Thanks for your reply! They didn't state in their policy it would be enrolled and lied about it. It was for Outlook and Teams and a few other none MS apps. Never once did I use outlook but had to use the work email which is Outlook, to login into an authenticator app with the email for an OTP...Was Game over after that. I will refuse to indeed thanks again !! Any idea on how to approach an employer who will not unenroll a personal device and denies its enrollment? My phone other phone is unsuable, it isnt a google device, spoke to google and the manufacturer and they both said your device is using a personal gmail account but its a corporate device enrolled in MDM. Deleted the google account, changed phone numbers, factory reset, hard reset , Ive tried it all and it still is enrolled with serial number or IMEI. IT department seems to find it funny because they're a bunch of assholes.

de0u

DeletedUser177 If it is possible to install and activate an MDM app without user intervention (edit: meaning that the user unlocks the device, installs and launches the app, and agrees to activation) that would be a gigantic hole. A claim of that happening would ideally be based on very strong evidence that can be verified by experts. For starters, the MDM app would need to be present on the device.

Note that having an MDM app installed on a device and managing the device is different from having an authenticator app installed on a device. Authenticator enrollment is not MDM enrollment and routinely happens without MDM enrollment.

Is it possible to describe the evidence that the device in question had an MDM app installed and activated?

DeletedUser237

DeletedUser177
de0u

Let's get some things out of the way, Authenticator app (the MS one) does not require MDM, Outlook however does. You did not say whether you installed it or not on the phone, so I am going to skip this part for now, until you clarify this part.

Also, there is no way for your org to install anything on your phone just because you installed the auth app. However, there's a prompt that asks you if you want to sign-in just to this app or to all apps and there's another prompt asking if you want to allow your org to manage your device. If you wanted to quickly get through the install process, and haven't read the prompts, you may have allowed to it unintentionally..

This would pull Intune mdm module and make it device admin permissions. Without it your org can't manage your device or install anything.

Wiping the device removes the components and it can't be reinstalled automatically, there's no such feature in Intune.

I'd recommend you check the device admin settings + list of all apps, IMEI or anything like that is not what is used to enroll to MDM portal or re-enroll.