Device locked due to work policy

AcclaimSublevel19

I went to unlock my phone after leaving it charging unattended and I was asked to use my primary method. Instead of the classic "it's been a while since you last used your password", I got the message "For added security, device locked due to work policy".

This has left me a bit puzzled. I haven't activated any work features on the device, it's only for personal use. Is this message normal? Was it caused by an app?

Xtreix

AcclaimSublevel19 It's normal, If you do not use your primary unlock method within 48 hours, the device will require you to use it. To avoid this, use your primary unlock method in the evening before going to bed.

AcclaimSublevel19

Xtreix I had used my primary unlock method much more recently than that (about 10 hours since this happened). I know the 48 hours behaviour. But this isn't it, I got a different message.

UPDATE to the original post (can't edit anymore): this occurred to all my profiles at the same time.

AcclaimSublevel19

Bumping this thread for visibility

Novalissoide

AcclaimSublevel19

Use your Auditor app, check device integrity.

https://attestation.app/tutorial

AcclaimSublevel19

Novalissoide Use your Auditor app, check device integrity.

I checked, everything is good.

Psyonico Did you turn off auto reboot? I believe it's on by default and by default reboots your phone after 12 hours of not signing in. This would prompt for your full password.

No, I haven't turned it off. IIRC I have it set to 18 hours. I was using the phone very recently before this happened. Also, it would prompt for the owner password first if a reboot had happened.

This happened again today and I'm starting to see a pattern. It seems linked to an Always On Display app I've installed so that it can only turn on when charging. Once I disconnect the charger and AOD turns off, all my profiles are locked. I'm not 100% sure it's this, but it very well could be.

Psyonico

Did you turn off auto reboot? I believe it's on by default and by default reboots your phone after 12 hours of not signing in. This would prompt for your full password.

de0u

AcclaimSublevel19 It seems linked to an Always On Display app I've installed so that it can only turn on when charging.

That seems genuinely quite plausible.

Upstate1618

I think it's about developer options. Apps can make permanent OS modification using developer options which can only be wiped through reset.

AcclaimSublevel19

Upstate1618 Apps need to be given access to connect first. Also, they're disabled IIRC.

EDIT: Apparently they were enabled, but only USB debugging was on, I haven't touched anything else. I turned them off now. I've never granted an app ADB access.

Upstate1618

Do you have mdm? Work profile? Have you grant device owner to apps? Ever used Shizuku?

Notme

Same thing happens when you lock using µLauncher shortcut which requires device admin permission to function.

AcclaimSublevel19

Notme hmm that seems to be it. I guess I'll try keeping it this way and I'll see if it's too inconvenient. Thank you everyone for the help!

Xtreix

Notme I will avoid giving device admin permission to an app. You can lock your device normally on µLauncher without having to give it this permission.

starglider

Do you have Google Play Services installed and Theft Protection enabled? This is the message you'll get when any app with "device admin" permissions locks your phone (the permission sounds scarier than it is; it's mainly giving the app permission to enforce passcode requirements and to lock the device, although some can also wipe the device, too).

If you have Google Play Services installed, I actually think everyone should enable the theft and offline lock features. They're well-designed an non-invasive. If the device is snatched from you and senses a running motion, it'll lock (you need to give Google Play sensors permission). And if it's offline for ₅ minutes, it'll also lock (just happened to me on a flight). Even if it happens by accident, you just type in your pin and unlock like normal (although biometrics won't work; it locks the phone in the style of lockdown, which disables all notifications and requires the primary unlock).

Novalissoide

starglider everyone should enable the theft and offline lock features

Is this only functional when GPlay Services are enabled, with a logged in account? I signed up yesterday, and only now I have that option visible in the Google settings.

starglider

Novalissoide Definitely only available with Play Services installed. I'm not sure whether a logged-in account is necessary, though. I'd imagine that if you can configure "theft protection" settings in Play Services, then it'll be active.

In order to get remote wipe functionality (where you login to https://www.google.com/android/find/), then you'd definitely need to log in on the phone.