Blog Post

Intune Customer Success
3 MIN READ

Known Issue: Samsung devices are noncompliant after restart or update

Intune_Support_Team's avatar
Intune_Support_Team
Silver Contributor
Nov 10, 2021

Updated 01/02/22:

  • For Samsung Galaxy devices with Android device administrator (DA) management or Android Enterprise personally-owned work profiles, a fix was released in December 2021 (CP Version 5.0.5358.0). With the fix, impacted devices will no longer be marked as non-compliant as a result of the automatic reset. The device will maintain the existing compliance state.
  • This fix only applies to Samsung Galaxy devices showing as noncompliant after an automatic restart for Android device administrator (DA) management or Android Enterprise personally-owned work profiles is applied. Note that this fix does not apply to any managed devices such as Android Enterprise corporate-owned with a work profile, Android Enterprise dedicated devices, and Android Enterprise fully managed (we are continuing to investigate a fix for these devices) compliance issues after a device restart.

We are aware of an issue where some Samsung devices show as noncompliant after an automatic restart or after a managed update is applied. This could potentially affect access to corporate resources, depending on the Conditional Access policies set by the IT administrator. We are working to resolve this issue with Samsung, but in the meantime, we wanted to give you more information and workaround instructions to help you bring devices back into compliance.

 

For Samsung Galaxy devices with Android device administrator (DA)  management or Android Enterprise personally-owned work profiles, this issue occurs when the user runs an automatic restart (Settings > Auto restart at set times) on the device. After the restart, the device shows as noncompliant in Intune, which can block access to corporate resources. This issue affects Android (DA) and Android Enterprise personally-owned work profile Samsung Galaxy devices running Android 9 or later.

 

  • To work around the issue, users need to unlock the phone, launch the Company Portal, and trigger a device sync. Once the sync is completed, the device should show as compliant in Intune and access to corporate resources should be restored.

 

For Android Enterprise fully managed Samsung devices, this issue occurs when the device receives and completes a managed update. After the update, the device shows as noncompliant in Intune, which can block access to corporate resources. This issue affects Samsung devices provisioned as Android Enterprise fully managed devices running Android 11 and later.

 

  • To work around the issue, users need to unlock the phone, open the Device Policy Controller app, and trigger a sync. Once the sync is completed, the device should show as compliant in Intune and access to corporate resources should be restored.

We will continue to update this post as new information becomes available. If you have questions or comments for the Intune team, reply to this post or reach out to @IntuneSuppTeam on Twitter.

 

Post updates

12/08/21: Working closely with Samsung, a fix for this issue will be included in an upcoming Company Portal update.

01/07/22: A fix was released in December 2021 (CP Version 5.0.5358.0). With the fix, impacted devices will no longer be marked as non-compliant as a result of the automatic reset. The device will maintain the existing compliance state.

02/02/22: Updated post with additional clarification that this fix only applies to Samsung Galaxy devices showing as noncompliant after an automatic restart for Android device administrator (DA) management or Android Enterprise personally-owned work profiles is applied.

Updated Dec 19, 2023
Version 11.0
Known Issue

60 Comments

Sort By
Show More
  • Nick_Saris's avatar
    Nick_Saris
    Copper Contributor
    Nov 18, 2021

    These workarounds do not work at all. Thankfully most of my org is iPhones otherwise I would have already cancelled my org's 6+ year Office subscription over this. The more important an employee is, the more essential it is for them to have access to company data through their phone. This is a SERIOUS ISSUE that NEEDS TO BE FIXED. Shocking that this is not even logged as an Active Issue on Azure's "Tenant admin | Tenant status" section. It truly seems like no one is taking this problem seriously. 

  • DBR14's avatar
    DBR14
    Iron Contributor
    Nov 18, 2021

    Larry Torick  you mean this? 

    Because that's how are tenant is set and I've given myself an Intune standalone license, and its still not working. 

  • Larry Torick's avatar
    Larry Torick
    Copper Contributor
    Nov 18, 2021

    1000+ android users.   I was in the process of testing Intune License with their own policies and those were the only ones not affected.   The Android 11 users that were still on 365 MDM that got the update got the device password compliance failure.  Only work around for us has been migrating users to Intune license and applying an Intune MDM policy.    Worked with Microsoft on the 365 MDM issue and still have no resolution other than moving users to license Intune.  

     

    To use Intune your Tenant needs to be converted to use Microsoft Intune as the MDM Authority.  

    endpoint.microsoft.com - tenant administration will show your MDM Authority status. 

  • DBR14's avatar
    DBR14
    Iron Contributor
    Nov 17, 2021

    Geoff_Bernard - We're still seeing it despite the Intune license. For instance I have an E5 with Security & Mobility E5 and a Stand Alone Intune license and my Samsung S10+ Android 11 is still not registering as compliant. 20 some devices right now are registering non-compliant because of this garbage issue.

  • Geoff_Bernard's avatar
    Geoff_Bernard
    Copper Contributor
    Nov 17, 2021

    We've been having this same issue since around October. It was happening with new Android (Samsung) phones as well as ones that rebooted after a security update. All of the devices were registered under Device Administrator. I read someone else got it working by assigning Intune licenses. (We were using the free device management from Office365 for most users.)

     

    As a test, I added a few MS365 licenses instead of Office365 (both E3) and sure enough, all of my non-compliant Samsung phones shows compliant. So there is definitely something up there. It's not affecting Google Pixel or Motorola phones. It's don't understand why licensing fixes it.

     

    <opinion>

    This is something the vendors need to work together on to create a fix for the existing platform without having to purchase additional licenses.

    </opinion>

  • DBR14's avatar
    DBR14
    Iron Contributor
    Nov 16, 2021

    ThPrGX Das ist interessant, weil wir unsere auf nicht konfiguriert eingestellt hatten und alle unsere Samsung-Geräte nicht konform sind. Ich habe es geändert, weil es empfohlen wurde und es immer noch nicht behoben wurde.

  • ThPrGX's avatar
    ThPrGX
    Copper Contributor
    Nov 16, 2021

    Einzig funktionierender Workaround ist im Moment, die Passwortregeln innerhalb der Compliance Policy auf 'not configured' zu stellen.

    Da wir in unserem Setup die die Passworterstellung bereits während des Setups per Configuration Profile erzwingen, stellt das für den Moment kein Problem dar. Ein Entfernen oder Änderung auf eine unsichere Methode ist somit nicht möglich.

    Wir hatten übrigens die ersten Fälle schon sehr viel früher (April 2021).

    Viele Grüße

  • DBR14's avatar
    DBR14
    Iron Contributor
    Nov 15, 2021

    Just FYI your "work arounds" are a complete and utter fallacy. What's goin on with this and why is it not working?

  • DBR14's avatar
    DBR14
    Iron Contributor
    Nov 11, 2021

    RochLafrance There's been an issue with this for far longer than 11/9. I had a bunch of Samsung devices go non-compliant with a password remediation failed error for no reason last week or more.  I think this started at the end of October, its the same password issue -- we do not force a password length minimum, we simply require one be on the personal device to be compliant. 

  • RochLafrance's avatar
    RochLafrance
    Copper Contributor
    Nov 11, 2021

    Je tiens à souligner que ce problème de non conformité depuis le 9 novembre 2021 pour les appareils samsung affecte un de nos appareil qui n'est pourtant pas configuré avec un redémarrage automatique (Auto redémarrer à des heures définies).  De plus, la solution proposée pour contourner le problème (de déverrouiller l'appareil) ne fonctionne pas.  Depuis 2 jours, l'appareil est devenu non conforme et ne peut pas accéder aux ressources de l'entreprise parce que le mot de passe serait trop court (au moins 4 caractères).  Pourtant le mot de passe a plus de 4 caractères et même si nous modifions le mot de passe (avec des chiffres, lettres, caractères spéciaux, etc.), nous avons toujours le même message de non conformité.