We’re happy to announce two improvements for the management of Android personally owned work profile devices with Microsoft Intune, which is now generally available!
A new implementation for how ...
Updated Oct 29, 2026
Version 19.0
Blog Post
10 MIN READ
New policy implementation and web enrollment for Android personally owned work profile is now GA
"As soon as Web based enrollment is enabled new enrolled devices are automatically on AMAPI, right?"
"Can I start moving the existing devices to AMAPI by assigning "Move to Android Management API" configuration and enable Web based enrollment later?"
Based on my tests: Yes and Yes.
Thanks for you reply.
I assigned the configuration profile template "Move to Android Management API" about 2 days ago to my already enrolled personally owned work profile device. After about 1 day the "Intune" app has been installed inside my work profile. But in the report of the configuration profile template "Move to Android Management API" as well as in the general report "Personal devices on Android Management API" it still shows "Move pending". In the Android settings in the "Apps" menu (area "Work") I see system app "Device Policy" with version 161.45.0 (10772060). The work profile has been turnded on almost all the time that last 2 days and I also restarted the phone (Samsung Galaxy S21). Is it normal that it takes so long to reporting "Move pending"?
Our test got stuck on a SCEP certificate that had an error. We collected the logs, gave them to Claude which analyzed it, and found that the migration stopped because of the SCEP profile that didn't work. After we unassigned the faulty profile, the migration went through after just a few minutes on one device, and a few hours on another one.
TLDR; check for faulty config profiles, apps, compliances etc. and collect and analyze the logs from the Company Portal app. If the migration has not gone through after 1 day, something's wrong.Thanks. I removed an AlwaysonVPN connection configuration (JAMF) and shortly after that the AMAPI move worked.
But now I lost all Trusted- und SCEP-certificates as well as the stored SCEP-Certificate-related WIFI connection from the device. In Intune I see the last report modification time for this device of all these lost configurations with a date/time while the AMAPI move didn't work yet and was still pending for 1 or 2 days. Other restriction configurations (like block screen capture) are still (or again?!) applied to the workprofile and I see the last report modification time for this device of all these still/again applied restriction configurations with a date/time after the AMAPI move worked.
I already tried unassigning and reassigning all these lost configurations (Certs/WIFI) but until now they aren't back at the device and the last report modification time for this device of all these lost configurations is still unchanged.All the Cert- and WIFI configurations are the modern way ( I think) --> Platform: "Android Enterprise", Profile type: "Templates", Template name: "Trusted certificate" in Category "Personally-owned Work Profile"
Yesterday a enrolled a device the old way and everthing was fine. Now I assigned the AMAP Move config to this device and a few seconds later I lost all Trusted- und SCEP-certificates as well as the stored SCEP-Certificate-related WIFI connection from the device, too.
I'm wondering whats wrong here.Yeah, seems like there's something off with SCEP and the connection to trusted certs. Luckily, our SCEP was just a test policy and not in use so didn't bother to troubleshoot any further right now. But we got the exact same error as you:
"CA cert config item ...
linked to SCEP config item ...
not found"
Alls configuration profiles and compliance polcies are succeeded. I collected the logs and see:
MigrationReadinessPolicyProcessor
ByodWpMigration: Device is not ready for migration
--------------------WorkflowType=ByodWpMigrationWorkflowType
status=Abandon
errorName=ReadinessStatusNotReady
-----------------------
resourceAccessPoliciesSize: 1
scepCertDataReportsSize: 1
certificateThumbprintsSize: 1
--------------------------
ByodWpMigration: Got 1 SCEP certs.
---------------------------
Adding SCEP cert data report
----------------------------
CA cert config item ...
linked to SCEP config item ...
not found
is it the same like on your side? I'm wondering what could be faulty in s scep cert config which is currently working fine? Or must the scep cert configs be recreated in a new way for AMAPI?
