Work profile cannot be created on Galaxy Tab S4

Hi,

I checked my tenant again but I still can't get it working.

My test user has M365 Business and EMS E5 licenses added, managed Google Play is setup, the intune portal app is approved in Google Play and I configured the device registration restrictions to Android=blocked, Android Work Profile=Allowed but still I get the same errors during enrollment via app:
"Work Profile can not be added. Work profile can not be added to this device. Please contact your Administrator."

and

"Device could not be added. To manage your device, you need to approve all system permissions".

To clarify my procedure, I enroll my tablet with the fully managed QR-Code token and as soon as the intune portal app is installed, I try enrolling it with the work profile where the error messages mentioned appear. 

I enabled the developer options on my device and could find 2 suspicious entries in the log file:

...
com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver:

..
userRestrictions:
no_add_managed_profile
defaultEnabledRestrictionsAlreadySet={no_add_managed_profile}

..

It seems that either the user itself has no permissions for creating a work profile or the device was given a false setting.

May I ask which enrollment path you use for your devices Alexander Vanyurikhin ?

Kind Regards

Julian