Huawei and Android Work Profile

[Thomas Førde]

We have many users that want to purchase Huawei as a preferred personal phone in our company, and i have recently purchased a P20 Pro with Android 8.1 to test in my environment for Android Work Profile.

Now i have configured everything after specs, with managed google play and approved what needs to be approved, but attempting to enroll the device, it stops at the "Halfway there" page, and then nothing happens.  Is there a problem enrolling Huawei devices with a Work Profile? 

The specifications to Google merely says Android 5.0 as a minimum requirement.

So what am i doing wrong, or is Huawei not supported for this?

[#2]

Hi Thomas,

I sorry but I did not tried to enroll to enroll a P20 since September last year so I could not say if there is a specific problem for the moment.

I remember, that I have experienced some glitches including with the Intune company portal.

You can try a factory reset on your test device which, of course might be difficult to perform on an "in-use" personal device, and start again.

A few questions:

• Did you try to "soft reset" (shutdown) the P20 and start again ? I know it seems stupid but it helps sometimes.
• Did you try, to remove the company portal and install it again from your user account google play store?
• Do you use EM+S with Mobility (MDM and MAM setup) and it is setup correctly ?
• Are the user account you use to enroll your device able to join devices to Azure AD?
• Are enrollment restrictions configured to Allow android for Work profile and the correct version number (if configured)?
• Did you set conditional access policies?
• Did you approved the Intune company portal in Google Play store
• Did you deployed the Intune Company portal to your test user account ?

Kr,

[#3]

Since this is a phone for testing, i can pretty much to what i want too it:)

I have done at least 5 factory resets when testing, each attempt failed at the same level using Android Work Profile.

So i assume hard reset is more effective then soft reset, so that should answer those questions.

EMS License is added, and this this the enrollment process, MAM is not in the loop, we only use MDM.

This device is isolated to the Work Profile restrictions for this specific test user as other devices use the normal Android enrollment process. Min version number is set to 5.0+ so it should be good. 

Managed Google Play is configured in Intune, Company Portal, Outlook and and Authenticator are approved as apps for this purpose.

Everything seems in order, the process hangs when The personal company portal seems to try and launch the work profile company portal to install this.

After reviewing many google searches/twitter, it seems MS is aware that this is a problem, so it might be a Huawei issue.

[#4]

In past I have seen issues with Android legacy device management on Huawei devices.  Google provides Android Enterprise (AFW) recommended devices and Huawei P20 Pro is listed so technically it should work in countries outside China. 

https://www.android.com/enterprise/device-collection/#android_enterprise_recommended 

[#5]

Yes, Technically it should, but it doesnt yet.

Im waiting for the Android Pie to come out, should be around the corner now i hope, since they are a bit delayed.

but if Pie also fails, i will have consider this a failure for AFW policy config.

[#6]

@Thomas Førde 

Hello Thomas, I had the same issue, its one bug with HUAWEY phones.

If I understand you well, with Intune company Portal application you can not enroll on Intune?

Problem I solved with battery settings on the Huawey device.

Going on Settings--> > Battery--> > Launch--> > (exclude Company Portal that manage automatically) set up manage manually. and click OK.

I hope it helped you

[#7]

@Matej_Brcic 

Im still waiting for Android Pie as it might fix the bug. This is enrollment with the Android for Work Profile that is not working.

and until it do, i cant allow Huawei Purchases internally..

[#8]

Hi @Thomas Førde 

Gather an adb bugreport and raise a ticket with Huawei (I would not wait for Android Pie to fix this fault)

https://developer.android.com/studio/debug/bug-report#bugreportadb

The bug report output will be fairly lengthy, however should contain some clue as to why it stopped working.

You may also want to check in with Microsoft Support to see if they have seen this issue before.

,Andrew

[#9]

sure, but i hate the typical its been fixed in Pie, or we dont do bugfixes to Android 8, when 9 is just around the corner somewhere. I rather just wait until 9, and then do the bugreport, although i dont have high hopes for any of them.. but it could quite possibly be one of reasons why the release was delayed. Time will tell.

[#10]

@Thomas Førde 
I'm actually using P20 Pro as my daily driver configured with work profile. And that was configured on Android 8 and continued to work with Android 9 without any issues.

[#11]

Maybe something changed with Intune enrollment during this time. Ill try again tomorrow and see if anything has changed since last.

[#12]

Hi,
@Thomas Førde 

Any news?

I have probably the same problem on some Huawei P9 lite and P10 lite devices. They cannot create Work Profile successfully... It may happens after some Android update (I guess...).

tt

[#13]

@Tomas Tuba  No.

Im going to go through my setup here, so if anyone reads something that might be off.

1. I have created a seperate Device Type Restriction profile that has only 1 purpose. The only platform allowed is Android Work Profile, and Android 5.0 including Personally owned allowed. This profile is assigned to the test person.

This test person downloads company portal and install on a newly updated Huawei P20 Pro, with 9.0.0.236 OS installed.

I get the following error now. se attachment

[#14]

@Thomas Førde this device is fully managed through AE?

[#15]

@Alexander VanyurikhinExplain please?

I Have followed https://docs.microsoft.com/en-us/intune/connect-intune-android-enterprise and configured everything according to the specifications.

And device is listed in the directory.

https://androidenterprisepartners.withgoogle.com/device/#!/5759180434571264

This is a brand new phone, never been registered before, and attempting to registered it with the Android Work Profile enrollment, not Android Enrollment.

https://docs.microsoft.com/en-us/intune/android-work-profile-enroll If i set Android Work Profile as allowed, and Android as Block, it states it will try and enroll all Android Devices as conventional Device if AWP doesnt work.

Since conventional Device registration is blocked, i belive that i causing my error.. hence, Logic dictates Work Profile doesnt work.

or is my Logic wrong?

[#16]

@Thomas Førde 

I tried register issued device with the Android  enrollment, not Android for Work Enrollment (Restrictions: Android Allowed; Android 4 Work disallowed) with no success.

Only I can set to this device, are MAM policies and assign them to apps...

It looks like bug in Intune MDM..

[#17]

Hi @Thomas Førde 

Based on what I have read so far I would not jump to Intune being the issue (well not a bug anyway).

You have setup Android Enterprise and want to use Work Profile (do not use the traditional Device Admin setup), other users have this device model working with Intune and it is listed as Android Enterprise Recommended on googles site (this is a very small list and takes a lot more work to get the AER badge).

Next steps;

• Test another device against your Intune config (not the same make/model, a similar OS version would be ideal but not necessary)
• Get the log from Email Support when you have the enrollment issue (as per screenshot)
• Generate a bugreport and take a look

Also;

• Make sure you have licences for enrolment (second test device enrollment will help understand if this is an issue)
• Enrollment Restrictions, start with just the Defaults and only allow Android work profile and not Android without any additional restrictions (i.e. OS, Personally Owned). I have seen some restrictions cause problems.
• Make sure you are not blocking enrollment via any other method (Conditional Access)

Last;

• Log a job with Microsoft Support

[#18]

@AndrewDawson 

We have setup Android Enterprise and restrictions.....

We have many models and types of mobile devices and now only HONOR X, HUAWEI P20 Pro, P10 lite and P9 lite are issued..

HONOR and HUAWEI P20Pro are brand new devices..

HUAWEI P10 lite  was SUCCESSFULLY enrolled to Intune and used from 2/2018 in our Company. After 3/2019 work profile on this device stopped working and now its impossible to enroll this device..

I also tested this issue on old HUAWEI P8lite and there wasn´t any issue with creating Work Profile.

So i thing it is bug in Intune after some update on some versions of Android OS.

[#19]

Interesting to see the client logs and bugreport, let me know what support say about the issue.

Remember bugreport are very useful and pretty much required in all Google AE escalations.

[#20]

@AndrewDawson Did you manage to solve the issues with P20 phones?