"Can't add work profile"

[powerappsRocks]

Device: Lenovo Tab M7

OS: Android 9

Issue:

- I (think) I've setup InTune correctly for "Multi-app Kiosk Corporate Owned Dedicated Devices"

- Just unboxed a new tablet

- Installed a QR reader app (there was no native QR reader)

- Scanned the QR code in MEM Enroll devices/Corporate-owned dedicated devices / custom_profile /token

- This then prompted me to download the Android Device Policy app

- Once that opened, it asked me to scan the QR code again

- After that, I receive the error:

"Can't add work profile

A work profile can't be added to this device. If you have questions, contact your admin"

What does this mean and how do I overcome it?

[#2]

Hi,

How is the MDM scope defined and are there any enrollment restrictions configured?

[#3]

@Rudy_Ooms_MVP 

Hi,
I'm unsure where the "MDM scope" is defined in MEM. I did not configure any enrollment restrictions. Appears the defaults are in there:

[#4]

@Rudy_Ooms_MVP ,
I did configure some device restrictions...

Would any of these have a bearing on the issue?

[#5]

And also no changes to the default policy? To be sure your device restrictions are not the issue, you could remove the device/user from the group to test it out?

The device: android 9, isn't android 9 go? I am not sure all apps are working on that edition? could you perhaps test it on another device?

[#6]

RE: Change to "default policy":
- I'm unsure what the default policy is

- The only term "policy" I can find in MEM portal is "Compliance Policy" under /devices/Android

- This is not configured so I assume its "default"(?)

- There is no device/user to remove as the device has never been setup (the subject of this post is stopping me)

RE: Android 9:
- What do you mean by "...isn't android 9 go?"
- I don't have another Android device to test on (procured 4 of these M7 tabs only)

[#7]

@powerappsRocks 

Hi,
The Lenovo Tab M7 runs the Go version of Android 9 (if i believe google ;) )

https://arstechnica.com/gadgets/2018/04/android-go-review-googles-scattershot-attempt-at-a-low-end-a...

A few other things in Android Go have been disabled for performance reasons—or at least, don't work on our ZTE Tempo Go. Most of these are flagship-centric features you would not expect to get on a low-end device.

-Split-screen support. Side-by-side apps are apparently too much for 1GB of memory.
-Daydream VR. Totally reasonable.
-The "Android for Work" work profile.
-Android Wear. No smartwatches allowed.
-Android Auto.
-No on-by-default storage encryption. You can manually enable it though.

[#8]

Thank you for the continued discussion.

So does this mean that the Lenovo TabM7 is not supported by InTune?

Or, do you have further ideas on how I can get this working?

Looks like the only Lenovo tabs that are supported are M10's (https://androidenterprisepartners.withgoogle.com/devices/#!?AER&search=lenovo). 

[#9]

Hi, I guess so, but if you want to be sure you could try it out with another android device. (if you have on of course)

[#10]

Right on. I RMA'd the tab7's in favor of m10's. They'll be here tomorrow and I'll try them out using the same profile.

Thanks again for all the help. I'll report back on findings.

[#11]

Hi,

I was also facing the same issue earlier. As I had another work profile already present on my mobile of my previous employer. I removed it by going into the

settings -> Accounts & sync -> Go down and click on remove work profile.

Then you will be able to add a new one. Most probably this is your issue too.