Back to top

How to enforce a lock screen policy during enrollment for company-owned devices with a work profile

Last updated December 13th, 2023

Categories:

Environment

  • Knox Manage
  • Android 11 and higher
  • Company-owned Android device with a work profile
  • Strict lock screen policies for both personal and work profiles

Overview

If you have a fleet of company-owned Android 11 and higher devices that require work profiles and a strict lock screen policy, it’s possible for the device user to accidentally render the device or some of its features unusable. During enrollment with a strict lock screen policy, the device prompts the user to set locks for both the personal profile and work profile. However, on Android 11 and higher, if the device is rebooted for whatever reason before the locks are set, Managed Google Play functionality might be inhibited, or worse, the device might become bricked.

This article provides insights about how to avoid this risk. We highly recommend that you incorporate this information into your enterprise deployment process.

How do I enforce a lock screen policy when enrolling a company-owned device with a work profile?

When a company-owned device with a work profile is enrolled with a strict lock screen policy:

  1. The device user begins the appropriate enrollment method.
  2. The Knox Manage agent prompts the device user to set a lock for both the primary profile and work profile. The agent provides DEVICE SCREEN LOCK SETTING and WORK PROFILE LOCK SETTING buttons to facilitate this step in the flow.
  3. The device user sets both locks, which must comply with the applied lock screen policy.
  4. The device user taps Finish on the Finish Setup screen, and the device enrolls.

The following scenarios can occur if the device is rebooted before step 2 is complete. Each scenario’s consequences and solutions differ depending on the Android version.

The device user doesn’t set both locks, and the device is rebooted

System Consequence Solution
Android 11 Android starts without resuming the enrollment process. Neither profile is protected by a lock. The device user must manually set both locks through the default Android and Knox Manage methods.
Android 12 The enrollment flow resumes. The device user must set both the locks through the enrollment process.

The device user sets the Work Profile lock, and the device is rebooted

System Consequence Solution
Android 11 Android starts without resuming the enrollment process. Managed Google Play doesn’t start or sync the Knox Manage profile’s apps until the work profile is unlocked. The device notifies the user that system setup is still in progress, and when they tap the notification it prompts them to set a lock for the personal profile. The device user must unlock the work profile.
Android 12 The device becomes bricked. A support provider must factory reset the device with hardware keys.

The device user sets the Work Profile lock, taps Finish, and the device is rebooted before enrollment completes

System Consequence Solution
Android 11 and higher Android starts without resuming the enrollment process. Managed Google Play doesn’t start or sync the Knox Manage profile’s apps until the work profile is unlocked. The device notifies the user that system setup is still in progress, and when they tap the notification it prompts them to set a lock for the personal profile. The device user must unlock the work profile.

Additional information

Back to KBAs

Is this page helpful?