How to enforce a password policy during enrollment for company-owned devices with a Work Profile

Environment

• Knox Manage
• Android 11 and higher
• Company-owned Android device with a Work Profile
• Strict password policies for both personal and Work Profiles

Overview

If you have a fleet of company-owned Android 11 and higher devices that require Work Profiles and a strict password policy, it's possible for the device user to accidentally render the device or some of its features unusable. During enrollment with a strict password policy, the device prompts the user to set locks for both the personal profile and Work Profile. However, on Android 11 and higher, if the device is rebooted for whatever reason before the locks are set, Managed Google Play functionality might be inhibited, or worse, the device might become bricked.

This article provides insights about how to avoid this risk. We highly recommend that you incorporate this information into your enterprise deployment process.

How do I enforce a password policy when enrolling a company-owned device with a Work Profile?

When a company-owned device with a Work Profile is enrolled with a strict password policy:

1. The device user begins the appropriate enrollment method.
2. The KM agent prompts the device user to set a lock for both the primary profile and Work Profile. The agent provides DEVICE SCREEN LOCK SETTING and WORK PROFILE LOCK SETTING buttons to facilitate this step in the flow.
3. The device user sets both locks, which must comply with the applied password policy.
4. The device user taps Finish on the Finish Setup screen, and the device enrolls.

The following scenarios can occur if the device is rebooted before step 2 is complete. Each scenario's consequences and solutions differ depending on the Android version.

The device user doesn't set both locks, and the device is rebooted

System	Consequence	Solution
Android 11	Android starts without resuming the enrollment process. Neither profile is protected by a lock.	The device user must manually set both locks through the default Android and KM methods.
Android 12	The enrollment flow resumes.	The device user must set both the locks through the enrollment process.

The device user sets the Work Profile lock, and the device is rebooted

System	Consequence	Solution
Android 11	Android starts without resuming the enrollment process. Managed Google Play doesn't start or sync the KM profile's apps until the Work Profile is unlocked. The device notifies the user that system setup is still in progress, and when they tap the notification it prompts them to set a lock for the personal profile.	The device user must unlock the Work Profile.
Android 12	The device becomes bricked.	A support provider must factory reset the device with hardware keys.

The device user sets the Work Profile lock, taps Finish, and the device is rebooted before enrollment completes

System	Consequence	Solution
Android 11 and higher	Android starts without resuming the enrollment process. Managed Google Play doesn't start or sync the KM profile's apps until the Work Profile is unlocked. The device notifies the user that system setup is still in progress, and when they tap the notification it prompts them to set a lock for the personal profile.	The device user must unlock the Work Profile.

Additional information

• Android Enterprise password policy group
• Enroll a single device