Work Profile Not Created for Successful DO (WPC) Enrollments

Environment

• Knox Mobile Enrollment (KME)
• Android 11
• Device Owner (DO) profile: Work profile on company-owned device (WP-C)

Overview

Users using KME to enroll devices into a DO (WP-C) MDM profile are experiencing an issue where the work profile is not being created, but the enrollment is completed without any errors.

Cause

In Android 11, Google made many changes in order to protect user privacy on company-owned devices. One of the changes was the replacement of the device management mode called fully managed device with a work profile with a new work profile on company-owned device.

This profile type requires a certain configuration of the KME profile. If the KME profile configuration is incorrect, then the work profile will fail to be created.

Resolution

During the KME Android Enterprise (DO) profile creation, there are 2 options:

1. Force Device Owner enrollment
2. Let MDM choose to enroll as a Device Owner or Profile Owner

If you are enrolling in a WP-C MDM profile, please ensure that Let MDM choose to enroll as a Device Owner or Profile Owner is selected.

If Force Device Owner enrollment is selected, the provisioning mode is automatically set to PROVISIONING_MODE_FULLY_MANAGED_DEVICE (DO without a work profile) instead of PROVISIONING_MODE_MANAGED_PROFILE (WPC).

Additional Information

To learn more about the different device management modes in Android 11, see the Knox Platform for Enterprise admin guide.