Work profile widget visibility limitations on newer Android devices

Environment

• Mobile Device Management (MDM)
• Knox Service Plugin
• Devices running Android 14 or higher

Understanding work profile widget restrictions on newer Android devices

On modern Android devices — especially those running recent versions of One UI (such as Galaxy S25 and newer) — admins may notice that work profile widgets aren’t available on the home screen, even when properly configured in their MDM solution.

This behavior can be confusing, particularly when widget allowlists are already defined. However, this isn’t a configuration issue; it’s a result of system-level limitations imposed by Android’s security architecture.

How widget configuration works in Knox Service Plugin

In Knox Service Plugin, admins can define widget controls through Application management policies:

• Widget Allowed List: Specifies which widgets are permitted on managed devices.
• Widget Blocked List: Restricts specific widgets from appearing.

This configuration ensures that only approved widgets can be used on managed devices within your organization.

System-level limitations on Android

On devices running Android 14 or higher, widgets from the work profile are subject to stricter isolation rules:

• Work profile and personal profile operate as isolated containers.
• The home screen launcher typically runs in the personal profile.
• Work profile widgets require cross-profile exposure, which Android restricts for security purposes.

These isolation measures maintain separation between work and personal data, but they also prevent work profile widgets from appearing on the home screen, regardless of your MDM configuration.

Expected behavior

As a result of these Android security measures, work profile widgets might not appear in the launcher even when allowed through Knox Service Plugin policies.

This is expected behavior, not a Knox Service Plugin configuration issue. Android’s enhanced security framework enforces strict separation between work and personal data on enterprise devices, which limits cross-profile widget visibility.