I am developing an Android Enterprise solution where I provision devices as fully managed (Device Owner) using the Android Management API. My requirement is to install my own custom CA certificate into the system trust store so that all apps on the device will trust it automatically — not just apps that trust user-installed CAs. So the problem is that even on a fully managed (Device Owner) device DevicePolicyManager.installCaCert() only installs into the user CA store. Many apps using network security config with trust-anchors restricted to system do not trust user-installed CAs. In the Android Management API policies docs I haven't found any options that will allow me to do that either. There appears to be no way via Android Management API to install my CA into the system store after provisioning. Is there any current officially supported method in Android Management API to install a system CA (not user CA)? If not, are there any other methods to achieve that(I don't consider using root for this, as it may break overall user experience using other apps and services).

To access corporate applications, I requested my company's system administrator to grant me access. They instructed me to install certain security apps (such as "CA Mobile"), install security certificates, and complete a profile installation process on my device. After following these steps, I gained access to all corporate applications, and a "work profile" was created on my device. Now, I no longer require corporate access and wish to completely remove this "work profile" and all associated administrator permissions from my device. Currently, some device options remain "Disabled by admin" indicating residual administrator control. I already attempted to uninstall the security apps I initially installed, but the work profile remains, and administrative restrictions are still active on my device. I do not wish to perform a factory reset since I have many personal apps and data on the device. My goal is simply to: 1. Completely remove the work profile. 2. Eliminate any remaining administrator permissions. 3. Restore full control over my device settings without any restrictions. If necessary, I’m open to using utilities, ADB commands, or other recommended tools. Could you please guide me on - what could be done here?

I was reading on the Knox platform enterprise documentation online and I came across a policy that takes an action upon OS tamper detection. Also on another site (Knox manage 24.09 release notes ) it just says that this option is recently introduced with the 24.09 update to the Knox manage client. So my question here is, Does this policy **only apply** or **take effect** if Knox manage client is installed?, assuming someone managed somehow to tamper with the OS and bypass the factory reset protection, and managed to flash a custom firmware or something else, will the device get locked down without Knox manage client installed?

I’ve been experiencing a severe security breach where individuals have hacked into both my Android and Linux devices. They have access to all my online and offline activities, including my social media accounts, Gmail, WhatsApp, call logs, and SMS. Despite resetting my phone multiple times and enabling two-factor authentication for all my accounts, I am still unable to remove these intruders. I’ve also used the paid version of Bitdefender for malware protection, but it hasn’t detected any malware. I am confident that the intruders remain in my system. To check if my phone is still compromised, I posted a story on Instagram and used the 'Close Friends' feature to share it only with my other account. However, I discovered that the intruders were still able to see the story. Additionally, they have made comments about my personal online activities that they should not have known about. What further steps can I take to ensure that my devices are fully secure, and how can I conclusively verify that the intruders are no longer accessing my information?

On a device running Android 13 (LineageOS 20), I created a managed user profile to separate work apps from the primary user's personal apps: pm create-user --profileOf 0 --managed Work Also applied a few restrictions to limit privileges in the work profile:

pm set-user-restriction --user 10 no_sms 1
pm set-user-restriction --user 10 no_outgoing_calls 1
pm set-user-restriction --user 10 no_config_location 1
pm set-user-restriction --user 10 no_config_wifi 1
pm set-user-restriction --user 10 no_config_bluetooth 1
pm set-user-restriction --user 10 no_config_mobile_networks 1

(Reference: [android.os.UserManager](https://developer.android.com/reference/android/os/UserManager)) The work profile got successfully created and appeared in settings, and its apps as a second tab in the launcher. I kept the bare minimum set of system apps (pm uninstall --user 10) and moved work-related apps to the work profile (pm install-existing --user 10) and everything seems to work fine. But there is a problem - If I minimise any app from the work profile and go to recent apps, I only see apps from my main profile (user ID 0) but the apps from my managed profile (with the 💼 icon) do not appear at all. But if I tap on the app in the launcher, it does resume exactly where I minimised it, which indicates that the app is running. I am able to see entries appearing in /data/system_ce/10/recent_tasks for minimised apps however the snapshots folder stays empty for some reason. Another observation is that when I create a managed profile using an app like [Island](https://play.google.com/store/apps/details?id=com.oasisfeng.island) , all its apps do appear in the recents. I am unable to figure out what to do to make it work with the manually created managed profile. I have already tried setting allow_parent_profile_app_linking to true but it didn't fix it.

I recently had a problem with merging all the data from two phones (one personal and one for work) into a corporate owned personal work profile dual-sim phone. Here, importing the contacts for the work profile was a problem. Importing via file, transferred via the work-profile OneDrive app did not work. So, the next attempt was to store all contacts on the SIM card of the old work phone and move the (work) SIM into the new dual-sim phone. However, the contacts stored on the (work) SIM show up in the personal-profile contacts only. Is there a way to associate a SIM card with a profile? E.g. SIM1 is personal and SIM2 is work, so that the personal contacts app only shows contacts stored on SIM1? This would also apply to SMS, e.g. handling SMS received from the work SIM by the messages app of the work-profile.

We're trying to configure Intune so that people with Android devices can access their corporate email through Outlook for Android. In the Access Requirements blade (dashboard > client apps- app protection policies > intune app protection - properties), we've activated PIN (including simple PINs) and fingerprint for accessing the apps. Whenever a user tries to access the corporate email through Outlook, it's prompted to install the Intune app (company portal app) from the store. After doing that, the user is asked for a PIN after setting up the corporate email account in Outlook. After the specified timeout, the user will be asked for a PIN again. However, the app never allows the users to use fingerprints to unlock the app. It will only allow the user to enter the PIN. The Intune portal seems to imply that I should be able to use a fingerprint (instead of a PIN) to access the mail, but we've tried it on a couple of Android Devices (OnePlus 3T and 5T) and the fingerprint option is never shown. Any ideas on what's happening? Thanks.

After enrolling my Android device in the Intune company portal, I removed it from the company portal. Now, if I install any APK from other sources downloaded via Chrome, it keeps saying > Unkown apps can't be installed by this user. I tried to go to Settings -> Install unknown apps -> Files by Google -> Allowed, still the same error. Device admin apps are all off. Still getting the same error. --- This may answer it: https://support.google.com/pixelphone/thread/249737257/unknown-apps-can-t-be-installed-by-this-user

I am using Nusantara ROM (Android 12) and my device is RMX2193. The device isn't managed by an enterprise so I can't understand this Digital Wellbeing shows

timers aren't available for work apps or fully managed devices

Please note that app timer is no longer a Pixel exclusive feature since the last few years. See the bottom-most part of the screenshot " class="img-fluid rounded" style="max-width: 100%; height: auto; margin: 10px 0;" loading="lazy">

I'm looking for some solutions about managing a fleet of mobile devices, but I found that all the documents is about how to communicate with androidmanagement.googleapis.com. But I want to know more about how to communicate with the device directly. Basically my question: Is it possible to self host a androidmanagement.googleapis.com service?

I can't unlock my Samsung S10e after enabling my company's work profile. I learned [from here](http://eskonr.com/2020/11/the-case-of-unexplained-android-enterprise-work-profile-password-in-intune/) that this is because my work profile password has usurped my personal passcode for my unlock screen. Further complicating things is that I restarted my phone and everything is very locked down. Is there any way I can either remove the work profile or at least access the files on the phone before I do a factory reset? I have tried called my company's tech support but they claim that what has happened cannot happen and when I ask them to reset the work profile password (which I never knew and none of my work passwords work), they say that they don't have that ability. They have claimed that they have revoked my phone's permissions to have a work profile, but the problem still persists. I have tried letting my phone die and then charging it back up to see if maybe it was some kind of caching issue. No dice. Does anyone have any ideas? As long as I can recover the data on the phone I'm will to try jail breaking it or basically anything. Edit: For clarity, this is my personal device and my company requires a work profile to use various apps with my company issued email address. That is why I enabled it when prompted.

My organization has several phones which I would like to setup for employee use. It appears that the Google Admin app has this functionality but requires a Google Cloud subscription. If possible I would like to know what my alternatives are. I want to be able to manage what apps are installed on the devices and allow app installs but be able to at least monitor what is being installed allong with basic features as an admin.

My phone can't be rooted but I want to MITM my own traffic. Is there any downside to enrolling my device as a managed enterprise device and installing a certificate through the program? It [seems possible](https://docs.sophos.com/central/Mobile/help/en-us/esg/Sophos-Mobile/references/ConfigurationRootCertificateAfW.html) , but I have not come across this solution anywhere on the internet so I was wondering if there is a downside.

So I added a work related Google for enterprise account but it's now showing up along side my personal accounts. I know there is a way that the enterprise admin (which is not me) can force the account to be separated from my personal accounts (different gmail/calendar/drive apps, separate file spaces, restrictions on transferring data, etc.), but they seemed to have not elected to do that. Is there any way **I** can cause that to happen without having to involve them? --- Note: I've found the option for adding multiple users, but that's not what I'm looking for as that seems to be a only-one-is-logged-in-at-a-time thing where as the thing I've used before has only one session just with duplication and isolation of the apps.

The organization I work at has added the option of using Android For Work (AFW) aka Android Enterprise (AE). Under this setup I have two profiles: private and work. These are completely separate spaces, so apps installed in one profile aren't available in the other, and files are kept separate. Even Android's _share_ functionality is separate, so I can't share a file I received at work to my private profile. The only thing that I've seen that is somewhat shared is the phone app. When I search for a contact, I get results from both work and private profiles. The question is, is there any way to view my work and private calendars together? While the profiles are separate, there is only one me, so I would like to be able to see all my schedule constraints in one place. Is there any way to do this?

I got the following email from my employer: > Passwords required on all mobile devices > > > > In order to protect College data stored on portable devices, from > Tuesday 20 November ICT will enable a feature which requires all > mobile devices (Android, iOS phones and tablets) used to access > College emails to be protected with either a PIN password or biometric > recognition, such as fingerprint or face recognition. This applies to > all portable devices, whether College or personally owned. > > > At a minimum, ICT will enforce the use of a PIN for access to the > device. Devices that do not meet the minimum requirement will be > prevented from accessing College email accounts until the device has > been appropriately secured. > > > You can manage your security settings from the ‘settings’ menu of your > device. Please get in touch with the Service Desk if you have problems > doing this. If you do not wish to secure your device, then you may not > be able to access your College email account from your Is there a feature in Android that I don't know about that will enable them to change the settings on my phone? # EDIT **The Plot Thickens** On my way to work this morning popped up on my phone screen when I tried to check my meetings for the day. Now I am worried. I don't want to give my work admin access to my personal phone. What will they be able to do? Delete my emails? Reset the phone? Lock me out of the phone? Track my location? I can see how this is fine on devices supplied by an employer but it normal for personal devices.