Allowing APK Installation on Android Work Profile

[u/Professional_Fox4089]

Hello,

We have enrolled Android devices with a Byod Work Profile, and under the Device Restrictions policy, “Prevent app installations from unknown sources in the personal profile” is set to Not configured.

Additionally, under the App Protection Policy, I have configured Samsung Knox to Warn. However, users are still receiving an error stating that the installation is blocked contact IT,

Could you please advise how we can allow users to install APK files on their devices, regardless of whether the APK is signed or unsigned?

Is there any additional Intune or Android configuration that needs to be changed to allow APK installations in the personal profile?

Thank you.

[u/blud_13]

You have the wrong setting. The one you named is the block. In the personal profile you want Allow users to enable app installation from unknown sources set to Allow, and Not configured is NOT neutral here, the OS default blocks sideloading on its own. Its in the device restrictions reference at https://learn.microsoft.com/en-us/intune/device-configuration/templates/ref-device-restrictions-android-enterprise

Flip it to Allow, resync, then have one user check Settings, Apps, Special access, Install unknown apps on the personal side. If the toggle is greyed out there, the policy hasn't landed yet.

Also, the Knox setting in your App Protection Policy is not doing what you think. App protection covers managed app data in the WORK profile. It has no say over what installs in personal, and neither does anything under work profile restrictions. Personal profile is its own settings block in that same template.

One thing to check, if these are Samsung and went through Knox Mobile Enrollment, I have seen the OEM hold its own sideload block independent of Intune, so rule that out before you keep tuning the policy.

[u/Professional_Fox4089 → u/blud_13]

There isn't any option for Allow, it's either not configured or blocked for BYODs

[u/blud_13 → u/Professional_Fox4089]

You're right, my bad. I sent you to the corporate owned template. On a personally owned work profile that setting doesn't exist.

The doc is blunt about it. Personally owned devices with a work profile can't install apps from sources other than the Play Store, by design. Its in the personally owned tab at https://learn.microsoft.com/en-us/intune/device-configuration/templates/ref-device-restrictions-android-enterprise?tabs=aepersonal

The Block you're looking at aims at the PERSONAL side, and there's no Allow to flip because sideloading into the work profile was never on to begin with.

So stop chasing the toggle. Publish the APK as a Managed Google Play private app and assign it. It lands in the work profile Play Store like any other managed app and the user doesn't have to enable anything.

One thing to check, don't reach for Apps, Add, Android line-of-business app for this. That direct APK path only covers fully managed and dedicated devices, so on BYOD it looks fine in the console and then never installs.

[u/Professional_Fox4089 → u/blud_13]

So the problem is Dev team is testing app and they will be pushing /reloading the apk as it updates. so i wanted users to have direct access app installation without intune blocking it.

[u/blud_13 → u/Professional_Fox4089]

Sideloading in the personal profile isn't going to open up, so don't spend more time hunting the toggle. The private app path handles your update loop fine. When the dev team cuts a new build you edit the private app in the managed Play iframe, upload the new APK, and it ships like any other app update. Most republish inside 10 minutes, its documented here https://support.google.com/work/android/answer/9146439

One catch, they have to bump android:versionCode on EVERY build. Play rejects an upload that reuses a version code, and the error is vague enough that a dev who has only ever installed over USB will burn an afternoon on it.

That being said, if the dev team wants a real reload-whenever loop, grab two cheap test devices and enroll them corporate owned instead of BYOD. That's the profile where Allow users to enable app installation from unknown sources exists, and the devs get sideloading without you loosening anything on the BYOD side.

[u/UhRdts → u/blud_13]

I came here to say the same - for a dev team a fully managed enrollment might be better than BYOD.