App Protection also Locks Managed Playstore

Hi Zeeshan Siddiqui 

Would you please suggest whether you are using Sophos Central mobile or Sophos Mobile Control on-prem? 

I am assuming that you are using Android Enterprise to manage devices. You need to check the application group which is defined under the application protection policy in the Sophos Mobile as App protection will block all the applications mentioned in that application group.

Hi Jasmin,

I am using Sophos SMC on-premises and Android Enterprise to manage devices, i created application group my self and well aware that there is no google play store added there, only ACRONIS True Image which is to automate the process of backup and not let user interact with app or change and settings.

Hi Zeeshan Siddiqui 

If it is working fine, please provide the screenshots of app group and application protection policy.

Jasmine,

i have removed the policy as i told you in last message, so how will the app protection policy works. my issue still exist with no work around till now.

will make more clear for you if it is confusing.

App protection policy with app group does not have Play store but still locking playstore. removing policy will not work for all the other apps thats not a solution. i want policy but dont want playstore to be locked.

hope you will get a clear picture now.

Hi Zeeshan Siddiqui 

Thank you for the information.

When I said if it is working fine, I meant after removing the application control policy, are you able to access the play store or not?

As you confirmed, it is only happening if the policy in place, so there should be something mentioned in the policy itself which is blocking the play store.

That's why I asked you for the screenshot. If you don't want to reveal a screenshot of the policy due to the privacy on the community, I'd suggest you open a support case here.

Please PM me the case number once it is opened.

The screenshots are attached.

Hi Zeeshan Siddiqui 

From the above, screenshots everything looks fine in terms of the policy.

To troubleshoot detail, we'll need logs from the server and may need a remote session of the server.

I'll discuss this with our support team meanwhile I'd request you open a support case here.

Hi Jasmin,

Thanks, i ll be sharing session whenever you want. have also opened the case as per your advise

Hi Zeeshan Siddiqui 

Thank you for the information.

The assigned engineer will contact you in order to troubleshoot the issue further.

Hi Zeeshan Siddiqui 

We did check this with our development team, and this is at the moment works as designed as this prevents users from uninstalling apps if the device was managed with the "legacy" device administrator. However, we will check this further for Android Enterprise as it might not be required. At this moment I would not be able to provide any timeline for this. 

Dear Shweta,

i didn't get you clearly can you please elaborate.

thanks,

Hi Zeeshan Siddiqui 

Android devices can be enrolled through two methods. First is device Profile enrollment where you directly assign policies when you don't have managed google account/domain. Another one is Android Enterprise enrollment where you have google managed account/domain through which you can control allowed application and other policies on the company devices.

Now, when you have enrolled the device through Device Profile where Google play store account is user-generated not managed by Organization. To make App protection effective on those devices, by design, google play store will be locked, so the user can't uninstall the application from the device.

For Android Enterprise, as google account is managed through Organization, this can be changed but by design Android enterprise also has the same functionality as device enrollment in this feature but this can be changed for Android Enterprise. They will take this into the consideration and will try to change this functionality but there is no timeline for it.

Please let us know if you have any other query.

Hi Zeeshan Siddiqui 

Android devices can be enrolled through two methods. First is device Profile enrollment where you directly assign policies when you don't have managed google account/domain. Another one is Android Enterprise enrollment where you have google managed account/domain through which you can control allowed application and other policies on the company devices.

Now, when you have enrolled the device through Device Profile where Google play store account is user-generated not managed by Organization. To make App protection effective on those devices, by design, google play store will be locked, so the user can't uninstall the application from the device.

For Android Enterprise, as google account is managed through Organization, this can be changed but by design Android enterprise also has the same functionality as device enrollment in this feature but this can be changed for Android Enterprise. They will take this into the consideration and will try to change this functionality but there is no timeline for it.

Please let us know if you have any other query.