Password Policy Android Work Profile

Hi Florian Kieschnick ,

Thank you for reaching out to the Sophos Community Forum.

Did you use the "Lock" option as described in this document? - Lock device

If yes, for devices where Sophos Mobile manages the Android Enterprise work profile, it should lock the device, not just the work profile.

There's a different way to use the Lock option if you want to lock just the work profile and not the whole device, which is described here - Lock work profile

Regarding your Support Portal registration, it looks like your account is still under review. You'll receive an email notification once it's approved, and that's when you'll be able to log in to the Support Portal.

Hello,

I think there was a misunderstanding.

I dont want to lock/remote lock a device. I want to enforce a policy in a way that users have to use a Pattern, Pin or Password to unlock the device.

This currently only seems to work when using apps inside the work profile. IN the old on-prem version it worked for the entire device.

The user should not be allowed to disable this protection.

Hi Florian Kieschnick ,

Thanks for providing more details. Apologies for the confusion. May I know what configurations you currently have under your Android Enterprise Work Profile policy? Do you have any of these configurations?

I got both of these set to Pin or Password (roughly translated from German). If it helps - I will attach some german screenshots from the portal.

Both are configured as shown below:

Edit: The Forum didn't like my Upload methodology and replaced one with the other :(

I tested this out on an Android Device enrolled under "Work Profile" management. I see a compliance violation alert from the SMC app within the Work Profile container when I update the device screen lock settings to not require a password/pin.

The Work Profile management mode cannot make changes on the device as a whole, whereas a device enrolled as under "Full Device Management" will have the options for "No screen lock" greyed out.

Hello, this sounds like the source of it.
However, the on-prem sophos mobile was able to do so. At least my work phone did lock the options which were not configured (as intended).

There is a new observation as well.
My test device showed the behaviour above (settings only apply to work profile apps only) whereas my actual work phone did require a lock according to my configuration after I kicked it out of the on-prem sophos and enrolled it into the cloud based sophos.

As far as I know - "Full device Management" requires us to go a different route and have our phones registered by the distributor into some management suits from apple or samsung. Is that correct?

Hello, this sounds like the source of it.
However, the on-prem sophos mobile was able to do so. At least my work phone did lock the options which were not configured (as intended).

There is a new observation as well.
My test device showed the behaviour above (settings only apply to work profile apps only) whereas my actual work phone did require a lock according to my configuration after I kicked it out of the on-prem sophos and enrolled it into the cloud based sophos.

As far as I know - "Full device Management" requires us to go a different route and have our phones registered by the distributor into some management suits from apple or samsung. Is that correct?

Full Device Management does not require you to go through your distributor, although this is an option that can make the enrollment process simpler for you when obtaining new devices. You can find more information on this in the following link. 
- Zero-touch enrollment

You can enroll devices in the Full Device management mode by first performing a factory reset. The following video explains a bit further. 
- Sophos Mobile: Android Enterprise Management and Enrollment

The behaviour you observed here is a little odd. Can you confirm that both devices are enrolled under the "Work Profile" management mode?

Florian Kieschnick said:

whereas my actual work phone did require a lock according to my configuration after I kicked it out of the on-prem sophos and enrolled it into the cloud based sophos.