Skip to main content
w4lter
w4lter
Level 2.0: Eclair
May 19, 2026
Question

Android COPE with Samsung KME and Retire (Intune)

  • May 19, 2026
  • 3 replies
  • 40 views

dear community,

some days ago i've Retired a Android COPE (Corporate owned work profile enabled) Device from Intune. In Addition, the Device record where also removed from Samsung Knox Mobile Enrollment Service.

I've found out, that on the device itself under Device admins the App "Enrollment Service" is in place and cannot be deactivated.

Samsung Support told me already, that "Enrollment Service" is not coming from them, this comes from MDM System.
Microsoft Support (what a surprise) had absolutely no idea what im talking about.

Now, i want to try my luck here in Android Enterprise community.

Did someone else had this Situation, especially with Intune?

Google Statement about Retire (RELINQUISH_OWNERSHIP)

https://developers.google.com/android/management/deprovision-device#relinquish_ownership_command

In my point of view, the Device should be fully personal after that action.
But when a Device Admin App is still in place which cannot be deactivated, this is then weird.
For example: If user, who can keep that Device want's to re-enroll again, for example with Company Portal, it's not possible because the Enrollment Service Device Admin app is blocking it.

https://ibb.co/MxMVc88Z

3 replies

Moombas
Moombas
Level 4.4: KitKat
May 19, 2026

For my opinion, i might be wrong, if you have work profile i agree that after remove of the links (KME, EMM,...) it should be free but for COPE i see it different as it was enrolled with a system app for management, means tied to the device during enrollment with completely different/deeper permissions to it.

So, in my opinion COPE should have a need to be wiped before getting into full private use but ​@jasonbayton has most likely a better knowledge of that as I never used COPE in production yet and my assumptuion might be wrong.

    jasonbayton
    jasonbayton
    Level: 4.1: Jelly bean
    May 19, 2026

    Relinquishing is the process of fully removing control from MDM without a wipe on a company-owned device. A couple of linked-service artefacts aren’t really justification for fully wiping a device when all trace of MDM has been removed; consider if they hadn’t removed it from KME, that enrollment service app would trigger after the wipe too :) 

      jasonbayton
      jasonbayton
      Level: 4.1: Jelly bean
      May 19, 2026

      Enrollment service is tied to KME, it is 1,000% a Samsung app & something Samsung preloads on their devices. Because you’ve relinquished ownership rather than wiped the device, it’s expected it would still be showing enabled; KME and EMM are two different solutions essentially, with limited knowledge of one another.

       

      You’ve removed the device from KME so the service isn’t in use, I wouldn’t personally worry, and would reassure the end user it’s a preloaded app, but fully disconnected from your control.

        w4lter
        w4lterAuthor
        Level 2.0: Eclair
        May 19, 2026

        Hi Jason, thank you very much for your fast answer.

        I dont get it, why Samsung Knox Support rejected me with the Information, that the Enrollment Service does not come from Samsung. Maybe i will try it again to consult them.

        The Story behind is “quite” simple.

        I’ve had the case where a user left the company AND was somehow allowed to keep the mobile phone. Technically it was clear, a Retire (Relinquishing ownership) is the right way - at least, it sounds like this.

        Anyway - the user which left the company started of course in a new company, and they told him you can enroll you BYOD Device with Company Portal. Well, the answer is no - Company Portal cannot take over the control, because Enrollment Service is active as Device admin app. So Company Portal is not able to take over the Device admin role :-).

        So, somehow a new learning. COPE = all the time a WIPE… :-)

         

        jasonbayton
        jasonbayton
        Level: 4.1: Jelly bean
        May 19, 2026

        Oh that’s interesting. I can’t comment on this specific scenario because it’s not something I’ve personally tested.. but it surprises me that a device admin would block Intune enrolment. Device admin apps aren’t rare. Did they share a screenshot or log/error with you?

        Kirk
        KirkCommunity Manager
        Community Manager
        May 19, 2026

        Thanks ​@Moombas and ​@jasonbayton, awesome help as usual chaps!

        ​@w4lter if their advice has solved the issue please consider hitting the ‘best answer’ button so others with similar problems can find the response, thank you.

        Terms & ConditionsAccessibility statement