Level 1.6: Donut

Solved

Any Intune admins seeing the new AMAPI implementation for personally-owned work profiles yet?

9 replies
390 views
Translate All • Beta, powered by Gemini

This blog post says it's now generally available but I'm not seeing it live in my tenant yet: What’s new in Microsoft Intune – May

For those that don't know, Microsoft has been using Company Portal as their custom DPC but is now transitioning to Google’s Device Policy app to get in line with Google’s mandates. This means (among other things), enrollment will happen at http://aka.ms/enrollymyandroid instead of through the Company Portal app.

If they've rolled it out to your tenant, it will look like the first image in this other blog post when you go to Devices > Android > Enrollment > Personally-owned work profile.

I am curious if this is live for anyone else. Methinks Microsoft has a weird interpretation of "generally available".

LizzieAnswer

Community Manager

Hey @okmick, @Rakib,

I’ve been looking into this for you. Good news and very hot off the press (as of about an hour ago I think), this has been launched fully today. I believe you should see this setting it in your Intune portal.

You can read more details in this Microsoft Intune blog post. Just to highlight, the article was first posted in January 2026, but has been updated today with the news. 😎

It would be great to hear if you can now see it and how you get on with it. It sounds like you are both keen to enable this.

Thanks so much,

Lizzie

Welcome to the Community everyone!

Rakib

Level 3.0: Honeycomb

No not yet, we are also waiting for this. iOS is ready but we want Android also to be ready before we start rolling out in our organization.

Translate • Beta, powered by Gemini

Lizzie

Answer

Community Manager

Hey @okmick, @Rakib,

I’ve been looking into this for you. Good news and very hot off the press (as of about an hour ago I think), this has been launched fully today. I believe you should see this setting it in your Intune portal.

You can read more details in this Microsoft Intune blog post. Just to highlight, the article was first posted in January 2026, but has been updated today with the news. 😎

It would be great to hear if you can now see it and how you get on with it. It sounds like you are both keen to enable this.

Thanks so much,

Lizzie

Translate • Beta, powered by Gemini

Welcome to the Community everyone!

okmickAuthor

Level 1.6: Donut

Hi Lizzie! I can see the option now in my Intune portal, thanks so much!

Translate • Beta, powered by Gemini

pvandroid

Level 1.6: Donut

Thanks for sharing this. I have a couple of questions for anyone who has already enabled web-based enrollment for personally owned Android work profiles.

If a user still downloads and signs into the Company Portal app, what is the expected workflow?

Does Intune detect that web enrollment is enabled and redirect the user to Chrome/Samsung Internet to continue the web enrollment process?
Or does Company Portal continue with the traditional work profile provisioning flow?

I'm also interested in understanding the experience for organisations that block BYOD Android enrollment.

If a user is not permitted to enroll their personally owned Android device, what message do they see when attempting to sign in through Company Portal?
Does the web enrollment flow present the same restriction, and if so, what error or guidance is shown to the user?

In our environment, users can:

Enroll BYOD iOS/iPadOS devices into MDM
Register mobile devices for MAM
Access corporate apps with App Protection Policies

However, BYOD Android device enrollment into MDM is intentionally blocked. One of the concerns we have is understanding what experience users will receive under both the Company Portal and web enrollment methods when enrollment is restricted.

Any screenshots, test results, or real-world experiences would be greatly appreciated. Thanks!

Translate • Beta, powered by Gemini

okmickAuthor

Level 1.6: Donut

Hi @pvandroid I highly recommend that you take a look at Microsoft Learn | Set up enrollment of Android Enterprise personally owned work profile devices as it answers all of your questions. I will link to specific sections of this article to address your concerns.

If a user still downloads and signs into the Company Portal app, what is the expected workflow?

If you have enabled web-based enrollment for your tenant, installing and signing into the Company Portal app will prompt the user to enroll through the web. This also applies to apps like Teams and Outlook if you have the conditional access policy to support it. See the #Enroll devices section.

I'm also interested in understanding the experience for organisations that block BYOD Android enrollment.

This one is a little tricky because you have to get your enrollment restrictions just right. Take a look at what Microsoft says about this in the #Configure device platform restrictions section:

In essence, the Personally owned platform restriction setting for Android doesn’t do anything anymore. If you’re wanting to block personally owned work profiles for all users but allow it for a subset of users, like yourself for testing, what you need to do is set your All users platform restriction to block Android Enterprise work profiles overall, not just personally owned work profiles. Then make a second platform restriction that allows it and apply that to a security group with the necessary users. Like this:

If a user who is not allowed to enroll work profiles tries to enroll, they will receive this message (I’ve redacted my organization’s logo and name):

When a restricted user signs in to Company Portal, it does not launch the web enrollment. Instead, it just signs them in to the app and nothing else. I can open up all the usual menus and see my list of devices, etc. I’m guessing this is to support MAM scenarios. That way, organizations could disallow work profiles but still allow MAM to function through Company Portal.

I’ve enabled web-based enrollment in my tenant and got my existing users migrated over and everything is working great. So I suggest you try it out. Microsoft says they will be forcibly migrating all tenants in Q4 of 2026 so pretty soon, you will have no choice. More on that here:

Microsoft Learn | Use Android Management API for personally owned devices with work profiles (talks about steps to prepare)

Intune Customer Success Blog | New policy implementation and web enrollment for Android personally owned work profile is now GA (talks about overall change and enforcement timeline)

Let me know if you have any more questions.

Cheers.

Translate • Beta, powered by Gemini

Lizzie

Community Manager

Hey @pvandroid,

Great questions here.

@okmick, @Rakib, @Kris, @jarmo_akkanen, @SF4, @Timmy I wonder if you have dived deeper into any of these areas yet?

Thank you.

Translate • Beta, powered by Gemini