AMAPI prepareEnvironment() randomly throws SecurityException right after enrollment — persists until device reboot

Hello everyone,

I am implementing a custom Device Policy Controller (DPC) (device owner mode) and integrating the Android Management API (AMAPI) locally on the device using:

• EnvironmentClient.prepareEnvironment()
• AccountSetupClient.startAccountSetup()

Both calls happen directly after device enrollment, inside a flow that starts within minutes after provisioning.

Most of the time, everything works perfectly.

However, randomly, prepareEnvironment() fails immediately after enrollment with:

 java.lang.SecurityException: Permission denied to call Android Device Policy app.

And once this error happens, all subsequent calls to AMAPI continue to fail with the same exception — until the device is rebooted. After reboot, AMAPI works normally again.

Sometimes onboarding works the first time, sometimes not, with no changes in our code or provisioning steps.

We consistently see repeated Google Play Services / Dynamite module errors whenever the failure occurs:

Invalid module.yaml info for apk: split_GoogleCertificates_installtime.apk

DynamiteModule: Failed to load remote module: Failed to get module context GoogleCertificates: Failed to get Google certificates from remote DynamiteModule: LoadingException: Remote load failed. No local fallback found.

Followed by AMAPI denying our DPC:

Permission denied to call Android Device Policy app.

java.lang.SecurityException: Permission denied to call Android Device Policy app. 

This state persists indefinitely until the next device reboot.

I test on my Samsung Galaxy Tab A8 (SM-X200)

We rely on AMAPI to complete Managed Google Play provisioning right after enrollment, and this intermittent failure is blocking many devices until they are rebooted. Any insights, known issues, or best practices from Google engineers or EMM partners would be extremely helpful.

Thank you!