Sandboxed Google Play in Work Profile cannot install apps due to “unknown sources” restriction

[cameronaaron]

When enrolling via Intelligent Hub to get enterprise email, GrapheneOS correctly creates an Android work profile and allows installation of the sandboxed Play Store—but that Play Store then cannot install downloaded apps because work profiles globally block “unknown sources,” and because Play Store isnt the default app store on graphine it isn’t exempted which is the mdm and IT teams expectation.

Steps to reproduce
1. On GrapheneOS, install and enroll Intelligent Hub to set up enterprise email.
2. Intelligent Hub creates an Android work profile and prompts for a Play Store.
3. “No Play Store found” error appears; install the GrapheneOS sandboxed Google Play.
4. Sign into Play Store and download required enterprise apps.
5. Downloads complete but installation fails—Play Store lacks INSTALL permission.

Actual behavior
The work profile’s global block on “install from unknown sources” applies even to the sandboxed Play Store, so it cannot install any downloaded APKs.

Expected behavior
While technically things are working correctly Graphine wise it would be nice if there was some kind of a system where the os can whitelist google play in work profiles or the built in graphene app store can proxy downloads from google play to download them somehow allowing enterprise app installs without manual overrides.

Workarounds
None found—IT teams report “we’ve never seen this before” when troubleshooting.

Additional context
This breaks basic enterprise app deployment workflows on GrapheneOS devices; a targeted exemption would restore compatibility with MDM-driven Play Store installs.

Google news is Graphiene itself does not bring the device out of corp compliance at all

[thestinger]

because work profiles globally block “unknown sources,”

That's only when the work profile management app chooses to do this.

[cameronaaron]

Yes but they are doing so with the assumption the playstore will always be able to be used same way the graphine app store works in work profile they are not accounting for graphine because they have never seen it before

[cameronaaron]

To be clear the built in Graphine app store installs stuff perfectly becauze it is the built in app store and is trusted by all but the playstore is a third party app store in this case i would be fine if i could download from the internal appstore but they dont have outlook and stuff

[LindaFerum]

I may be talking out of my ass here and correct me if I'm wrong @cameronaaron but as far as I understand the provisioning policies a work profile gets configured by are updatable from employer side (which is reasonable, org demands change etc)

So maybe the IT guys could try provisioning with a profile that allows unknown sources, install the sandboxed play/play store, enable installing from play store and THEN change the policy so no other apps can get the permission

Possible pitfalls

1. I may be wrong and policies are not updatable

2. work profile policies are updateble "in google's design" but the particular management soft an employer uses is not smart enough

3. google are too smart for their own good and when policy gets updated to "no unknown sources" the permission gets yanked from apps that already have it

4. assuming all goes as per plan BUT everything is done remotely and there isn't Employer's IT Guy watching over the phone while these things happen, a sophisticated hostile employee could leverage time between policy1 (permissive) and policy2 (restrictive) to so something spicy like add another trusted install source, but I think it is kinda marginal threat and likely possiblr to detect early

[cameronaaron]

I may be talking out of my ass here and correct me if I'm wrong @cameronaaron but as far as I understand the provisioning policies a work profile gets configured by are updatable from employer side (which is reasonable, org demands change etc)

So maybe the IT guys could try provisioning with a profile that allows unknown sources, install the sandboxed play/play store, enable installing from play store and THEN change the policy so no other apps can get the permission

Possible pitfalls

1. I may be wrong and policies are not updatable
2. work profile policies are updateble "in google's design" but the particular management soft an employer uses is not smart enough
3. google are too smart for their own good and when policy gets updated to "no unknown sources" the permission gets yanked from apps that already have it
4. assuming all goes as per plan BUT everything is done remotely and there isn't Employer's IT Guy watching over the phone while these things happen, a sophisticated hostile employee could leverage time between policy1 (permissive) and policy2 (restrictive) to so something spicy like add another trusted install source, but I think it is kinda marginal threat and likely possiblr to detect early

Yeah I think they could change it on their end but they are so used to it working because everyone uses the stock device that they are like wait what its not working wtf ok uhh try again oh if you try again same result damn this usually works uhhh ok we dont know bye. I tell them hey update the policy on your end this is whats going on and what you need to do. Their response is uhh we dont do that sorry it should just work

[LindaFerum]

How much do they pay your IT guys and do they accept remote work lol :3

[cameronaaron]

right?

[cameronaaron]

https://discuss.grapheneos.org/d/18236-how-to-set-up-a-proper-google-managed-work-profile-if-required-by-your-employer/17