Android app allowlist apps missing and Intune can't add work profileSolved

Hi @maevee,

For Android app allowlist policies, it is important to separate two behaviors:

1. The allowlist controls which installed apps are accessible to the user.
2. It does not automatically install apps on the device.

If an app is added to the allowlist but is not installed on the Android device, it will not appear just because it is allowlisted. Apps such as Intune Company Portal, Outlook, and Teams must be installed first, either by deploying them through Hexnode as Required apps or by using the Install Application action.

Also, make sure Google Play Store is included in the allowlist. App installations through Managed Google Play rely on Play Store being available on the device.

For already installed apps that are still hidden, run the following actions from the device page:

• Scan Device
• Scan for Apps

Then check the device app inventory or blocklisted app count. If an app appears as blocklisted, add the exact app to the allowlist policy, save the policy, and run Scan for Apps again.

Regards,
Isabel Lora
Hexnode UEM

That explains part of it. I had assumed adding Company Portal, Outlook, and Teams to the allowlist would also push them to the phone. After deploying them as required apps and keeping Play Store allowed, those apps started appearing.

The remaining issue is with Files, Phone, Messages, Weather, and Calendar. They are listed in the allowlist, but I still don’t see them on the device.

For built-in or system apps, the same rule still applies: the app must be present and enabled on the device, and the allowlist must include the correct app entry/package.

If those apps are not visible after being added to the allowlist, check whether they appear in the scanned app inventory. If they show up as blocklisted, add the exact detected app entry to the allowlist and rescan the device. If they do not appear in the inventory at all, they may not be installed, may be disabled by the device image, or may not be available in the managed profile depending on the enrollment mode and Android build.

The allowlist cannot create or restore a missing system app. It can only permit access to apps that are available on the device.

Regards,
Isabel Lora
Hexnode UEM

The other problem is Intune Company Portal. When I open it and try to enroll, Android says it can’t add a work profile. Does that mean Hexnode and Intune cannot both manage the same Android device?

Yes @maevee, that error is expected in this scenario.

Android allows only one active work profile on a device. If the Android device is already enrolled and managed by Hexnode using a work profile, Intune Company Portal cannot create a second work profile on the same device. Android blocks the attempt and displays an error such as “can’t add work profile.”

For environments where Microsoft Entra Conditional Access requires Intune compliance before users can access Outlook or Teams, the recommended approach is not to create a second work profile. Instead, configure Hexnode as a compliance partner in the Microsoft Intune admin center.

With this approach:

• Hexnode continues managing the Android device.
• Hexnode reports the device compliance status to Microsoft Intune/Microsoft Entra ID.
• Conditional Access can evaluate the compliance state without requiring a separate Intune work profile enrollment.
• Users can access Microsoft apps such as Outlook and Teams based on the compliance policy.

If your Microsoft environment is managed by a separate Entra or Intune administrator, they will need to configure the compliance partner integration on the Microsoft side. Another possible Microsoft-side option is to use App Protection Policies/MAM, depending on how Conditional Access is designed in the tenant.

Regards,
Isabel Lora
Hexnode UEM