Android Enterprise enrollment QR code works, but system apps disappear after policy is appliedSolved

Hi @skylar-a,

For Android Enterprise enrollment, the correct QR code depends on the management mode you want to use:

• Device Owner: Use this if the device is company-owned and should be fully managed by Hexnode.
• Profile Owner: Use this if you only want to manage a work profile/container on a personally owned device.

If the device shows enrollment progress and Samsung Knox activation, your QR code is working correctly for a fully managed Samsung device.

The missing system apps are caused by the Android application Allowlist/Blocklist configuration. Unlike iOS, which keeps default apps unless explicitly blocked, Android’s Allowlist behavior is much stricter. When an Allowlist is configured, any app that is not explicitly allowed will be hidden, blocked, or removed from the managed device experience—including system apps like Camera, Gallery, Calculator, Messages, Phone, and Calendar.

To fix this, edit your Android policy and ensure the Allowlist explicitly includes both:

• Required work apps: Outlook, OneDrive, Chrome, Adobe apps, or internal business apps.
• Required system apps: Camera, Gallery, Calculator, Calendar, Messages, and Phone.

A practical approach is to create a copy of the Android policy, update the app Allowlist there, and test it on one device first. Once the device syncs and you confirm the system apps remain available, you can apply this updated policy template as the base for all future Android deployments.

Best regards,
Eden Pierce
Hexnode UEM

That explains it. We had only allowed the work apps, so the phone lost the basic apps after the policy applied. 

Thank you for the help, that sorted it out!