Microsoft Android 11 must be provisioned as a fully managed device and configured to create a work profile.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-255230	MSFT-11-009600	SV-255230r870779_rule		Medium

Description
The Android Enterprise Work Profile is the designated application group for the COPE use case. SFR ID: FMT_SMF_EXT.1.1 #47

STIG	Date
Microsoft Android 11 COPE Security Technical Implementation Guide	2022-11-14

Details

Check Text ( C-58843r870778_chk )
Review that Microsoft Android 11 is configured as Corporate Owned Work Managed. This procedure is performed on both the EMM Administrator console and the Microsoft Android 11 device. On the EMM console, configure the default enrollment as Corporate Owned, and select "Use for Work & Personal". On the Microsoft Android 11 device: 1. Go to the application drawer. 2. Ensure a Personal tab and a Work tab are present. If on the EMM console the account the default enrollment is set to Corporate Owned Work Managed or on the Microsoft Android 11 device the user does not see a Work tab, this is a finding.

Check Text ( C-58843r870778_chk )

Review that Microsoft Android 11 is configured as Corporate Owned Work Managed.

This procedure is performed on both the EMM Administrator console and the Microsoft Android 11 device.

On the EMM console, configure the default enrollment as Corporate Owned, and select "Use for Work & Personal".

On the Microsoft Android 11 device:
1. Go to the application drawer.
2. Ensure a Personal tab and a Work tab are present.

If on the EMM console the account the default enrollment is set to Corporate Owned Work Managed or on the Microsoft Android 11 device the user does not see a Work tab, this is a finding.

Fix Text (F-58787r869306_fix)
Configure Microsoft Android 11 device as corporate owned with a work profile. On the EMM console, configure the default enrollment as Corporate Owned, and select "Use for Work & Personal". Refer to the EMM documentation to determine how to configure the device.