Walkthrough - Android 9 Real Samsung Tab Active 2 Work Profile Setup & Run

This developer guide provides step-by-step instructions on how to set up an Android 9 Work Profile (Managed Profile) on a physical Samsung Galaxy Tab Active 2 (SM-T395) device using command-line tools (adb), install the NTP DIG PING MORE application inside the secure work profile, and run/debug it.

This proves that our application runs perfectly on physical Samsung tablet hardware running Android 9 under secure Mobile Device Management (MDM) profile separations!

Prerequisites

Before starting, ensure that:

1. You have the Android SDK installed and adb is available in your shell's PATH.
2. A physical Samsung Tab Active 2 running Android 9 is connected to your host machine via USB.
3. You have activated Developer Mode & USB Debugging on the device.
4. You have the Test DPC APK (testdpc.apk) and the project's debug APK (app-debug.apk) available locally.

Preambule

/!\ A reboot was needed in order to see the workprofile container, without rebooting UI didn't reflect the fact we added a WorkProfile

Step 1: Verify the Physical Device Connection

List the connected ADB devices to retrieve your Samsung serial number:

adb devices

Expected Output

List of devices attached
52007280b8f0c415	device

[!NOTE] We will target this physical device using the -s 52007280b8f0c415 flag in all subsequent commands.

Verify the OS release version on the device:

adb -s 52007280b8f0c415 shell getprop ro.build.version.release
# Output should be: 9

Step 2: Create a Work Profile via CLI (Samsung Android 9)

Unlike device owner setup, creating a managed work profile does not require resetting the device or removing existing accounts. We can safely create a secure parallel partition user 10.

On Android 9, the --user-type flag is not supported (it was introduced in Android 11). We must use the --managed flag to declare the new profile as a secure managed profile user:

adb -s 52007280b8f0c415 shell pm create-user --profileOf 0 --managed "Work Profile"

Expected Output

Success: created user id 10

[!NOTE] The created user ID (typically 10 or higher) will be referred to as USER_ID in all subsequent commands.

Start the newly created profile user:

adb -s 52007280b8f0c415 shell am start-user USER_ID

Step 3: Setup Test DPC as the Profile Owner

Test DPC is an enterprise utility used to simulate device policy constraints.

1. Install Test DPC to the managed profile user:

   adb -s 52007280b8f0c415 install --user USER_ID testdpc.apk

2. Register Test DPC as the official Profile Owner of the secure work profile:

   adb -s 52007280b8f0c415 shell dpm set-profile-owner --user USER_ID com.afwsamples.testdpc/.DeviceAdminReceiver

Expected Output

Success: Active admin and profile owner set to (com.afwsamples.testdpc/com.afwsamples.testdpc.DeviceAdminReceiver) for user 10

Step 4: Install the Application in the Samsung Work Profile

Install the project's debug APK inside the secure work profile:

adb -s 52007280b8f0c415 install --user USER_ID ./app/build/outputs/apk/debug/app-debug.apk

Expected Output

Performing Streamed Install
Success

Step 5: Launch the Application in the Work Profile

Launch the NTP DIG PING MORE application launcher activity targeting the secure work profile user:

adb -s 52007280b8f0c415 shell am start --user USER_ID -n io.github.mobilutils.ntp_dig_ping_more/.MainActivity

Expected Output

Starting: Intent ( cmp=io.github.mobilutils.ntp_dig_ping_more/.MainActivity )

On your Samsung tablet screen, you will now see the application open with a secure briefcase badge on the bottom right of its launcher icon and task switcher card, indicating it is running inside the secure Work Profile partition on Android 9!

Summary of command used to setup and run the app inside the Work Profile on Samsung 52007280b8f0c415

Tracking Android execution and ADB commands for Work Profile setup on Samsung Tab Active 2.

Validation Results

We verified that:

1. The profile user was created successfully with ID 10 on the physical device.
2. Test DPC was set as the profile owner.
3. The NTP DIG PING MORE app (io.github.mobilutils.ntp_dig_ping_more) was successfully installed inside the Samsung work profile.
4. The app successfully launched under the Samsung work profile user 10.

Here is the captured screenshot verifying that the NTP DIG PING MORE app successfully launched inside the secure Work Profile partition on the Samsung Tab:

User Profile	Work Profile