Enable Passbolt as an Autofill provider for Android Work Profile, managed through an MDM

Feature requests
1

Q1. What is the problem that you are trying to solve?
After Android 15 update, Passbolt cannot be choosen as the default Autofill provider for Work Profiles.

Q2 - Who is impacted?
Every Android 16+ Work Profile user.

Q3 - Why is it important and/or urgent?
This is strategic for Enterprise adoption of Passbolt. It was working before Android 15.

Q4 - What is your proposed solution? (optional)

The solution is to enlist the application as “Password manager for Android 15+”
I will provide two screenshots, one from Passbolt and one from Microsoft authenticator from Google MDM, that show the difference:

microsoft
microsoft1544×801 54.5 KB

passbolt
passbolt1558×791 60.6 KB

Enabling that option might make Passbolt usable again in Android Work Profiles.

2

hello @n104165,
thank you for your report - we are currently investigating the conditions needed for passbolt to have this option. We’ll get back here after the research.

3

hi @n104165 ,

We reproduced it on dedicated emulator with SDK 35+ (Android 15+) with work profile and the Test Device Policy Control (Test DPC) App: https://github.com/googlesamples/android-testdpc , but only when explicitly setting the Credential Provider Allowlist that doesn’t include com.passbolt.mobile.android. We’re now looking into what makes the console offer that toggle for an app.

A few questions to make sure we’re looking at the same thing:

  1. Is Google Endpoint Management your only EMM or is the work profile also managed by another one on top of it? If there’s another one, does it expose a credential-provider allowlist, and can you add com.passbolt.android there as a temporary workaround?
  2. On an affected android device: Settings → Passwords, passkeys & accounts → Work tab (can vary on different devices) : is Passbolt listed but grayed out? and what does the message say when you tap it?
4

Hello @mi-mq ,

  1. Google is our only EMM, no other EMM on top of it.
  2. On affected devices, Passbolt is listed but grayed out with the string: “Controlled by admin”. Selecting passbolt produces the following error message: “Blocked by work policy. For more info, contact your IT admin”.
6

Thanks for the response.

I did more digging and found out there’s no official statement from google about it except that the toggle depends on „compliance with the Android Enterprise API for managed password services”, however with no external EMM I guess that credentialProviderPolicyDefault cannot be set to CREDENTIAL_PROVIDER_DEFAULT_ALLOWED out-of-the-box (https://developers.google.com/android/management/reference/rest/v1/enterprises.policies?hl=en#credentialproviderpolicydefault).

However, investigating other products like Bitwarden, KeePassDX or MS Authenticator shows that the solution seems to be a new autofill feature (CredentialProviderService).

We already started investigating on how we can implement it in Passbolt and we’ll keep you posted.

One more thing worth a double-check: are you able to add com.passbolt.mobile.android anywhere to the Credential Manager allowlist settings in the MDM? Maybe it could work as a temporary workaround.

7

Hi @mi-mq ,

i searched in the admin console and on the Internet, and ufortunately I didn’t find any suitable option or functionality to push this custom configuration.

Thanks

1 Like