Q1. What is the problem that you are trying to solve?
After Android 15 update, Passbolt cannot be choosen as the default Autofill provider for Work Profiles.
Q2 - Who is impacted?
Every Android 16+ Work Profile user.
Q3 - Why is it important and/or urgent?
This is strategic for Enterprise adoption of Passbolt. It was working before Android 15.
Q4 - What is your proposed solution? (optional)
The solution is to enlist the application as “Password manager for Android 15+”
I will provide two screenshots, one from Passbolt and one from Microsoft authenticator from Google MDM, that show the difference:
hello @n104165,
thank you for your report - we are currently investigating the conditions needed for passbolt to have this option. We’ll get back here after the research.
We reproduced it on dedicated emulator with SDK 35+ (Android 15+) with work profile and the Test Device Policy Control (Test DPC) App:https://github.com/googlesamples/android-testdpc , but only when explicitly setting the Credential Provider Allowlist that doesn’t include com.passbolt.mobile.android. We’re now looking into what makes the console offer that toggle for an app.
A few questions to make sure we’re looking at the same thing:
Is Google Endpoint Management your only EMM or is the work profile also managed by another one on top of it? If there’s another one, does it expose a credential-provider allowlist, and can you add com.passbolt.android there as a temporary workaround?
On an affected android device: Settings → Passwords, passkeys & accounts → Work tab (can vary on different devices) : is Passbolt listed but grayed out? and what does the message say when you tap it?
Google is our only EMM, no other EMM on top of it.
On affected devices, Passbolt is listed but grayed out with the string: “Controlled by admin”. Selecting passbolt produces the following error message: “Blocked by work policy. For more info, contact your IT admin”.
However, investigating other products like Bitwarden, KeePassDX or MS Authenticator shows that the solution seems to be a new autofill feature (CredentialProviderService).
We already started investigating on how we can implement it in Passbolt and we’ll keep you posted.
One more thing worth a double-check: are you able to add com.passbolt.mobile.android anywhere to the Credential Manager allowlist settings in the MDM? Maybe it could work as a temporary workaround.
i searched in the admin console and on the Internet, and ufortunately I didn’t find any suitable option or functionality to push this custom configuration.
we’ve done the investigation and it took a while and we wanted to come back with something concrete.
The short version is that there’s no official documentation from Google on what makes an app eligible for the “Password manager for Android 15+” toggle in the console. We went through the Android Enterprise, Android Management API and Credential Manager docs and none of them spell out the criteria.
So we compared Passbolt against apps that do get the toggle. The one relevant thing they all have and we don’t is a CredentialProviderService implementation, which is the newer Credential Manager API introduced in Android 14. Passbolt today only implements the AutofillService. We strongly suspect that’s the reason, and a few community comments elsewhere point the same way, but I want to be honest that we haven’t found anything authoritative confirming it, so please treat it as a well-founded guess.
The good news is that this should get resolved as a side effect of work already planned. We’re adding a passkey resource type, and on Android that is done by implementing CredentialProviderService. Once that lands we’ll be able to verify directly whether the toggle shows up for Passbolt in your console.
Passkeys are high on the priority list. We don’t have a concrete release version we can commit to yet, but I’ll post an update in this thread as soon as I do.
