Copy-paste issue (COPE)

In our MDM is an option to turn off the possibility to copy/paste from work profile to the user profile.

Same for sharing from work profile to personal profile.
But i never tested that but pretty sure someone would have raised an issue about that in the community of our MDM already if that would have been the case but haven't seen something like this the last years.

So, i think it's not an Android issue but more likely again an Intune issue (I'm so happy we didn't swithc to it in the past when i read all the issue here about it + our testing exerience).

But it would be good if someone with experience with using this functionality could shortly verify here that it's working on their end (from any MDM).

Did you try the option "Data sharing between work and personal profiles"  in Intune? You can find it in the restrictions profiles under general settings. 

I have no test devices in Intune at the moment, but I believe this should do the trick. 

In KSP you have an option to allow clipboard sharing between work container en personal profile, but this is disabled by default:

Hopefully we're talking about the same thing:

{
"mCategoryMap": {
"RCP_CATEGORY": {
"mKeyMap": {
"poRCPMoveFilesFromWorkProfileToPersonal": {
"mData": null,
"mMessage": "[Allow moving files from work profile to personal space in Work profile policies (Profile Owner) successfully processed.]",
"mPolicyStatus": true,
"mReportStatus": 1
},
"poRCPMoveFilesFromPersonalToWorkProfile": {
"mData": null,
"mMessage": null,
"mPolicyStatus": false,
"mReportStatus": 0
},
"poRCPShareClipboardToData": {
"mData": null,
"mMessage": "[Enable Sharing of Clipboard Data to Owner in Work profile policies (Profile Owner) successfully processed.]",
"mPolicyStatus": true,
"mReportStatus": 1
},
"poRCPDataSyncPolicy": {
"mData": null,
"mMessage": "[Enable RCP data sync policy (Configure profiles below) in Work profile policies (Profile Owner) is not supported by this device.][14001][This policy is not supported for this knox version or higher.]",
"mPolicyStatus": true,
"mReportStatus": 1
}
}
},
"CMFA_CATEGORY": {
"mKeyMap": {}
},
"KPU_CATEGORY": {
"mKeyMap": {
"profileName": {
"mData": null,
"mMessage": "Knox policies in EMEA_v1.34 successfully processed",
"mPolicyStatus": true,
"mReportStatus": 1
},
"kpePremiumLicenseKey": {
"mData": null,
"mMessage": "Successfully activated license key ending with ...PNJZ",
"mPolicyStatus": true,
"mReportStatus": 1
}
}
}
},
"mStatus": "SUCCESS",
"mTimeStamp": 1721038679013
}

Thanks all for your input. I'm being vague intentionally (NDA), but this is now being looked into and should be fixed.

Sharing workaround if someone else runs into this before resolution:

Create a new device restriction policy

Set copy/ paste to Allow and save

Reset copy/paste to Not configured and save.

Please note workaround doesn't work for existing policies, you need to create a new policy

Hi there,

It sounds like you're facing a tricky situation with managing copy-paste between work and personal profiles on COPE devices. You've already done a lot of groundwork by exploring Intune settings, OEMConfig, and even delving into Google Enterprise solutions.

Regarding your question, AMAPI (Android Management API) can indeed be used to enforce stricter policies, but integrating it with Intune might not be straightforward, as Intune generally abstracts a lot of the lower-level controls that AMAPI provides.

For crossProfileCopyPaste, while it's possible to control this through DPC extras in a pure Android Enterprise setup, doing so within the confines of Intune can be challenging, especially since Intune's configuration options may not expose all the granular controls you need.

You might want to consider setting up a custom policy using Intune’s Device Configuration Profiles, where you can explicitly block copy-paste actions via App Protection Policies. This might not directly expose crossProfileCopyPaste but could achieve a similar effect by limiting data sharing between work and personal profiles.

Additionally, you could explore Samsung Knox's advanced settings in more detail, as Knox provides more granular controls over work profiles that could complement what Intune offers. Combining Knox with Intune might give you the additional layers of security you're looking for.

I hope this helps, and feel free to reach out if you have more questions!