Intune org-managed Android devices and Android KeePass compatible apps

[danielfdickinson]

This is for your information. There have been some issues (#8803,#7749, #7531, #6240) where users have reported that various Android KeePass-compatible apps report an issue with the database file even though it reads and writes fine on KeepassXC and KeePass 2, and even other devices, with no issues.

One cause of this (that I ran into, hence this note) is that if one is using an Intune org-managed apps (like org-managed OneDrive) or an Intune org-managed Android device, then

If the data protection policy prevents the managed apps from transferring data to unmanaged apps, then a database from one's KeePassXC that one tries to access on Android through OneDrive (for instance) will throw an error that doesn't indicate the real issue.

This affects (at least):

KeePassDX
Keepass2Android
KeePassDroid
OneKeyPass

I spent several hours before figuring out the issue. In my case I was able to test (and verify) the theory by changing the protection settings, because I have MS365 with Intune licenses.

Hope that helps someone.

[danielfdickinson]

You get issue reports from users who think that KeepassXC is broken. This gives you info on a possible cause.

The error messages from the droid software indicates the database is 'not valid' (not corrupt, but things like a 'bad signature' or not a recognized database format). So it looks like to the end user like an issue with database creation (which it is not).

[droidmonkey]

Thanks, but those issues had nothing to do with an intune managed device.

[danielfdickinson]

🤷 I'm not going to spend more time arguing about about this, I was just trying to pass on helpful information for you and your users.

I will mention that Intune isn't the culprit, it is the Android Enterprise Management that Intune and other platforms (including Google's native Android Enterprse Managemnt solution) use to protect organization data on BYOD and org-managed devices.

I found those issues and random Reddit threads suggesting the problem was the database or encryption configuration (rounds, particular algorithms, etc) were the issue but that didn't work to consistently resolve the issue in those thread, and didn't for me, because the problem was basically a permissions problem that was reported as a database integrity / format issue.

Anyway you don't seem to want to know / hear about it, so I'm wandering off to other things.