Answer
Microsoft official configuration requirements:
CN:https://learn.microsoft.com/zh-cn/mem/intune/enrollment/android-work-profile-enroll
EN:https://learn.microsoft.com/en-us/mem/intune/enrollment/android-work-profile-enroll
For devices registered through device administrator method previously, it is necessary to erase the device and re register, or create a compliance policy migration.
1. Link account
You could choose an existing Google Play account that requires it to be an enterprise account, registered for the Google Play console, and an administrator account.
You could also bind a new account, and the default thread will help you register everything.
How Android Enterprise connects your Google services (blog.google) For more Google product management and EME management, we will not use them here. We will not provide demonstrations based on individual customer needs.
2. Set up registration configuration file
Intune Enrollment restrictions configuration https://intune.microsoft.com/?feature.tokencaching=true&feature.internalgraphapiversion=true#view/Microsoft_Intune_Enrollment/DeviceTypeRestrictionsBlade
Normally, the default restriction configuration file use DA (Device Administrator) mode, which may result in the inability to register the device. Create a new configuration file to assign members to solve this problem, and the Android device administrator should be Blocked.
Reference：
CN: https://learn.microsoft.com/zh-cn/mem/intune/enrollment/android-work-profile-enroll
EN: https://learn.microsoft.com/en-us/mem/intune/enrollment/android-work-profile-enroll
3. Android device registration process steps
Reference：
CN: https://learn.microsoft.com/zh-cn/mem/intune/user-help/enroll-device-android-work-profile
EN: https://learn.microsoft.com/en-us/mem/intune/user-help/enroll-device-android-work-profile
Intune managed Google Play private app https://intune.microsoft.com/?feature.tokencaching=true&feature.internalgraphapiversion=true#view/Microsoft_Intune_Apps/ManagedGooglePlaySelectModeConsole
Reference：
CN: https://learn.microsoft.com/zh-cn/mem/intune/apps/apps-add-android-for-work
EN: https://learn.microsoft.com/en-us/mem/intune/apps/apps-add-android-for-work
Click Select for the private app you want to sync, Click Sync on the App pane to sync with the Managed Google Play service after creating private app (important)
After deploy is completed, private applications with locks can be viewed in Google Play App Management Android Apps on Google Play
Hosting synchronization will take about 10 minutes. After completion, assign the app in the list, and the assigned group must be Entra's.
If Required is assigned, it will not be displayed when obtaining the application and will be directly installed in the workspace.
If Available for enrolled devices are allocated, the application will be displayed.
If not displayed, please search for the Publisher name to obtain this application.
4. Apps - Microsoft Intune admin center App protection Policies
Due to the low version of Microsoft's official wrapper tool, and they haven't updated for more than a year, if a protection policy is not assigned, there will be a prompt stating that "the app has not been set up for xxx".
Create a App protection policy to bypass this issue.
Select the custom apps.
The package id you could check on here.
Please note the assigned group.
Reference: https://docs.microsoft.com/zh-cn/mem/intune/apps/app-protection-policies