Hi, I have had this issue with a few environments and it was due to Safetynet giving a false compromised. To identify and address this we took two actions
1, we temporarily disabled compromised Protection which stops devices getting auto wiped when marked as compromised, we then setup a compliance rule to highlight the compromised devices. This stopped devices being wiped and allowed us to identify the compromised devices to capture logs from and then worked with VMware to prove it was safteynet marking the device as compromised
To do this
Disabled Compromised Protection
Settings > Apps > Settings and Policies > Compromised Protection > change to disabled save
Create compliance policy
Devices > Compliance Policy > List view > Add
Rules > Compromised status = Is compromised
Action > Send email to Admin
Assignment > Top OG
Save
2, After collecting logs we identified that although we had disabled Safteynet in the System settings all existing devices still had Safetynet enabled on the device side (NOTE new enrolments were fine SafetyNet was disabled as per the system setting was only existing device that did not take the settings). We investigated this with VMware for some time and ended up having to deploy the following custom XML profile to the devices.
<characteristic type="CustomSettingsV2" uuid="e459fdf2-22dd-4b5b-8502-0aafe72167ec">
<parm name="packageid" value="com.airwatch.androidagent" />
<parm name="CustomSettings" value="{
 "CustomSettings": "{\"SafetyNetEnabled\": false}"
}" />
</characteristic>
Once deployed we confirmed from the device logs that all existing devices had correctly disabled SafetyNet and the issue was resolved
Hope this helps
