public static void startDeviceAndProfileOwnerSharedPostProvisioning(final Context context, final DevicePolicies policies) {
		final boolean owner = Users.isOwner();
		if (SDK_INT >= O) {
			final Set<String> ids = Collections.singleton(AFFILIATION_ID);
			final Set<String> current_ids = policies.invoke(DevicePolicyManager::getAffiliationIds);
			if (! ids.equals(current_ids)) try {
				policies.execute(DevicePolicyManager::setAffiliationIds, ids);
			} catch (final SecurityException ignored) {}	// SecurityException will be thrown if profile is not managed by Island.

			policies.clearUserRestrictionsIfNeeded(context, UserManager.DISALLOW_BLUETOOTH_SHARING);    // Ref: UserRestrictionsUtils.DEFAULT_ENABLED_FOR_MANAGED_PROFILES
		}
		if (owner) policies.clearUserRestrictionsIfNeeded(context, UserManager.DISALLOW_SHARE_LOCATION);		// May be restricted on some devices (e.g. LG V20)

		try {
			if (SDK_INT >= N_MR1 && ! policies.isBackupServiceEnabled())
				policies.setBackupServiceEnabled(true);     // Ref: DevicePolicyManagerService.toggleBackupServiceActive()
		} catch (final SecurityException e) {
			if (SDK_INT != N_MR1 || ! owner && ! "There should only be one user, managed by Device Owner".equals(e.getMessage()))
				Analytics.$().report(e);
		} catch (final IllegalStateException e) {
			Analytics.$().report(e);
		}

		policies.execute(DevicePolicyManager::setShortSupportMessage, context.getText(R.string.device_admin_support_message_short));
		policies.execute(DevicePolicyManager::setLongSupportMessage, context.getText(R.string.device_admin_support_message_long));
		// As reported by user, some account types are strangely unable to remove. Just make sure all account types are allowed.
		final String[] restricted_account_types = policies.getManager().getAccountTypesWithManagementDisabled();
		if (restricted_account_types != null && restricted_account_types.length > 0) for (final String account_type : restricted_account_types)
			policies.execute(DevicePolicyManager::setAccountManagementDisabled, account_type, false);
	}
This is the normal procedure after ManagedProvision finished its provisioning, running in profile.
engine/src/main/java/com/oasisfeng/island/provisioning/IslandProvisioning.java