Android Enterprise

Here is a breakdown of the management scenarios that Android Enterprise supports:

As is evident, there is a lot of flexibility to support most business needs that are built right in. The most common management scenario is shown here, where the organisation owns the device but allows some personal use (COPE), available from Android 8.0.

For more information, see Google’s Android Enterprise datasheet.

With the introduction of Android 5.0, Google made user profiles available for mobile phones in addition to the tablets that already use them. With the same functionality, Android Enterprise is able to create a managed user profile, which although it is completely separately encrypted on disk (and from Android 7.0 onwards uses completely different encryption for professional/private purposes), is directly integrated with the current user on the device. This way, both private and professional apps can be provided in the same app drawer, with the professional apps indicated by a briefcase:

Source: bayton.org, Foto: Android Enterprise Arbeitsprofil, das ändert sich im Andoid Pie

The mix of work and personal apps together on the above BYOD device shows the level of integration. As an end user, it feels like just a few more apps are installed, even though the underlying profile configurations work to separate and secure corporate data. DLP policies can prevent the transfer of corporate information outside of the work profile or vice versa. Should a corporate wipe occur, the work profile is simply removed and all user data remains untouched.

Additionally, Google has added work profile authentication for the work profile. This is essentially a secondary password requirement to access corporate data within the profile. BlackBerry Good, MobileIron Apps@Work or AirWatch Container have supported this feature for many years.

This allows the work profile to be paused (temporarily shut down) for evenings, weekends or holidays, which is a great benefit for employees. It can thus help to promote a healthy work-life balance. This has improved massively again with Android 11, where the Android Enterprise team worked closely with Digital Wellbeing to enable automatic work profile scheduling. Thanks to APIs, administrators can ensure that the work profile cannot be turned off indefinitely.

The biggest limitation of the whole BYOD approach from an administrator’s perspective is, as one might suspect, the limited control and visibility over the device itself. Organisations do not ‘see’ anything outside of the work profile and thus can only enforce very basic device-wide policies such as the passcode.

For fully managed devices, there is usually no provision for user provisioning. Since the intended use is for fully company-owned devices, all typical BYOD or COPE scenarios are omitted for these devices and the device is strictly limited to the environment defined by the EMM administrator. However, as of Android 8.0, the COPE scenario has been introduced with support for work profiles on fully managed devices.

By default, when deploying a fully managed device, almost all non-critical system apps are removed unless they are whitelisted. Instead, only access to authorised apps is granted via the managed Google Play.

This means that should an app require the camera function, for example, a camera app would also need to be authorised or whitelisted for enterprise use. There is support for enabling system apps, however this support includes all OEM/carrier apps, which most would want to see removed. It therefore requires certain applications to be disabled rather than enabled as described above.

Fully managed provisioning is currently initiated on the first system boot of a new device – or a device freshly reset from the factory:

• A provisioning app on a dedicated provisioning device (configured with EMM server details) and an NFC bump or tag that can be used to boot devices
• A DPC identifier on the screen to set up a Google account
• A QR code (ideal for devices without NFC)
• Zero-touch enrolment

In Android 10, NFC bump provisioning is deprecated and NFC tags are recommended for NFC provisioning instead.