When to choose Android Enterprise mode
DeepManage offers two management modes. In classic mode the DeepManage app manages the device directly; it does not need Google services and also works in networks without internet access. In Android Enterprise mode management runs through Google’s Android Enterprise service, and the tools of the Google ecosystem come into play.
Android Enterprise mode is a good fit when:
- you want to distribute apps through Managed Google Play and leave updates to Google,
- new devices should enroll straight out of the box with zero-touch or Samsung Knox Mobile Enrollment,
- employees will use a work profile on their personal phones,
- your policy calls for management that follows Google’s Android Enterprise program.
A side-by-side comparison of the two modes is in Android Enterprise vs classic mode.
How it works
- Connect. An administrator connects the organization to Google from the console. This creates the organization’s Android Enterprise account.
- Enroll. The console creates an enrollment code: a QR code for a fully managed device or an enrollment link for a personal phone. The code can be tied to a device group; the device joins that group when it enrolls.
- Policies and apps. The group’s policies and apps reach the device through Google. The DeepManage app is installed automatically from Managed Google Play.
- Monitor. The device’s status, compliance, software version and apps appear in the device detail and in reports. When a policy or the app list changes, only the affected devices are updated.
App management with Managed Google Play
On the apps page, Google Play search opens inside the console. The app you pick is approved for your organization and added to the catalog. For each app you set the install type (required, preinstalled, available, blocked) and the target (all devices or selected groups). When a device leaves a group, that group’s apps are removed; when it is added back, they are installed again.
If an app supports managed configuration, the console builds a form from the app’s own settings schema. For example, you can set a browser’s home page or turn off incognito tabs; the values are validated and sent to the target devices.
Work profile, COPE and zero-touch
- Work profile (BYOD): The employee opens the enrollment link on their own phone. A separate work profile is created; the organization manages only that profile, and personal apps and data stay out of its view.
- COPE: A company device is set up with a work profile using a QR code. Restrictions on the personal side, such as camera or screenshots, are managed in a separate policy section.
- Zero-touch and Knox Mobile Enrollment: Devices that the reseller assigned to your organization enroll in DeepManage by themselves on first start. The console generates the required configuration from the enrollment code.
For more on ownership models, see our guide to device ownership models.
Policies and kiosk
Android Enterprise policies apply to all devices or to groups. If several policies set the same option, the one with the higher priority wins; a disabled policy has no effect. Options are grouped under security (screenshots, camera, microphone, factory reset, developer options), screen lock, connectivity (USB, Wi-Fi, Bluetooth, mobile network, location), device and system updates.
The kiosk section locks the device to a single app or opens a managed launcher with several apps. The power button, navigation keys, status bar and access to Settings are set here as well. For kiosk in classic mode, see kiosk mode.
Limits to know
- Devices and the server need access to the internet and Google services. Closed networks use classic mode.
- Existing classic devices are not migrated to Android Enterprise mode; switching means enrolling again.
- Live Control works on fully managed devices only and is turned off in work profiles.
- File delivery with content management and console notifications currently go to classic-mode devices.
- Remote lock, reboot and wipe commands are being developed for Android Enterprise mode; today a device can be removed from the organization from the console.