Why the ownership model comes first
On Android, the way a device is enrolled decides what the MDM can do with it for the rest of its life. A device enrolled with a work profile cannot later be turned into a fully managed device without a factory reset. So the ownership model is not a detail to settle after rollout. It is the first decision.
The model answers three questions:
- Who pays for and owns the device? The organization or the employee.
- Is personal use allowed? Never, sometimes, or the device is personal to begin with.
- How much can IT control? The whole device, a separate work area, or a single app.
COBO: corporate-owned, business-only
The organization buys the device and it is used for work only. The MDM manages the whole device as Device Owner (Android calls this a fully managed device).
Advantages
- Full control: apps, settings, hardware, updates and remote wipe.
- Simplest to secure and to audit.
- Personal data does not mix with work data, because there should not be any.
Disadvantages
- Employees may end up carrying two phones.
- Higher cost, since the organization buys every device.
- Monitoring must still be proportionate and explained to staff.
Fits public agencies, security forces and field teams handling sensitive data. See government, defense and security and the company-owned devices scenario.
COPE: corporate-owned, personally enabled
The organization owns the device but allows personal use. On Android 11 and later, this is done with a work profile on a company-owned device: work apps and data live in a separate, managed profile, while the personal side belongs to the user.
Advantages
- One device for work and personal life.
- The organization keeps ownership and can apply some device-wide rules, such as blocking factory reset or requiring a screen lock.
- Clear separation of work and personal data.
Disadvantages
- Less control than COBO on the personal side. Since Android 11, IT cannot see personal apps or data.
- Needs clear rules on what happens to personal data when the device is returned.
Fits managers, sales teams and staff who would otherwise carry two phones. See field sales and FMCG.
CYOD: choose your own device
CYOD is a variation of COBO or COPE. The organization offers a short list of approved models, and the employee picks one. The organization still buys and owns it.
Advantages
- Employees get a device they prefer, which helps adoption.
- IT supports a limited set of models rather than anything on the market.
Disadvantages
- Purchasing and support are more complex than with a single standard model.
- Technically it is not a separate mode: each device is enrolled as COBO or COPE.
Fits organizations that want some user choice without the support burden of BYOD.
BYOD: bring your own device
Employees use their own phones for work. The MDM creates a work profile on the personal device and manages only that profile, as Profile Owner.
Advantages
- No hardware cost for the organization.
- Employees keep one familiar device.
- Strong privacy: the organization cannot see personal apps, messages, photos or browsing.
Disadvantages
- Limited control: no device-wide restrictions, no full wipe, no kiosk mode.
- The employee can remove the work profile at any time, which also removes the work data.
- Device models and OS versions vary widely.
Fits office staff who need email, calendar and a few business apps. See work profile and BYOD.
COSU: corporate-owned, single-use
Also called dedicated devices. The device belongs to the organization and does one job: a kiosk, a handheld scanner, a ticket validator, a digital sign. The MDM is Device Owner and locks the device to one app or a small set of apps using kiosk mode.
Advantages
- The device always does what it is meant to do. Users cannot leave the app or change settings.
- Often shared between shifts, so fewer devices are needed.
- Easy to replace: a new device enrolls with the same profile and behaves identically.
Disadvantages
- No general use, by design.
- The kiosk configuration needs testing so that users are not locked out of something they need.
Fits retail, logistics, hospitality, education and heavy industry. See retail, transport and logistics, mining and heavy industry and the kiosk and dedicated devices scenario.
Comparison table
| COBO | COPE | CYOD | BYOD | COSU | |
|---|---|---|---|---|---|
| Who owns the device | Organization | Organization | Organization | Employee | Organization |
| Personal use | No | Yes | Depends on policy | Yes | No |
| Android mode | Fully managed (Device Owner) | Work profile on company-owned device | Fully managed or work profile | Work profile (Profile Owner) | Dedicated device (Device Owner) |
| IT control | Whole device | Work profile plus some device rules | As COBO or COPE | Work profile only | Whole device, locked to set apps |
| User privacy | Low, by design | High on the personal side | As COBO or COPE | High | Not applicable |
| Remote wipe | Whole device | Work profile, or whole device | As COBO or COPE | Work profile only | Whole device |
| Kiosk mode | Possible | No | As COBO | No | Yes, the main purpose |
| Enrollment | QR, NFC, zero-touch on a new or reset device | QR or zero-touch on a new or reset device | As COBO or COPE | App and wizard on a device in use | QR, NFC, zero-touch on a new or reset device |
| Typical users | Field staff, public sector | Managers, sales | Knowledge workers | Office staff | Kiosks, handhelds, shared devices |
Choosing the right model
Work through your device groups one at a time and ask:
- Does the device handle sensitive data or need to meet strict security rules? Choose COBO.
- Does it do a single job, or is it shared between shifts? Choose COSU. Shared devices are covered in shared devices.
- Do people need one phone for both work and personal life, and will the organization pay? Choose COPE, or CYOD if you want to offer a choice of models.
- Do people only need email and a few apps, and will they use their own phones? Choose BYOD.
A typical mid-sized organization ends up with something like this: BYOD for headquarters staff, COPE for managers, COBO for field technicians and COSU for warehouse handhelds and reception tablets. Each group gets its own enrollment profile and policy.
Privacy and data protection
The more control a model gives, the more personal data the organization may process. With COBO, location and usage data can reveal a lot about an employee. With BYOD, the work profile keeps that risk low. Whatever the model, tell employees what is collected and why. Our guide on MDM and data protection explains the main points under GDPR and KVKK.
How DeepManage does it
DeepManage supports each model on Android: fully managed devices (COBO, CYOD), work profiles on company-owned devices (COPE, Android 11 and later), work profiles on personal devices (BYOD) and dedicated devices in single-app or multi-app kiosk mode (COSU). Each device group gets its own enrollment profile, so one QR code can enroll a device in the right mode with the right policy. See device enrollment and kiosk mode.