A short definition
Android Enterprise is Google’s framework for using Android devices at work. It is not an app or a separate product. It is a set of capabilities built into the Android operating system, plus some Google services around it, that a mobile device management (MDM) product uses to manage devices.
Google introduced it as “Android for Work” with Android 5.0 and later renamed it Android Enterprise. It replaced the older Device Administrator API, which Google has deprecated for enterprise use. If you are evaluating an Android MDM today, it should be built on Android Enterprise.
Why it matters
Before Android Enterprise, each manufacturer offered its own management extensions, and what an MDM could do varied from brand to brand. Android Enterprise gives every MDM the same standard set of controls across manufacturers. In practice, this means:
- The same policies work on phones, tablets and rugged devices from different brands.
- Work and personal data can be separated by the operating system, not by an app.
- Devices can be enrolled in a standard way, including fully automatic enrollment.
Manufacturers can still add their own extensions, but the core is common.
The management modes
Android Enterprise defines a small number of management modes. Which one you use depends on who owns the device and what it is for. The business side of this choice is explained in device ownership models.
Fully managed device
The organization owns the device and manages all of it. The MDM agent is the Device Owner. It can install and remove apps silently, enforce password rules, disable hardware such as the camera or USB, block factory reset, configure Wi-Fi and VPN, and wipe the device remotely. This is the mode for COBO devices.
Work profile on a personal device
The employee owns the device. The MDM creates a work profile, a separate, encrypted space for work apps and data, and manages only that space as Profile Owner. Work apps show a briefcase badge. The user can pause work apps outside working hours. The organization cannot see personal apps or data, and removing the work profile removes all work data. This is the mode for BYOD.
Work profile on a company-owned device
Introduced in its current form in Android 11, this mode is for company-owned devices that also allow personal use (COPE). The work profile is managed as on a personal device, but because the organization owns the hardware, the MDM can also apply some device-wide controls, such as blocking factory reset or requiring a screen lock, and can wipe the whole device. It replaced the earlier “fully managed device with a work profile” setup of Android 8 to 10.
Dedicated device
A dedicated device is a company-owned device used for one purpose: a kiosk, a scanner, a sign or a shared tablet. The MDM is Device Owner and uses Android’s lock task mode to keep the device inside one app or a small set of apps. The status bar, notifications and home button can be controlled. This is the mode for COSU. See what is kiosk mode.
Management modes compared
| Mode | Agent role | Who owns the device | Scope of control | Typical model |
|---|---|---|---|---|
| Fully managed | Device Owner | Organization | Whole device | COBO, CYOD |
| Work profile, personal device | Profile Owner | Employee | Work profile only | BYOD |
| Work profile, company-owned device | Profile Owner with extra device rights | Organization | Work profile plus some device-wide rules | COPE |
| Dedicated device | Device Owner | Organization | Whole device, locked to set apps | COSU |
Provisioning: how devices enroll
Provisioning is the process of setting up a device under management. Modes that give the MDM control of the whole device (fully managed, dedicated, and company-owned with a work profile) must be set up when the device is new or freshly factory reset. A work profile on a personal device can be added at any time.
Android Enterprise offers these methods for company-owned devices:
| Method | How it works | Good for |
|---|---|---|
| QR code | Tap the welcome screen six times, then scan a QR code from the MDM console. It contains the agent download location and setup data. | Most deployments, any number of devices |
| NFC | Touch the new device with an NFC tag or another device carrying the setup data. | Batches of devices set up at a desk |
| DPC identifier | Type a code starting with afw# where the setup wizard asks for a Google account. |
Devices without a QR code at hand, for MDMs registered with Google |
| Zero-touch enrollment | The reseller registers the devices to your organization. On first boot, each device contacts Google, receives your MDM configuration and enrolls itself. | Large rollouts, devices shipped directly to users |
Zero-touch requires supported devices bought from a participating reseller. For devices bought elsewhere, QR code and NFC are the usual choices. More on enrollment in how MDM works and device enrollment.
Managed Google Play
Managed Google Play is an enterprise version of the Google Play store. Administrators approve public apps, publish private apps for their organization only, and send app settings (called managed configurations) to devices. Users see only the apps their organization has approved.
Managed Google Play is useful when your apps are on Google Play and your devices have Google services and internet access. It is not the only option. Many MDMs can also install apps, including in-house apps, directly from their own console. That matters for devices in closed networks or devices without Google services.
Other building blocks
- Key attestation and device integrity. Android can prove, with hardware-backed keys, that a device and its key are genuine. MDMs use this to detect tampered devices. See security and compliance.
- Managed configurations. Apps can expose settings that the MDM fills in remotely, such as a server address.
- System update policies. On company-owned devices, the MDM can control when OS updates are installed.
- Android Enterprise Recommended. A Google program that lists devices and services meeting a set of enterprise requirements. It is a helpful filter when choosing hardware.
Examples by industry
- Defense and public safety: fully managed duty phones with strict policies, often in closed networks. See defense and security.
- Healthcare: fully managed or dedicated tablets on wards. See healthcare.
- Education: dedicated classroom tablets in kiosk mode during exams. See education.
- Corporate offices: work profiles on personal phones for email and business apps. See work profile and BYOD.
How DeepManage does it
DeepManage is built on Android Enterprise. Its agent works as Device Owner on fully managed and dedicated devices and as Profile Owner in work profiles, on both personal devices (BYOD) and company-owned devices (COPE, Android 11 and later). Company-owned devices enroll by QR code or NFC, and the agent supports Android’s standard provisioning flow used by QR and zero-touch setup. Apps, including in-house ones, are installed directly from the DeepManage console, so devices in closed networks can receive apps without Google Play. See device enrollment, app management and kiosk mode.
DeepManage also offers an Android Enterprise mode that manages devices through Google’s Android Enterprise service, with Managed Google Play, zero-touch and Samsung Knox Mobile Enrollment. See Android Enterprise integration and Android Enterprise vs classic mode.