Unified Endpoint Management

Configuring an Android Enterprise Work Profile through an MDM (Unified Endpoint Management platform) is the standard approach for BYOD (Bring Your Own Device) deployments. A Work Profile creates a secure, managed container for corporate apps and data while keeping personal apps and data separate.

Prerequisites

Before enrolling devices:

1. Set up Android Enterprise integration in your MDM.
2. Bind the MDM to a managed Google Play account.
3. Create device compliance and security policies.
4. Configure application deployment policies for work apps.

Step 1: Enable Android Enterprise in the MDM

In your MDM console:

1. Navigate to Android enrollment settings.
2. Connect Android Enterprise.
3. Authorize using a managed Google account.
4. Complete the Android Enterprise binding process.

This allows the MDM to manage Android Enterprise devices and distribute applications through Managed Google Play.

Step 2: Create a Work Profile Enrollment Policy

Create an enrollment profile for:

Personally Owned Devices with Work Profile (BYOD)

Typical settings include:

• Require screen lock/PIN
• Configure password requirements
• Data sharing policies
• Approve corporate applications such as:
  • Gmail
  • Outlook
  • Teams
  • Slack
  • Google Drive
  • Internal business apps

Assign them to the Work Profile, so they appear with the Android briefcase badge.

Step 3: Enroll the User's Device

The user typically:

1. Scans the QR code for the enrollment.
2. Signs in with corporate credentials.
3. Accepts management permissions.
4. Allows Android to create a Work Profile.
5. Waits for policy and app deployment to complete.

Android then creates:

• A Personal Profile
• A Work Profile

Work apps are identified by a briefcase icon and remain isolated from personal apps and data.