Android device management is the practice of controlling and securing the Android phones, tablets, and purpose-built devices that people use for work, from the moment a device is unboxed until it's wiped and retired. Organizations use an Android mobile device management (MDM) solution to enroll devices in bulk, push Wi-Fi, VPN, and security settings, install business apps, keep operating systems current, and lock or wipe a device that goes missing, without handling each one by hand.
Most enterprise Android management today runs on Android Enterprise, Google's framework for work devices. It covers company-owned phones handed to employees, personal devices used under a BYOD policy, and frontline hardware such as rugged handhelds, barcode scanners, point-of-sale terminals, and kiosks. ManageEngine Mobile Device Manager Plus (MDM Plus) acts as the management layer that applies Android Enterprise controls across all of these, from a single console.
Android device management, often called Android MDM, is the use of software to remotely enroll, configure, secure, and monitor Android devices that access corporate data. An admin creates policies in the MDM console, and the devices apply them over the air.
The role of Android Enterprise. Older Android management relied on the Device Administrator API, which Google has deprecated. Android Enterprise replaced it with a standard set of management modes, Managed Google Play for app distribution, and consistent APIs across manufacturers. An MDM solution such as MDM Plus is the tool admins use to apply those Android Enterprise controls in practice.
Corporate-owned vs. employee-owned devices. On a company-owned device, the organization can control the whole device, or the whole device plus a separate work profile when personal use is allowed. On an employee-owned device, Android Enterprise limits IT to a work profile. The employee's personal apps and data stay outside the organization's control.
Android device management covers far more than smartphones. The same console manages tablets, rugged handhelds, barcode scanners, POS systems, digital signage, kiosks, and other dedicated devices that run Android.
Android devices carry corporate email, documents, customer records, and app sessions. If one is lost, stolen, or left unpatched, that data is exposed. MDM enforces passcodes, restricts risky functions, and lets IT lock or wipe a device remotely, which cuts the exposure window from days to minutes.
Most organizations run both models at once. MDM lets IT apply full-device policies to company-owned devices while limiting management on personal devices to a work profile, so one console handles both without overreaching on employee privacy.
When every device is configured by hand, settings drift. MDM applies the same Wi-Fi, VPN, certificate, and restriction profiles to every device in a group, and any device added to that group later picks up the same configuration.
Instead of asking users to find and install apps, IT distributes public and private apps through Managed Google Play, installs them silently on managed devices, pre-configures them, and controls when they update.
Field technicians, delivery drivers, and remote employees rarely visit the office. MDM lets IT provision, update, troubleshoot, and secure these devices over the internet, wherever they are.
An Android fleet can include devices from many manufacturers, running different Android versions, with different hardware capabilities. MDM gives IT one inventory across all of them and adds manufacturer-specific controls through tools like Samsung Knox and OEMConfig.
The management mode is set at enrollment and decides how much of the device IT controls. Changing modes later usually means a factory reset and re-enrollment, so it's worth choosing carefully.
| Aspect | Work Profile (BYOD) | Company-Owned Work Profile (COPE) | Fully Managed | Dedicated device |
|---|---|---|---|---|
| Device ownership | Employee | Organization | Organization | Organization |
| IT control | Work profile only | Work profile, plus selected device-level controls | Entire device | Entire device, locked to specific apps |
| Personal usage | Yes, outside the work profile | Yes, in the personal space | Limited to what IT allows | No |
| Work Profile support | Yes | Yes | No (whole device is managed) | No |
| Data separation | Work and personal data kept apart by the OS | Work and personal data kept apart by the OS | Not applicable, all data is corporate | Not applicable, single purpose |
| Ideal use case | Employees using their own phones for email and work apps | Company phones that employees may also use personally | Work-only phones and tablets | Kiosks, POS, scanners, signage, shared frontline devices |
Work Profile mode (previously called Profile Owner) creates a separate, OS-managed workspace on an employee's personal device. Work apps carry a briefcase badge, and IT policies apply only inside that profile. IT can, for example, block copying data from work apps to personal apps, restrict app installation in the work profile, and restrict screen capture there. It can't see or control personal apps, photos, or messages. Enrollment doesn't require a factory reset, which makes it practical for existing devices. The trade-off is that fewer controls are available than on a Fully Managed device.
Company-Owned Work Profile (COPE), which MDM Plus also calls Fully Managed with a Work Profile, is for devices the organization owns but lets employees use personally. The device gets a work profile and a personal space. Compared with BYOD, IT gains extra protections: users can't remove the work profile, admins can perform a complete wipe, and Enterprise Factory Reset Protection can be applied. The personal space still stays unmanaged. COPE needs a new or factory-reset device and is set up through Zero-touch, Knox Mobile Enrollment, or QR code enrollment.
Fully Managed mode (previously Device Owner) gives IT control over the entire device. It supports the widest set of restrictions, including camera, microphone, USB, NFC, tethering, location services, and VPN configuration, along with OS update policies and complete wipe. It's the right choice for work-only phones and tablets. Fully Managed devices are usually provisioned from a factory-reset state.
Dedicated devices (also known as COSU, corporate-owned single-use) are company-owned devices built for one task. They're Fully Managed devices locked to one app or a small set of apps, typically with kiosk mode. Dedicated devices go beyond public kiosks. They include POS terminals, barcode scanners, rugged handhelds, digital signage, check-in tablets, and shared devices that move between workers on different shifts.
Enrollment is where the management mode gets decided, so MDM Plus ties each enrollment method to the modes it supports:
MDM Plus also supports NFC enrollment for Fully Managed devices. Learn more about Android device enrollment here.
Configuration profiles let IT set up devices remotely so they're ready for work the moment they're enrolled, and stay that way:
Not every control works everywhere. Many restrictions, including camera, USB, NFC, tethering, location services, and VPN configuration, apply only to Fully Managed devices. Work Profile devices support a smaller set that acts on the work profile. Some settings also depend on the Android version (several display, time zone, and airplane mode controls need Android 9.0 or later) or on the manufacturer. Check the Android feature comparison matrix before planning a policy. Learn more about Android profiles here.
Managed Google Play is the core of Android Enterprise app management. Once it's set up in MDM Plus, admins can:
Users can also install approved apps on their own from an app catalog. Learn more about Android app management here.
Learn more about Android security management here.
Uncontrolled OS updates can break business apps or flood the network, while delayed updates leave devices unpatched. MDM Plus handles both:
OS update management is available in the Professional, Free, and Trial editions. Work Profile devices don't support OS update policies.
Kiosk mode turns a device into a dedicated, single-purpose tool:
Kiosk mode needs a Knox-enabled Samsung device or a non-Samsung device running Android 5.0 or later enrolled as Fully Managed. Learn how to set up Android Kiosk Mode.
Remote control requires Android 5.0 or later with the device enrolled as Fully Managed, and it's available in the Professional, Free, and Trial editions.
Built-in and custom reports can be generated instantly or scheduled. Device privacy settings let you choose which details are collected, especially for personally owned devices. Learn more about reports here.
| Enrollment method | Best suited for | Ownership type | Deployment scale | User involvement | Zero-touch capability |
|---|---|---|---|---|---|
| Zero-touch | New corporate devices bought through a zero-touch reseller | Corporate (Fully Managed or COPE) | Large | Minimal, the device enrolls during setup | Yes |
| Knox Mobile Enrollment | New or reset Samsung devices | Corporate (Fully Managed or COPE) | Large | Minimal, the device enrolls during setup | Yes |
| QR code | Devices not registered for Zero-touch or KME | Corporate (Fully Managed or COPE) | Small to medium | Scan a QR code on each device | No |
| EMM token (afw#memdm) | Devices set up by hand without a reseller program | Corporate (Fully Managed) | Small to medium | Enter the token during setup, then scan a QR code | No |
| Work Profile enrollment | Employees' personal devices | Personal (BYOD) | Any | User follows an invite, link, or self-enrollment steps | No |
| ADB | Testing, or provisioning deployed devices without a reset | Corporate (Fully Managed) | Small | IT connects each device over USB | No |
A simple rule: use Zero-touch or Knox Mobile Enrollment whenever your devices are eligible, QR code or EMM token for the rest of your corporate fleet, and Work Profile enrollment for personal devices.
Decide the management mode first, then pick the enrollment method that supports it. Associate profiles and apps with a device group before enrollment, and place devices in that group as they enroll. They'll receive the right configuration automatically, with no manual follow-up.
Push Wi-Fi, VPN, certificate, and passcode profiles so devices can reach corporate resources immediately. Keep account-based settings, like email and Wi-Fi, in a separate profile from restrictions, so changing a restriction doesn't force users to re-enter credentials.
Approve apps in Managed Google Play, add in-house apps to the App Repository, and distribute them silently. Use managed app configurations so users don't have to set apps up themselves.
Apply passcode and restriction policies that match the device's mode. Fully Managed devices can take the full set of hardware and network restrictions. Work Profile devices get controls focused on data separation.
Review inventory, applied and violated policies, OS versions, and battery and storage levels. Schedule reports so problems show up before users report them.
Set OS update policies with deferral and maintenance windows for Fully Managed devices, and app update policies that run outside working hours. Test updates on a small group before releasing them to everyone.
When something breaks, scan the device for current details, then use remote view or control and chat commands to fix it without collecting the device.
To reissue a device, deprovision it, which wipes its data and removes its apps and policies, then re-enroll it for the next user. When an employee leaves a BYOD program, remove the work profile. When a device reaches end of life, wipe it completely and mark it retired in the inventory.
Android runs on hardware from many manufacturers, and each one adds its own features, settings, and update schedules. Android Enterprise standardizes the basics, but rugged and enterprise devices often have capabilities, like scanner configuration or programmable buttons, that the standard APIs don't cover. That's why the same policy can behave differently from one manufacturer to the next.
OEMConfig is an Android Enterprise standard that lets manufacturers publish an app exposing their device-specific settings. MDM Plus pushes these settings as managed app configurations through an OEM Configurations profile. Supported OEMConfig apps include Samsung's Knox Service Plugin and apps from Zebra, Honeywell, Lenovo, Datalogic, and other vendors. Only one OEMConfig app can be distributed to a device, and the available settings depend on what the manufacturer includes.
Feature availability also varies by manufacturer for remote control, hardware button restrictions, and firmware updates. Check the relevant help pages for your device models before rolling out a policy.
Frontline devices sit in warehouses, delivery vans, production floors, stores, hospitals, and job sites. They're often shared, often unattended, and need to work every shift without IT standing next to them.
In manufacturing and field services, rugged tablets and handhelds need manufacturer-specific settings, scheduled firmware updates, and remote troubleshooting because they're far from IT. Learn more about rugged device management.
In warehouses and logistics, scanners need consistent scanner settings, which are applied through OEMConfig, and they're locked to the picking or inventory app so workers can't wander into other apps mid-shift.
In retail and hospitality, POS devices run in single-app kiosk mode with the payment app, with settings and hardware buttons restricted so customers and staff can't change them.
In healthcare and retail, one device passes through several hands each day. Fully Managed devices can be configured for shared use, with limited functionality and user switching, so each worker's session stays separate.
Digital signage, patient check-in tablets, and delivery devices each have one job. Dedicated-device management locks them to that job, keeps them updated outside working hours, and lets IT fix them remotely.
BYOD programs succeed when employees trust what IT can and can't do. Android Work Profile is designed for exactly that.
Learn more about privacy management in BYOD.
Match each device group to a mode. Use Work Profile for personal devices, COPE for company devices with personal use, Fully Managed for work-only devices, and Fully Managed with kiosk for dedicated devices. Before you start, set up Managed Google Play in MDM Plus, since Android Enterprise app distribution depends on it.
Go to the Enrollment tab and configure the method that fits the mode, such as Zero-touch, Knox Mobile Enrollment, or QR code for corporate devices, or invites and self enrollment for BYOD. Assign a device group during setup so devices land in the right group automatically.
Under Device Mgmt > Profiles, create an Android profile with Wi-Fi, VPN, certificate, and restriction settings, and associate it with the device group.
Add Managed Google Play and in-house apps to the App Repository, add managed configurations where needed, and distribute the apps to the group for silent installation.
Add a passcode policy, decide which restrictions to enforce based on the mode, set device privacy settings for personal devices, and create OS and app update policies.
Use the Inventory tab and reports to check device status, installed apps, OS versions, and violated policies. Schedule reports for regular review.
Roll out updates through your update policies, troubleshoot remotely when issues come up, and deprovision, wipe, or retire devices when they change hands or reach end of life.
Give ManageEngine's Android MDM a try, free for 30 days, and simplify Android device management.
Mobile Device Manager Plus also supports the management of HarmonyOS devices. Learn how.
Yes. MDM manages employee-owned Android devices through Android Enterprise Work Profile, which creates a separate work space on the device. IT manages only the work apps, data, and policies inside that profile, and employees can enroll through an invite, a QR code or enrollment link, or self enrollment without a factory reset.
No. On a Work Profile device, IT can see device details such as the model and OS version, along with the work apps and policies it manages. Mobile Device Manager Plus can't collect call logs, browsing history, app data, photos, files, or passwords, and admins can use privacy settings to stop collecting details like location on personal devices.
Use Android Zero-touch enrollment or Samsung Knox Mobile Enrollment for corporate devices bought through a participating reseller. These devices enroll automatically during setup and receive the profiles and apps assigned to their device group. For devices not registered with either program, use QR code enrollment on new or factory-reset devices.
Yes. Mobile Device Manager Plus distributes public and private apps through Managed Google Play, along with in-house apps uploaded to the App Repository, and installs them silently on managed devices. On Work Profile devices, apps are installed inside the work profile. Where silent installation isn't supported, apps are sent to the app catalog for the user to install.
The right Android MDM depends on your fleet, but it should support every Android Enterprise mode you need, Zero-touch and Knox Mobile Enrollment, Managed Google Play, OS update control, kiosk mode, and OEMConfig for rugged devices. ManageEngine Mobile Device Manager Plus is an Android Enterprise Recommended solution that covers these capabilities, manages Android alongside other platforms, and is available in the cloud or on-premises.