Android device management is the practice of controlling and securing the Android phones, tablets, and purpose-built devices that people use for work, from the moment a device is unboxed until it's wiped and retired. Organizations use an Android mobile device management (MDM) solution to enroll devices in bulk, push Wi-Fi, VPN, and security settings, install business apps, keep operating systems current, and lock or wipe a device that goes missing, without handling each one by hand.
Most enterprise Android management today runs on Android Enterprise, Google's framework for work devices. It covers company-owned phones handed to employees, personal devices used under a BYOD policy, and frontline hardware such as rugged handhelds, barcode scanners, point-of-sale terminals, and kiosks. ManageEngine Mobile Device Manager Plus (MDM Plus) acts as the management layer that applies Android Enterprise controls across all of these, from a single console.
Android device management, often called Android MDM, is the use of software to remotely enroll, configure, secure, and monitor Android devices that access corporate data. An admin creates policies in the MDM console, and the devices apply them over the air.
The role of Android Enterprise. Android Enterprise (previously Android for Work) was introduced in Android 5.0. Older Android management relied on the Device Administrator API, which Google has deprecated. Android Enterprise replaced it with a standard set of management modes, Managed Google Play for app distribution, and consistent APIs across manufacturers. An MDM solution such as MDM Plus is the tool admins use to apply those Android Enterprise controls in practice.
Ownership first, then management mode. "Corporate-owned" and "BYOD" describe who owns the device. "Fully Managed" and "Work Profile" describe how much of it the MDM manages. The two line up like this: an employee-owned device can only be managed through a work profile, while a company-owned device can be Fully Managed, Fully Managed with a work profile (COPE), or a Dedicated device. Decide the ownership model, then pick the mode that fits it.
Corporate-owned vs. employee-owned devices. On a company-owned device, the organization can control the whole device, or the whole device plus a separate work profile when personal use is allowed. On an employee-owned device, Android Enterprise limits IT to a work profile. The employee's personal apps and data stay outside the organization's control.
Android device management covers far more than smartphones. The same console manages tablets, rugged handhelds, barcode scanners, POS systems, digital signage, kiosks, and other dedicated devices that run Android.
Android devices carry corporate email, documents, customer records, and app sessions. If one is lost, stolen, or left unpatched, that data is exposed. MDM enforces passcodes, restricts risky functions, and lets IT lock or wipe a device remotely, which cuts the exposure window from days to minutes.
Most organizations run both models at once. MDM lets IT apply full-device policies to company-owned devices while limiting management on personal devices to a work profile, so one console handles both without overreaching on employee privacy.
When every device is configured by hand, settings drift. MDM applies the same Wi-Fi, VPN, certificate, and restriction profiles to every device in a group, and any device added to that group later picks up the same configuration.
Instead of asking users to find and install apps, IT distributes public and private apps through Managed Google Play, installs them silently on managed devices, pre-configures them, and controls when they update.
Field technicians, delivery drivers, and remote employees rarely visit the office. MDM lets IT provision, update, troubleshoot, and secure these devices over the internet, wherever they are.
An Android fleet can include devices from many manufacturers, running different Android versions, with different hardware capabilities. MDM gives IT one inventory across all of them and adds manufacturer-specific controls through tools like Samsung Knox and OEMConfig.
The management mode is set at enrollment and decides how much of the device IT controls. Changing modes later usually means a factory reset and re-enrollment, so it's worth choosing carefully.
| Aspect | Work Profile (BYOD) | Company-Owned Work Profile (COPE) | Fully Managed | Dedicated device |
|---|---|---|---|---|
| Device ownership | Employee | Organization | Organization | Organization |
| IT control | Work profile only | Work profile, plus selected device-level controls | Entire device | Entire device, locked to specific apps |
| Personal usage | Yes, outside the work profile | Yes, in the personal space | Limited to what IT allows | No |
| Work Profile support | Yes | Yes | No (whole device is managed) | No |
| Data separation | Work and personal data kept apart by the OS | Work and personal data kept apart by the OS | Not applicable, all data is corporate | Not applicable, single purpose |
| Ideal use case | Employees using their own phones for email and work apps | Company phones that employees may also use personally | Work-only phones and tablets | Kiosks, POS, scanners, signage, shared frontline devices |
Work Profile mode (previously called Profile Owner) creates a separate, OS-managed workspace on an employee's personal device. Work apps carry a briefcase badge, and IT policies apply only inside that profile. IT can, for example, block copying data from work apps to personal apps, restrict app installation in the work profile, and restrict screen capture there. It can't see or control personal apps, photos, or messages. Enrollment doesn't require a factory reset, which makes it practical for existing devices. The trade-off is that fewer controls are available than on a Fully Managed device.
Company-Owned Work Profile (COPE), which MDM Plus also calls Fully Managed with a Work Profile, is for devices the organization owns but lets employees use personally. The device gets a work profile and a personal space. Compared with BYOD, IT gains extra protections: users can't remove the work profile, admins can perform a complete wipe, and Enterprise Factory Reset Protection can be applied. The personal space still stays unmanaged. COPE needs a new or factory-reset device and is set up through Zero-touch, Knox Mobile Enrollment, or QR code enrollment.
Fully Managed mode (previously Device Owner) gives IT control over the entire device. It supports the widest set of restrictions, including camera, microphone, USB, NFC, tethering, location services, and VPN configuration, along with OS update policies and complete wipe. It's the right choice for work-only phones and tablets. Fully Managed devices are usually provisioned from a factory-reset state.
Dedicated devices (also known as COSU, corporate-owned single-use) are company-owned devices built for one task. They're Fully Managed devices locked to one app or a small set of apps, typically with kiosk mode. Dedicated devices go beyond public kiosks. They include POS terminals, barcode scanners, rugged handhelds, digital signage, check-in tablets, and shared devices that move between workers on different shifts.
Enrollment is where the management mode gets decided, so MDM Plus ties each enrollment method to the modes it supports:
MDM Plus also supports NFC enrollment for Fully Managed devices. Learn more about Android device enrollment here.
Is the MDM app required? App requirements vary by enrollment method and management mode. For Work Profile enrollment through invites or self enrollment, the user installs the ManageEngine MDM Self Service app from Google Play and uses it to scan the QR code or open the enrollment link, and the app then creates the work profile. For corporate provisioning methods such as Zero-touch, Knox Mobile Enrollment, QR code, and EMM token, the device downloads the app as part of setup, so nobody installs it by hand. When a device is removed from MDM, its profiles and apps are removed, but the Self Service app stays on the device until the user uninstalls it.
Configuration profiles let IT set up devices remotely so they're ready for work the moment they're enrolled, and stay that way:
Not every control works everywhere. Many restrictions, including camera, USB, NFC, tethering, location services, and VPN configuration, apply only to Fully Managed devices. Work Profile devices support a smaller set that acts on the work profile. Some settings also depend on the Android version (several display, time zone, and airplane mode controls need Android 9.0 or later) or on the manufacturer. Check the Android feature comparison matrix before planning a policy. Learn more about Android profiles here.
Managed Google Play is the core of Android Enterprise app management. Once it's set up in MDM Plus, admins can:
Users can also install approved apps on their own from an app catalog. Learn more about Android app management here.
Learn more about Android security management here.
Uncontrolled OS updates can break business apps or flood the network, while delayed updates leave devices unpatched. MDM Plus handles both:
OS update management is available in the Professional, Free, and Trial editions. Work Profile devices don't support OS update policies. Learn more about automating Android OS updates.
Kiosk mode turns a device into a dedicated, single-purpose tool:
Kiosk mode needs a Knox-enabled Samsung device or a non-Samsung device running Android 5.0 or later enrolled as Fully Managed. Learn how to set up Android Kiosk Mode.
Remote control requires Android 5.0 or later with the device enrolled as Fully Managed, and it's available in the Professional, Free, and Trial editions. On Android 15, the OS hides sensitive screens and password fields during remote sessions as part of its screen share protection. Learn more about remote troubleshooting for Android.
Built-in and custom reports can be generated instantly or scheduled. Device privacy settings let you choose which details are collected, especially for personally owned devices. Learn more about reports here.
| Enrollment method | Best suited for | Ownership type | Deployment scale | User involvement | Zero-touch capability |
|---|---|---|---|---|---|
| Zero-touch | New corporate devices bought through a zero-touch reseller | Corporate (Fully Managed or COPE) | Large | Minimal, the device enrolls during setup | Yes |
| Knox Mobile Enrollment | New or reset Samsung devices | Corporate (Fully Managed or COPE) | Large | Minimal, the device enrolls during setup | Yes |
| QR code | Devices not registered for Zero-touch or KME | Corporate (Fully Managed or COPE) | Small to medium | Scan a QR code on each device | No |
| EMM token (afw#memdm) | Devices set up by hand without a reseller program | Corporate (Fully Managed) | Small to medium | Enter the token during setup, then scan a QR code | No |
| Work Profile enrollment | Employees' personal devices | Personal (BYOD) | Any | User installs the MDM Self Service app and follows an invite, link, or self-enrollment steps | No |
| ADB | Testing, or provisioning deployed devices without a reset | Corporate (Fully Managed) | Small | IT connects each device over USB | No |
A simple rule: use Zero-touch or Knox Mobile Enrollment whenever your devices are eligible, QR code or EMM token for the rest of your corporate fleet, and Work Profile enrollment for personal devices.
Every managed Android device moves through the same stages, whether it's a sales rep's phone or a warehouse scanner. What changes from one device to the next is the management mode, and the mode decides which actions are available at each stage.
Decide the ownership model and management mode first, then pick the enrollment method that supports it. Set up Managed Google Play before you enroll anything, because app distribution on Android Enterprise depends on it. Associate profiles and apps with a device group before enrollment, and assign that group in the enrollment settings, so each device receives the right configuration as soon as it enrolls, with no manual follow-up. For a large rollout, enroll a small pilot batch first and confirm that profiles and apps land as expected.
Push Wi-Fi, VPN, certificate, and passcode profiles so devices can reach corporate resources immediately. If Wi-Fi or VPN uses certificate-based authentication, distribute the certificate or SCEP configuration in the same rollout so the connection works on first try. Keep account-based settings, like email and Wi-Fi, in a separate profile from restrictions, so changing a restriction doesn't force users to re-enter credentials.
Approve apps in Managed Google Play, add in-house apps to the App Repository, and distribute them silently. Use managed app configurations so users don't have to set apps up themselves. On kiosk and dedicated devices, distribute the kiosk app before you apply the kiosk policy, so the device has something to lock to.
Apply passcode and restriction policies that match the device's mode. Fully Managed devices can take the full set of hardware and network restrictions. COPE devices add protections such as a work profile the user can't remove and Enterprise Factory Reset Protection. Work Profile devices get controls focused on data separation, and device privacy settings decide what's collected from them.
Review inventory, applied and violated policies, OS versions, and battery and storage levels. Watch the last contact time for devices that have stopped checking in, since a device that doesn't contact the server can't receive new policies or commands. Schedule reports so problems show up before users report them.
For Fully Managed devices, set OS update policies with a deferral of up to 30 days, maintenance windows of at least two hours, and freeze periods for times when nothing should change. Schedule app update policies outside working hours. Test updates on a small group before releasing them to everyone, and use inventory reports to find devices still running older versions.
When something breaks, scan the device for current details, then use remote view or control and chat commands to fix it without collecting the device. For unattended kiosk hardware, unattended access lets IT connect without anyone on site to accept the session.
To reissue a device, deprovision it, which wipes its data and removes its apps and policies, then re-enroll it for the next user. Devices registered for Zero-touch or Knox Mobile Enrollment enroll again automatically after a reset, which makes reassignment quick. When an employee leaves a BYOD program, remove the work profile. When a device reaches end of life, wipe it completely, mark it retired in the inventory, and release it from your Zero-touch or Knox account before you sell or recycle it, so it doesn't try to enroll into your MDM for its next owner.
Android runs on hardware from many manufacturers, and each one adds its own features, settings, and update schedules. Android Enterprise standardizes the basics, but rugged and enterprise devices often have capabilities, like scanner configuration or programmable buttons, that the standard APIs don't cover. That's why the same policy can behave differently from one manufacturer to the next.
OEMConfig is an Android Enterprise standard that lets manufacturers publish an app exposing their device-specific settings. MDM Plus pushes these settings as managed app configurations through an OEM Configurations profile. Supported OEMConfig apps include Samsung's Knox Service Plugin and apps from Zebra, Honeywell, Lenovo, Datalogic, and other vendors. Only one OEMConfig app can be distributed to a device, and the available settings depend on what the manufacturer includes.
Feature availability also varies by manufacturer for remote control, hardware button restrictions, and firmware updates. Zebra is a good example: enabling remote control uses the Legacy Zebra OEMConfig app on Android 11 and earlier, and the Zebra OEMConfig Powered by MX app on Android 13 and later. Check the relevant help pages for your device models before rolling out a policy.
Frontline devices sit in warehouses, delivery vans, production floors, stores, hospitals, and job sites. They're often shared, often unattended, and need to work every shift without IT standing next to them.
In manufacturing and field services, rugged tablets and handhelds need manufacturer-specific settings, scheduled firmware updates, and remote troubleshooting because they're far from IT. Learn more about rugged device management.
In warehouses and logistics, scanners need consistent scanner settings, which are applied through OEMConfig, and they're locked to the picking or inventory app so workers can't wander into other apps mid-shift.
In retail and hospitality, POS devices run in single-app kiosk mode with the payment app, with settings and hardware buttons restricted so customers and staff can't change them. Maintenance windows and freeze periods keep OS updates away from trading hours and peak sales periods.
In healthcare and retail, one device passes through several hands each day. Fully Managed devices can be configured for shared use, with limited functionality and user switching, so each worker's session stays separate.
Digital signage, patient check-in tablets, and delivery devices each have one job. Dedicated-device management locks them to that job, keeps them updated outside working hours, and lets IT fix them remotely.
BYOD programs succeed when employees trust what IT can and can't do. Android Work Profile is designed for exactly that.
Learn more about privacy management in BYOD.
Match each device group to a mode. Use Work Profile for personal devices, COPE for company devices with personal use, Fully Managed for work-only devices, and Fully Managed with kiosk for dedicated devices. Before you start, set up Managed Google Play in MDM Plus, since Android Enterprise app distribution depends on it.
Go to the Enrollment tab and configure the method that fits the mode, such as Zero-touch, Knox Mobile Enrollment, or QR code for corporate devices, or Enrollment > Invite to Enroll and self enrollment for BYOD. Assign a device group during setup so devices land in the right group automatically.
Under Device Mgmt > Profiles, create an Android profile with Wi-Fi, VPN, certificate, and restriction settings, and associate it with the device group.
Add Managed Google Play and in-house apps to the App Repository, add managed configurations where needed, and distribute the apps to the group for silent installation.
Add a passcode policy, decide which restrictions to enforce based on the mode, and set device privacy settings for personal devices. Then go to Device Mgmt > Automate OS updates to create an Android OS update policy, and set up app update policies.
Use the Inventory tab and reports to check device status, installed apps, OS versions, and violated policies. Schedule reports for regular review.
Roll out updates through your update policies. To troubleshoot, open the Inventory tab, select the device, and choose Actions > Remote Control or Remote View. Deprovision, wipe, or retire devices when they change hands or reach end of life.
Give ManageEngine's Android MDM a try, free for 30 days, and simplify Android device management.
Mobile Device Manager Plus also supports the management of HarmonyOS devices. Learn how.
Yes. Employee-owned Android devices are managed through an Android Work Profile. The employee enrolls through an invite, an enrollment link or QR code, or self enrollment, using the ManageEngine MDM Self Service app, and no factory reset is needed. IT then manages the work apps, work data, and work profile policies, while the personal side of the device stays outside its control.
No. On a Work Profile device, IT sees device details such as model and OS version, plus the work apps and policies it manages. MDM Plus can't collect call logs, browsing history, app data, photos, files, or passwords on any device. Admins can also use device privacy settings to stop collecting details like phone number, user-installed apps, or location from personal devices.
For new corporate devices, use Android Zero-touch enrollment if you buy through a zero-touch reseller, or Samsung Knox Mobile Enrollment for Samsung devices. Both enroll devices automatically during setup, so they can ship straight to users. For corporate devices that aren't registered with either program, use QR code or EMM token enrollment. For employee-owned devices, send enrollment invites by email or SMS to many users at once, or share a self-enrollment link.
Yes. With Managed Google Play set up in MDM Plus, admins can distribute public Play Store apps, private enterprise apps, and in-house APKs, and install them silently on managed devices without user action. On Work Profile devices, apps install inside the work profile. Admins can also push managed app configurations and control when apps update.
The right choice depends on your fleet. Look for support for all four Android Enterprise modes, Zero-touch and Knox Mobile Enrollment for bulk provisioning, Managed Google Play integration, OS update controls, kiosk management, OEMConfig support for the manufacturers you use, remote troubleshooting, and privacy controls for BYOD. Google's Android Enterprise Recommended program is a useful starting filter, since it validates vendors against Google's requirements. ManageEngine MDM Plus is Android Enterprise Recommended, holds the Gold badge for 2026, and covers each of these capabilities, so you can test it against your own devices with a free 30-day trial.
Yes. MDM manages employee-owned Android devices through Android Enterprise Work Profile, which creates a separate work space on the device. IT manages only the work apps, data, and policies inside that profile, and employees can enroll through an invite, a QR code or enrollment link, or self enrollment without a factory reset.
No. On a Work Profile device, IT can see device details such as the model and OS version, along with the work apps and policies it manages. Mobile Device Manager Plus can't collect call logs, browsing history, app data, photos, files, or passwords, and admins can use privacy settings to stop collecting details like location on personal devices.
Use Android Zero-touch enrollment or Samsung Knox Mobile Enrollment for corporate devices bought through a participating reseller. These devices enroll automatically during setup and receive the profiles and apps assigned to their device group. For devices not registered with either program, use QR code enrollment on new or factory-reset devices.
Yes. Mobile Device Manager Plus distributes public and private apps through Managed Google Play, along with in-house apps uploaded to the App Repository, and installs them silently on managed devices. On Work Profile devices, apps are installed inside the work profile. Where silent installation isn't supported, apps are sent to the app catalog for the user to install.
The right Android MDM depends on your fleet, but it should support every Android Enterprise mode you need, Zero-touch and Knox Mobile Enrollment, Managed Google Play, OS update control, kiosk mode, and OEMConfig for rugged devices. ManageEngine Mobile Device Manager Plus is an Android Enterprise Recommended solution that covers these capabilities, manages Android alongside other platforms, and is available in the cloud or on-premises.