Android Enterprise is a Google-led initiative to enable the use of Android devices and apps in the workplace. The program offers APIs and other tools for developers to integrate support for Android into their enterprise mobility management (EMM) solutions. This site provides developers with an overview of the program and the background information required to start building an Android Enterprise solution.
Android devices: enterprise use cases
This section describes the most common enterprise deployment scenarios for Android devices. You can use Android Enterprise's tools and services to support any or all of these use cases in your EMM solution.
Employee-owned devices (BYOD)
BYOD devices can be set up with a work profile—a feature built into Android 5.1+ that allows work apps and data to be stored in a separate, self-contained space within a device*. An employee can continue to use their device as normal; all their personal apps and data remain on the device's primary profile.
The employee's organization has full management control over a device's work profile, but has no visibility or access to a device's personal profile. This distinct separation gives enterprises control over corporate data and security without compromising employee privacy.*Lightweight mobile application management (MAM) with minimal device management features is available for older devices.
Company-owned devices for knowledge workers
Organizations can exercise full management control over the Android 5.0+ devices they own and issue to employees. There are two deployment options available for these types of company-owned devices: fully managed (Android 5.0+) and fully managed with a work profile (Android 8.0+).
Fully managed deployments are for company-owned devices that are used exclusively for work purposes. Organizations can enforce the full range of management policies on the entire device, including device-level policies that are unavailable to work profiles.
Fully managed devices with work profiles are for company-owned devices that are used for both work and personal purposes. The organization still manages the entire device. However, the separation of work data and apps into a work profile allows organizations to enforce two separate sets of policies. For example:
- A stronger set of policies for the work profile that applies to all work apps and data.
- A more lightweight set of policies for the personal profile that applies to the user's personal apps and data.
Company-owned devices for dedicated use
Dedicated devices (formerly called corporate-owned single-use, or COSU) are a subset of company-owned devices that serve a specific purpose. Android comes with a broad set of management features that allow organizations to configure devices for everything from employee-facing factory and industrial environments, to customer-facing signage and kiosk purposes.
Dedicated devices are typically locked to a single app or set of apps. Android 6.0+ offers granular control over a device's lock screen, status bar, keyboard, and other key features, to prevent users from enabling other apps or performing other actions on dedicated devices.
Integrate Android into your EMM solution
An Android Enterprise solution is a combination of three components: your EMM console, a device policy controller (DPC), and managed Google Play.
EMM solutions typically take the form of an EMM console—a web application you develop that allows IT admins to manage their organization, devices, and apps. To support these functions for Android, you integrate your console with the APIs and UI components provided by Android Enterprise.
All Android devices that an organization manages through your EMM console must install a DPC app during setup. A DPC is an agent that applies the management policies set in your EMM console to devices. Depending on which development option you choose, you can couple your EMM solution with Android's DPC or with a custom DPC that you develop.
Managed Google Play
Managed Google Play is an enterprise app platform based on Google Play that's free to Android Enterprise customers and available for you to integrate into your EMM solution. It combines the familiar user experience and app store features of Google Play with a set of management capabilities designed specifically for enterprises.
IT admins can use managed Google Play to discover apps, view app details, and purchase app licenses. Typically, an IT admin curates, manages, and distribute apps through an EMM console.
Using Android Enterprise APIs, an EMM console can distribute apps to managed devices. Apps can be remotely installed on a device or added to the device's managed Google Play store.
On managed devices, managed Google Play is the user's enterprise app store. The interface is similar to Google Play—users can browse apps, view app details, and install them. Unlike the public version of Google Play, users can only install apps from managed Google Play that are whitelisted for them.
Android EMM lifecycle features
The following section provides an overview of the major features you can integrate into your EMM solution.
Android Enterprise provides APIs and an online setup flow for you to onboard new
customers. When an organization completes the onboarding process, you create an
Enterprise resource for it.
There are two types of enterprises: Managed Google Play Accounts enterprises and Google Accounts enterprises.
Managed Google Play Accounts enterprise
With this type of enterprise, you provision managed Google Play Accounts for devices and end users. Managed Google Play Accounts provide access to managed Google Play, allowing users to install and use work apps selected by IT admins. If your customer uses a 3rd-party identity service, you can link managed Google Play Accounts with your customer's existing identity accounts.
Because this type of enterprise is not tied to a customer's existing domain, you can create more than one Enterprise resource for a single organization. For example, each department or region within an organization could enroll as a different enterprise to manage separate sets of devices and apps.
Google Accounts enterprise
Customers that use Cloud Identity or G Suite already have an existing enterprise ID and existing Google Accounts for users. With this type of enterprise, you need to sync with your customer's LDAP directory and retrieve Google Account information from Google using the Google Directory API.
When setting up a device, each user must manually sign in with their existing Google Account. The account will give them access to managed Google Play in addition to the other Google services already provided by their organization's Cloud Identity or G Suite plan.
Because this type of enterprise is tied to a customer's existing domain, each domain can only be linked with one EMM console.
Device and work profile provisioning
Provisioning is the process of setting up an Android device for management. It typically involves passing the DPC along with other setup details (for example, corporate WiFi credentials) to the device. For fully managed and dedicated devices, Android supports the following provisioning methods:
- Zero-touch enrollment: IT admins use your EMM console to create provisioning configurations and apply them to devices purchased from authorized resellers. These configurations are automatically applied to devices on first boot.
- QR code device provisioning: During setup of a new or factory-reset device, an IT admin scans a QR code generated by the EMM's console that contains provisioning details for the device.
- NFC device provisioning: IT admins "bump" new or factory-reset devices with the EMMs NFC provisioning app to pass provisioning details to the device.
- DPC-identifier install: In the device setup wizard, an IT admin or end user enters a unique DPC identifier (e.g. "emm123#") to download the required DPC and provision the device.
- Google Accounts method: Users enter their Google Account credentials to initiate the provisioning process (Google Accounts enterprises only).
To set up a work profile on an employee-owned device, the following provisioning methods are available:
- Link to provisioning details: An IT admins provides a link to end users containing an enrollment token they can use to set up their work profile.
- Setup from Settings: In Settings > Google, an end users selects "Set up work profile". In the setup wizard, they enter or scan a code to set up a work profile on their device.
- Install DPC from Play: IT admins or end users can install their DPC from Google Play. The DPC then guides the user through the process of setting up a work profile.
- Google Accounts method: Users enter their Google Account credentials to initiate the provisioning process (Google Accounts enterprises only)
Android devices are capable of supporting over 80 different management policies. To support device management, security, and usability features, your EMM console should support a workflow similar to the one described below:
- An IT admin configures management policies in their EMM's console for a specific user, device, group, or similar.
- The policies are communicated to the specified devices via their DPCs.
- The DPCs enforce the policies on specified devices.
If your solution uses Android's DPC, steps 2 and 3 are managed for you. If your solution uses a custom DPC, you need to develop your own way to support step 2 and you use Android's framework APIs to support step 3. See Development options for more details.
App management and distribution
IT admins typically use managed Google Play to browse apps and purchase app licenses. To provide customers with a more unified user experience, you can embed managed Google Play directly into your console as an iframe.
Android Enterprise supports public apps (any app available in Google Play), as well as private apps. Private apps are apps that are only available to users belonging to a specified enterprise. IT admins can publish apps in the Google Play Console, or directly from your EMM console, and restrict their visibility to their enterprise.
Public and private apps are both available for distribution to managed devices. There are two ways to distribute an app: add the app to a device's managed Play store or remotely push install the app to the device. In addition to these distribution methods, you can also use Android Enterprise's APIs to integrate other app management features into your EMM console, such as configuring app settings and managing runtime permission requests.
Next: Development options