What are the Android management options with Microsoft Intune

Today a blog post in which we talk about the management options we have for Android devices with Microsoft Intune. These are not only mobile device management (MDM) options, but also a Mobile Application Management (MAM) option.

I start with four MDM solutions, from which one is currently in public preview, and in the last part of the article, the MAM solution is described.

Mobile Device Management

For Android Enterprise devices, we have four device management solutions with Microsoft Intune;

• Work profile
• Corporate-owned devices with a Work profile (COPE)
• Corporate-owned, fully managed user devices (COBO)
• Corporate-owned dedicated devices (COSU)

The first solution, Work profile, is the only version intended for bring your own device devices (BYOD). The other three solutions are intended for Corporate-owned devices, as you can see on below slide.

Work profile

Let`s start with the BYOD version, Work profile. The reason why I say this is the only MDM solution is how the enrollment is done. The end-user needs to install the Company Portal app manually from the Google Play Store. This is done on a device that is already up-and-running. The other three solutions enroll in Intune during the out-of-the-box experience. Which seems a no-go in my opinion for BYOD Devices.

This solution has a big focus on the privacy of the end-user. Corporate apps are installed in a managed (encrypted) container. This way personal and corporate apps are strictly separated.
Corporate apps are marked with a briefcase icon, so it is clear to the user which apps are corporate apps.

The company has full control over the work profile container, but not over the device itself. The Google Play Store inside the work profile is restricted to the apps made available via Intune. Public apps are available in the Store in the personal part of the device.
A wipe action from the Intune portal would wipe and remove the work profile container but does not wipe the device itself.

If you want to see how you can get started with Work profile and how the end-user experience is, you can read this post.

Corporate-owned with Work profile

The first option for corporate-owned devices is the solution with Work profile. The solution is also known as Corporate-owned, personally enabled user devices.

The enrollment is done during the out-of-the-box experience (OOBE). There are several options to enroll a device during the OOBE, depending on the Android OS version, the vendor and device type. By default you can enroll a device by scanning a QR code, which starts the enrollment. If you manage Samsung devices a zero-touch deployment can be achieved with Knox Mobile Enrollment. Some Android device types can be enrolled by using Googles zero-touch deployment solution.

Compared to the BYOD solution with Work profile, the corporate-owned version is controlled on the device level. The device is fully managed with Intune, a device wipe action resets the device to factory defaults.

But as with the BYOD version, corporate apps and data are stored in a separate work profile container and strictly separated from the personal apps.

In the below video, you see how easy it is, to enroll your device in Intune as personally-owned device with work profile.

If you want to see how you can get started with Corporate-owned with Work profile and how the end-user experience is, you can read this post.

Corporate-owned, fully managed user devices

The Corporate-owned, fully managed user device solution is available in Microsoft Intune since 2019.

As with the Corporate-owned devices with Work profile, enrollment in Intune is done during the out-of-the-box-experience when enrolling as fully managed user device. The device is fully managed, but there is no separation between personal and corporate apps and data.

The admin is able to set restrictions on the device level, such as preventing the user to perform a factory reset. As an admin, you can restrict access to the Google Play store to only allow apps made available via Intune, or leave the store open for public apps.

Fully managed user devices are associated to one single user, in contrast to dedicated dvices.

If you want to see how you can get started with Corporate-owned, fully managed user devices and how the end-user experience is, you can read this post.

Corporate-owned dedicated devices

Corporate-owned dedicated devices are devices for a single purpose. Think of a ticket scanner or a digital signage device.

Enrollment is done during the out-of-the-box-experience, but no authentication needs to be done during the enrollment process. The device is not associated with a user.

Apps on the device are fully managed using Intune, the Google Play Store is not available.

If you want to see how you can get started with Corporate-owned dedicated devices, you can read this post.

Mobile Application Management

Besides the options to manage an Android device with Microsoft Intune, usually done to control access to corporate data, we have the option to only manage applications with Intune.

As you can see in the illustration below, the device itself isn`t managed by Intune, but the applications which are allowed to access corporate data, are managed.

Mobile Application Management is done using App Protection Policies (APP). In such a policy we set data protection and access requirements to keep corporate data save.
Examples of these are restrictions to which apps corporate data can be copied and requiring a PIN code to open a managed app.

The end-user doesn`t see two separate apps when using the app for personal and corporate use. For example Microsoft Outlook mobile. The user can add a personal and corporate email account to Outlook. The APP restrictions are applied to the corporate account and not to the personal account.

An admin has the ability to perform a selective wipe. This action will delete corporate data from the device, without touching the device itself.

An advantage of this Mobile Application Management solution is this is available for Android and iOS devices.

Whether you use device or application management (or a combination of both) to keep your data safe, really depends on the needs and the requirements of the company you implement this for. Make a good comparison between the options every solution provides and the needs you have. And just test every option if you doubt which solution fits your needs,

If you have any questions about Android management, leave a comment below!