Edit

Set up enrollment of Android Enterprise personally owned work profile devices

  • Article

Set up enrollment for bring-your-own-device (BYOD) and personal device scenarios using the Android Enterprise personally owned work profile management solution. During enrollment, a work profile is created on the device to house work apps and work data. The work profile can be managed by Microsoft Intune policies. Personal apps and data stay separate in another part of the device and remain unaffected by Intune.

For more information about Android Enterprise work profile features, see Work profiles (opens Android Enterprise Help).

Requirements

Set up enrollment

Complete these steps to set up enrollment for Android Enterprise devices in BYOD scenarios. Android Enterprise work profile is allowed by default on personal devices enrolling in Intune.

Note

Device enrollment managers can enroll up to 10 devices per account.

  1. Sign in to the Microsoft Intune admin center.

  2. Go to Devices > Enrollment.

  3. Select the Android tab.

  4. In the Enrollment options section, choose Device platform restriction.

  5. Select the Android restrictions tab.

  6. Select Create restriction.

  7. On the Basics page, enter a name and description for the restriction so that you can distinguish it from other restrictions in the admin center. Device users don't see these details.

  8. Select Next to continue to Platform settings.

  9. Configure platform settings for Android Enterprise (work profile). Your options:

    • Platform: Select Allow to permit enrollment with Android Enterprise work profile. Select Block to prevent work profile enrollment. If you block work profile, devices enroll using the Android device administrator management solution, unless device administrator enrollment is also blocked.
    • Personally owned: Select Allow to permit personal devices to enroll with a work profile. Personal devices are allowed by default. Select Block to prevent personal devices from enrolling with a work profile. Android devices that don't support Android Enterprise enroll using the Android device administrator solution, unless device administrator enrollment is blocked.

    Any device that supports Android Enterprise personal work profiles also supports the Android device administrator management solution, so if you don't want Android device administrator to be a part of enrollments, make sure to block the platform. For more information, see device platform restrictions.

    Note

    Today, Android Enterprise work profile management for personal devices is allowed by default. In policies configured before July 2019 without any changes, the default setting blocks Android Enterprise work profile management.

    Important

    Microsoft Intune is ending support for Android device administrator management on devices with access to Google Mobile Services (GMS) on August 30, 2024. After that date, device enrollment, technical support, bug fixes, and security fixes will be unavailable. If you currently use device administrator management, we recommend switching to another Android management option in Intune before support ends. For more information, read Ending support for Android device administrator on GMS devices.

  10. Select Next to continue to Scope tags.

  11. Optionally, apply one or more scope tags to limit restriction visibility and management to certain admin users in Intune. For more information about how to use scope tags, see Use role-based access control (RBAC) and scope tags for distributed IT.

  12. Select Next to continue to Assignments.

  13. Assign the restriction to all users, or select specific groups.

  14. Select Next to continue to Review + create.

  15. Review your choices, and then select Create to finish creating the restriction.

Enroll devices

Communicate enrollment steps to device users. Users typically don't like enrolling themselves, and aren't familiar with the Company Portal app. Be sure to provide guidance, including what information to enter. For some guidance on communicating with your users, see Planning guide: Step 5 - Create a rollout plan.

Users must be signed in to the primary user account on their device when enrolling. Enrollment isn't supported on secondary user accounts. Personal devices previously enrolled with Android device administrator can unenroll, and then re-enroll using the work profile solution.

Tip

You can remotely return a device to a state where it's ready to enroll again by using the Retire function in the admin center. To use this remote action, go to Devices > All devices, and select a device. For more information, see Retire Android device administrator.

For more information and screenshots of the end user experience, see Enroll device with Android work profile in the Intune user help docs.

Data shared with Google

Microsoft Intune shares certain user and device information with Google when Android Enterprise device management is enabled. For more information, see Data Intune sends to Google.

Next steps