Skip to main content

081: Review enrolled vs unenrolled for BYOD/Corporate

Implementation Effort: High
User Impact: High

Overview​

A strong BYOD and corporate-owned strategy starts with deciding how much control is actually required. Some scenarios need app-level protection only, while others require device compliance, certificate deployment, network profiles, or full corporate management. For Zero Trust, the default question should be: what minimum control is required to protect organizational data? Personally owned devices often fit app protection policies without enrollment or Android Enterprise work profile. Corporate-owned devices typically require full management such as fully managed, corporate-owned work profile, or dedicated device modes.

Implementation Guidance​

  1. Define personas and data sensitivity first: executives, knowledge workers, frontline workers, kiosks, contractors, and shared devices usually require different mobile controls.
  2. Use app protection policies without enrollment when the requirement is limited to protecting organizational data in approved apps on personal devices.
  3. Use Android Enterprise personally owned work profile when you need MDM controls over a contained work profile on BYOD devices.
  4. Use fully managed, corporate-owned work profile, or dedicated Android Enterprise enrollment for corporate devices based on whether personal use is allowed and whether the device is shared or single-purpose.
  5. Avoid new Android Device Administrator deployments except for edge cases explicitly documented by Microsoft, and maintain a migration path away from legacy modes.
  6. Pair each enrollment decision with Conditional Access, compliance, app assignment, and a clear privacy notice so users know what the organization can and cannot see or control.

Reference​