Skip to main content

098: Android Enterprise

Implementation Effort: High
User Impact: High

Overview​

Android Enterprise is the modern management framework for Android devices with Google Mobile Services in Microsoft Intune. It supports multiple ownership and usage models, including personally owned work profile, corporate-owned work profile, fully managed, and dedicated devices. From a Zero Trust perspective, Android Enterprise is important because it provides the controls required to separate work and personal data, enforce compliance, deploy secure apps, and build a reliable path for identity and device trust. It should be treated as the default strategic platform for Android management rather than as one option among many equal legacy modes.

Implementation Guidance​

  1. Connect Intune to Managed Google Play and validate the tenant-wide prerequisites before designing app or enrollment workflows.
  2. Map each user or device persona to the right Android Enterprise mode. BYOD usually fits work profile, assigned corporate phones may fit fully managed or corporate-owned work profile, and kiosks fit dedicated mode.
  3. Build platform-specific baselines for compliance, configuration, certificate, Wi-Fi/VPN, and app deployment instead of assuming one policy set fits every mode.
  4. Avoid legacy Android Device Administrator except for temporary, explicitly justified exceptions, and keep a migration plan for any remaining legacy estate.
  5. Automate enrollment where possible and define how users get support if enrollment, Google account dependencies, or app provisioning fail.
  6. Review the estate regularly for unsupported Android versions, stale enrollment methods, and app dependencies that prevent modernization.

Reference​