Android Enterprise MDM: what it is and how enrollment works

Android Enterprise is Google’s framework for managing Android devices in organizations. It is not an MDM product you buy from Google. It is the set of APIs, management modes, and enrollment methods that Mobile Device Management (MDM) vendors build on to manage Android phones, tablets, and dedicated devices. When IT teams say “Android Enterprise MDM,” they mean an MDM solution that implements Google’s Android Enterprise framework.

This distinction matters because it shapes the buying decision. Every compliant Android MDM uses the same underlying Google framework, management modes, and enrollment methods. What differs among vendors is everything around the framework: cross-platform coverage, pricing, support, offline handling, and console quality. Understanding the framework first makes the vendor comparison clearer.

This guide explains what Android Enterprise is, the four management modes it offers, and how enrollment works across every method. Enrollment is the part most teams underestimate, so it gets the most detail. MDM here means Mobile Device Management for devices, not Master Data Management, which is an unrelated data-governance category that shares the acronym.

Android Enterprise MDM terminology, in one place

Term	Meaning
Android Enterprise	Google’s enterprise management framework built into Android
MDM / EMM	The vendor product that implements Android Enterprise and provides the admin console
Work Profile	Separate, encrypted work container, mainly used for BYOD
Fully Managed	Corporate-owned device managed end to end (historically “Device Owner”)
Dedicated device (COSU)	Corporate device locked to one app or a small approved set, foundation of kiosk deployments
DPC (Device Policy Controller)	The management agent the MDM installs on the device
Managed Google Play	The managed app store from which IT approves and distributes work apps
Zero-touch enrollment	Reseller-based automated provisioning on first boot for corporate devices
DPC identifier (afw#setup)	Manual fallback provisioning method using a setup identifier
Android Enterprise Recommended	Google’s validation program for MDM products and devices that meet its baseline requirements

What is Android Enterprise?

Android Enterprise is the official enterprise management framework built into Android. Google introduced it to replace the older, limited device administration approach with a modern system that separates work and personal data, supports a managed app store, and enables provisioning at scale. It was originally launched as Android for Work, then renamed to Android Enterprise. Some older documentation still uses the legacy name.

The framework provides three things an MDM needs: management modes (how much of the device the organization controls), Managed Google Play (the work app store), and enrollment methods (how devices get provisioned into management). An MDM vendor connects to Android Enterprise, enabling it to enforce policies, push apps, and manage devices.

Android Enterprise vs a standalone MDM

Android Enterprise is the framework. An MDM is the product that uses it. Google maintains the framework and the APIs. The MDM vendor builds the admin console, the policy engine, the reporting, and the support. You do not choose between Android Enterprise and an MDM. You choose an MDM that implements Android Enterprise. Google publishes an Android Enterprise Recommended certification that identifies MDM products and devices validated against its requirements.

Android Enterprise vs the legacy Device Admin API

Before Android Enterprise, Android management used the Device Admin API, an older, more limited approach that managed the entire device without separating work and personal data. Google has steadily restricted Device Admin in favor of Android Enterprise across recent Android releases, removing or limiting administrator capabilities such as password policy enforcement, camera restrictions, and keyguard controls. New management deployments should plan around Android Enterprise rather than Device Admin. Confirm the current deprecation status in Google’s developer documentation before relying on any specific Device Admin capability still in use in your environment.

Android Enterprise management modes

Android Enterprise offers four management modes. The mode determines how much of the device the organization controls and whether personal data stays separate. Choosing the mode is the first decision, before enrollment.

Device scenario	Recommended mode	Why
Employee-owned phone	Work Profile (BYOD)	IT manages work apps and data only, personal side stays untouched
Company phone used only for work	Fully Managed	IT controls the whole device end to end
POS, kiosk, scanner, signage	Dedicated device (COSU)	Device is locked to a specific purpose
Company phone with allowed personal use	Work Profile on company-owned device	IT gets corporate controls while preserving a personal space

Work Profile (BYOD)

Work Profile creates a separate, encrypted container on a personally owned device. Work apps and data live in the profile, marked with a briefcase badge. Personal apps and data stay outside it, untouched by IT. The organization manages only the work profile. It can wipe the profile without touching personal content. This mode fits Bring Your Own Device (BYOD) programs, where employees use their own phones for work.

Fully Managed (Device Owner)

Fully Managed mode, historically called Device Owner, gives the organization control of the entire device. It is for corporate-owned devices. IT manages all apps, settings, and policies across the whole device, not just a work container. This mode fits company-issued phones and tablets where the organization owns the hardware and wants full control.

Dedicated devices / COSU (kiosk)

Dedicated device mode, also called COSU (Corporate Owned, Single Use), locks a fully managed device to one app or a small set of approved apps. The device becomes a single-purpose tool: a POS terminal, a warehouse scanner, a digital sign, a check-in kiosk. The end user cannot exit the locked app or reach the rest of the device. This mode is the foundation of kiosk deployments.

Work Profile on company-owned devices

This mode combines elements of the other two. It applies a work profile to a company-owned device, giving the organization more control than BYOD Work Profile while still preserving a personal space. It suits organizations that issue devices but allow limited personal use with privacy boundaries. The organization gets device-level controls the BYOD work profile does not allow, while the employee keeps a separate personal area.

How Android Enterprise enrollment works

Enrollment is the process of getting a device from out-of-box to fully managed. Android Enterprise supports several enrollment methods, and choosing the right one depends on device ownership, fleet size, and how devices reach their users. The process has four stages regardless of method.

Step 1: Bind your MDM to Android Enterprise

Before enrolling any device, the MDM must be connected to Android Enterprise. The organization links its MDM to a managed Google domain or generates an enterprise enrollment token through the MDM console. This one-time setup establishes the trust relationship between Google’s framework and the MDM. After binding, the MDM can manage Android Enterprise devices and distribute apps through Managed Google Play.

Step 2: Choose the management mode

Decide whether each device or device group will use Work Profile, Fully Managed, Dedicated, or Work Profile on company-owned. The mode is set during enrollment and determines the provisioning path. A BYOD device takes the Work Profile path. A corporate-owned device takes the Fully Managed or Dedicated path, which usually requires the device to be new or factory-reset.

Step 3: Pick an enrollment method

Android Enterprise supports several enrollment methods. The method determines how the device receives its management configuration. Standard Android Enterprise enrollment requires connectivity during provisioning, because the device must contact Google’s services to bind to the enterprise, download the Device Policy Controller, and apply its initial policies.

QR code enrollment. IT generates a QR code in the MDM console. On a new or factory-reset device, the user taps the setup screen several times to open the QR scanner, scans the code, and the device provisions itself into fully managed or dedicated mode. This method is fast, requires no special hardware, and works well for moderate batches.

Zero-touch enrollment. For corporate-owned devices bought through a zero-touch reseller, the device enrolls automatically on first boot with no manual steps. IT pre-assigns devices to the MDM in the zero-touch portal. The employee powers on the device and it configures itself. This method scales best for large corporate fleets shipped directly to users.

NFC enrollment. IT provisions a device by tapping it against a pre-configured NFC source. This method is used in staging environments where many devices are provisioned in one location.

DPC identifier (afw#setup). During setup, the user enters an identifier that downloads the MDM agent (the Device Policy Controller). The device then provisions into the chosen mode. This is a manual fallback method when QR or zero-touch is not available.

Sign-in URL enrollment. For company-owned Work Profile and some Fully Managed scenarios, the user signs in with a managed account through a sign-in URL, and the device provisions based on the user’s identity. This method is useful when enrollment policy depends on which user receives the device.

Manufacturer programs (Samsung Knox Mobile Enrollment and others). Samsung Knox and other manufacturer programs offer reseller-based enrollment similar to Google zero-touch, sometimes with extra device-specific controls. These integrate with the MDM for hands-off provisioning of supported hardware.

For BYOD Work Profile, enrollment is simpler: the user installs the MDM agent from Google Play, signs in with work credentials, and the work profile is created on the existing device without a factory reset.

Scenario	Best enrollment method	Notes
BYOD phones	Work Profile setup via app, settings, token link, or QR	No factory reset needed
New corporate devices shipped to employees	Zero-touch enrollment	Best for scale, requires authorized reseller
Corporate devices staged by IT	QR code	Fast and simple for moderate batches
High-volume staging bench	NFC	More specialized, requires NFC source setup
QR or zero-touch unavailable	DPC identifier (afw#setup)	Manual fallback
Samsung-heavy corporate fleet	Samsung Knox Mobile Enrollment	Manufacturer-specific automated enrollment
User-specific setup logic needed	Sign-in URL	Useful when policy depends on user identity

Step 4: Apply policies and apps

Once enrolled, the MDM pushes policies (passcode rules, encryption, network settings, restrictions) and distributes apps through Managed Google Play. Managed Google Play is the work app store: IT approves apps, and they appear on managed devices automatically or in a managed storefront. The device is now under management and reports compliance back to the MDM console.

Which enrollment method fits your fleet?

Match the method to how your devices are owned and distributed.

• BYOD, personal phones: Work Profile install. The employee adds a work profile to their existing phone with no reset. IT manages only the work container.
• Corporate-owned at scale, shipped to users: Zero-touch enrollment. Devices bought through a zero-touch reseller enroll automatically on first boot, with no IT hands on each device. This is the only method that scales cleanly to hundreds or thousands of shipped devices.
• Corporate-owned, provisioned in-house: QR code or NFC. For moderate batches that IT provisions before handing out, QR code enrollment needs no special hardware. NFC suits high-volume staging benches.
• Kiosks, POS, scanners, signage: Dedicated / COSU mode, provisioned by QR code or zero-touch. The device locks to its single purpose during enrollment.
• Low-connectivity field devices. Standard Android Enterprise enrollment requires connectivity during provisioning, because Google’s services must bind the device to the enterprise and install the Device Policy Controller. Low-connectivity problems usually appear after enrollment, when IT needs to update policies, support users, or change device behavior in the field. For these post-enrollment scenarios, Bento MDM’s Offline QR Commands let IT push policy updates to already-managed devices through a locally scanned QR code, which extends Android Enterprise management to locations where the device cannot reach the MDM over the network.

Choosing an MDM for Android Enterprise

Because Android Enterprise is a Google framework, every compliant MDM implements the same modes and enrollment methods. An MDM cannot offer “better” Work Profile or “better” zero-touch enrollment, because those belong to Google’s framework. Differentiation lives elsewhere.

Evaluate Android MDM vendors on the factors the framework does not standardize. Cross-platform coverage matters if your fleet includes more than Android. Pricing varies widely for the same Android Enterprise capabilities. Offline and low-connectivity handling differs between vendors. Console quality, reporting depth, and support model vary. Android Enterprise Recommended certification confirms a vendor meets Google’s baseline, which is a useful filter.

Category	Examples	Best fit
Cross-platform commercial MDM	Bento MDM, Microsoft Intune, Hexnode, Scalefusion	Mixed fleets that include Android plus iOS, Windows, macOS, or Linux
Android-heavy commercial MDM	AirDroid Business, Scalefusion (rugged focus)	Android-first fleets, remote support, kiosks
Open-source Android MDM	Headwind MDM	Technical teams that want self-hosted Android management
Microsoft ecosystem	Microsoft Intune	Organizations already standardized on Microsoft 365

Apple specialists do not manage Android, so they are out for Android fleets. Bento fits the cross-platform category for teams that manage Android Enterprise alongside iOS, Windows, macOS, and Linux, especially where low-connectivity operations matter. For Android-only fleets that want open-source, Headwind MDM is a self-hosted option built on Android Enterprise.

Frequently asked questions

Is Android Enterprise an MDM?

No. Android Enterprise is Google’s management framework for Android, not an MDM product. It provides the management modes, the Managed Google Play app store, and the enrollment methods that MDM vendors build on. To manage Android Enterprise devices, you use an MDM that implements the framework. Google does not sell a standalone MDM; it maintains the framework that MDMs use.

What is the difference between Android Enterprise and Android for Work?

They are the same framework. Android for Work was the original name when Google launched it. Google later renamed it to Android Enterprise. Some older documentation and forum posts still use Android for Work, but it refers to the same system.

What are the Android Enterprise management modes?

There are four. Work Profile (a separate work container on a personal BYOD device), Fully Managed or Device Owner (full control of a corporate-owned device), Dedicated or COSU (a corporate device locked to a single purpose like a kiosk), and Work Profile on company-owned devices (a work container on a corporate device with a personal space). The mode determines how much of the device the organization controls.

What is an Android work profile?

A work profile is a separate, encrypted container on an Android device that holds work apps and data, kept apart from personal apps and data. Work apps show a briefcase badge. The organization manages only the work profile and can wipe it without touching personal content. It is the standard approach for BYOD, where employees use personal phones for work.

How does Android Enterprise zero-touch enrollment work?

Zero-touch enrollment provisions corporate-owned devices automatically with no manual setup. IT buys devices through a zero-touch reseller and assigns them to the MDM in the zero-touch portal. When an employee powers on the device, it configures itself into management on first boot. It is the method that scales best for large fleets shipped directly to users.

Can I manage Android Enterprise devices without factory resetting them?

For Work Profile (BYOD), yes. The user installs the MDM agent and signs in, and the work profile is created on the existing device with no reset. For Fully Managed or Dedicated mode, the device must be new or factory-reset, because full device control has to be established during the initial setup process.

What MDM works with Android Enterprise?

Most major MDM and unified endpoint management platforms implement Android Enterprise, including cross-platform options like Bento MDM, Microsoft Intune, Hexnode, and Scalefusion, and Android-focused open-source projects like Headwind MDM. Google’s Android Enterprise Recommended certification lists validated products. Since all compliant MDMs use the same Google framework, compare them on cross-platform coverage, pricing, offline handling, and support rather than on Android Enterprise support itself.