Android devices have features that make them enjoyable to use at home and at work. A separate work profile on your device allows organizations to manage the business data and applications they care about, but leave everything else on your device private and under your control. Work profiles are configured in different ways depending on what type of device you have.
Work profileA work profile allows an IT department to securely manage a work container on your device without restricting you from using their device for personal apps and data. Administrators control the work profile, which is kept separate from your personal accounts, apps, and data. By default, work-profile notifications and app icons have a badge and appear under a work tab in the apps launcher.
To activate a work profile, you must have a device policy controller installed on your device. For details, see Device policy controller or contact your IT administrator. For more information see What is a work profile?
An Enterprise Mobility Management (EMM) device policy controller application allows IT administrators to separately manage access to corporate apps and data on supported Android devices. For more information see What is a device policy controller?
Your organization may choose to provide you with a company-owned device and configure the device to enforce security controls that protect sensitive company data. These Android 5.0+ devices are referred to as fully-managed devices.
Administrators can activate a fully-managed device using one of the following mechanisms:
- Zero-touch enrolment to mass-enroll devices over the air
- A QR code which the device can scan during setup to receive configuration details
- A near field communication (NFC) tag that provides configuration details to new devices via NFC
- An activation token generated by the EMM provider and supplied at initial device setup.
After the device is set up, users can’t disable the device policy controller or use the device in any way that’s not defined by the device policy controller, such as installing personal apps or signing up for a personal Google accounts.
Fully managed device policies allow administrators to enforce policies including:
- Set device lock and remote wipe methods
- Prevent USB file transfer
- Disable keyguard customizations, such as widgets
- Disable mounting of SD cards
- Disallow modifications to Wi-Fi and Bluetooth® settings
- Disable location sharing
Check with your IT administrator to find out which devices are supported for your organization.