barscaret-downcaret-leftcaret-rightcaret-upcheckchevron-leftchevron-rightfile-pdfinfosign-in-altsignin text-widthtimesyoutube
8 min read

A Beginner’s Guide to Android Device Management

8 min read

Katja Keinänen

Most Android devices across different device manufacturers can be managed with a Mobile Device Management (MDM) solution. MDM helps organizations secure and manage their Android smartphones, tablets, and even rugged devices, in an efficient way.

If you’re looking for a better way to manage Android devices and consider implementing an MDM solution in your organization, this guide is for you.

In this article, we’re going to cover:

Which Android devices can be managed with MDM?

As mentioned above, most Android devices can be managed with MDM. Google has a list of Android Enterprise Recommended devices that meet Google’s highest standards.

  • If you’re buying new Android devices for your company, we recommend choosing devices from that list.
  • If you want to manage devices that are not listed, it’s good to test out with one device first to make sure that all necessary MDM features are supported.

Different MDM tools typically enable you to manage both older and newer operating system (OS) versions. However, when managing devices that run older OS versions, you can face limitations with supported features, and they can also be prone to security vulnerabilities. Keeping your devices up to date with the latest OS versions (e.g., Android 12 and Android 11) enables a wider selection of MDM features and helps you keep your devices secure.

Smartphones and tablets can also be used for different use cases in today's organizations. MDM makes it easier to support these different use cases by enabling you to manage both company-owned and personal (BYOD) Android devices with different Android management methods. You can also configure devices for very specific purposes — you can, for example, set devices into Kiosk mode or use them as mobile points of sale.

Benefits of centralized Android management

So why manage Android devices with MDM? In short, centralized device management makes both your IT team's and employees' lives easier. Instead of keeping a manual list of your organization’s devices and setting up each device individually, MDM helps you manage your devices with ease.

More efficient device management

      • New devices can be set up up to 30 minutes faster.
      • Devices can be configured automatically according to a unified company policy, which saves time, reduces errors, and ensures device and data security.
      • Real-time device inventory helps you monitor your devices and keep them up to date.
      • Rolling out new applications and configurations to your entire fleet is easy.

Faster onboarding and more focus on work

      • New employees can be easily onboarded by providing them with pre-configured devices on their first day of work.
      • Employees always have access to the right applications and data.
      • Employees don’t have to deal with technical difficulties as devices and applications can be configured and updated remotely.

Enhanced user privacy and data security

      • Lost and stolen devices can be tracked and wiped remotely.
      • Sensitive business data and its usage can be controlled better.
      • Devices don’t have to be physically configured.
      • IT admins cannot access personal files and apps when using the Work profile.

 

Laptop and a mobile phone

Key concepts in Android device management

Before getting started with Android management, it’s good to learn the basics of Android Enterprise and Managed Google Play — the two key elements in Android management.

What is Android Enterprise?

Android devices are managed through Google’s management framework, Android Enterprise, which was previously known as Android for Work. It is a set of device management APIs and tools that are built into the Android operating system.

Earlier, Android devices were managed through a framework called Device Administrator which has now been deprecated.

Blog: Migrating to Android Enterprise from the Deprecating Device Administrator

Android Enterprise unifies Android management by removing device manufacturer variations and offers the same security and management features for all Android devices. All Android Enterprise Recommended devices can be seamlessly enrolled to an MDM solution through Android Enterprise.

What is Managed Google Play?

Managed Google Play is an enterprise version of Google Play that gives organizations more control over application usage. Managed Google Play enables companies to control access to different applications, configure application settings, and push apps silently to devices via Managed Google Play Store.

To start managing your Android applications, you first need to configure your Managed Google Play Enterprise Account to your MDM platform. Instead of using your personal Google account, we recommend creating a separate one that your entire team can use.

Once set up, you can either deploy applications to devices yourself or allow device users to download approved applications on their own by giving access to a Managed Google Play Store. With MDM, you can also manage application updates, licenses, and runtime permissions centrally for the Managed Google Play apps.

Android management methods

Before enrolling and setting up your devices, you need to determine which management method you want to apply to your devices. There are three different modes to choose from: Work profile (a.k.a. Profile owner), Fully managed (a.k.a. Device owner), and Fully managed with work profile (a.k.a. Android COPE).

The preferred management method depends on who owns the devices and what the devices are used for. It's good to note that the available MDM features vary between these three management methods.

If your employees are using devices for different purposes and use cases, you can also manage devices in different modes. In other words, you don't have to choose one method for all your devices.

Work profile

Android Work profile (a.k.a. Profile owner mode) enables you to easily separate work data from private applications while ensuring device user privacy. The Work profile is a container that isolates work data and apps from personal applications on an Android device.

This management method is the best choice for Bring-Your-Own-Device (BYOD) scenarios where employees or contractors are allowed to use their personal devices for working and accessing your organization’s resources.

If you have company-owned devices that are already in use and you don’t want to reset them, you can manage those devices in the Work profile mode. However, it’s good to note that this “lighter” management mode does not support some Android device management features (e.g., Kiosk mode and some restrictions).

This management method is suitable for:

      • Personally-owned Android devices used for work
      • Company-owned Android devices that are already in use and cannot be reset before device enrollment

Blog: Separate Work Time from Free Time with Android Work Profile

Fully managed

Fully managed device mode (a.k.a. Device owner mode) enables more extensive management options and it is intended for managing devices owned by your company or organization. This management method gives IT administrators extended control over device settings and additional controls that are not available when managing devices using the Work profile.

This management method is suitable for:

      • Company-owned Android devices used only for work

Fully managed with work profile

Fully managed with work profile (a.k.a. Android COPE) is the best option for managing devices that are owned by your organization and used for both work and private use.

This mode gives companies and device users all the benefits of the work profile with an added layer of security. IT can enforce a wide range of company policies on the entire device while device users can rest assured that their personal data, like installed applications, stay private.

In addition to having full control over the work profile, the Fully managed with work profile mode gives companies access to the majority of security features provided in the Fully managed mode.

This management method is suitable for:

      • Company-owned Android devices used for both work and private use

Enrolling Android devices to MDM

The first step in managing your devices is adding them to your MDM platform. You can enroll devices either one by one via NFC, QR code, token, or email/SMS invitation, or automatically with Android Zero-Touch Enrollment (ZTE) or Samsung Knox Mobile Enrollment.

We highly recommend using automated enrollment, especially if you’re managing multiple devices, as it helps you save time and unify device settings. If you prefer to enroll devices one by one, QR code enrollment is a great option as it also works for your existing devices.

What is Android Zero-Touch Enrollment?

Android Zero-Touch Enrollment (ZTE) is an Android program that can be used for automating the setup of company-owned devices. When purchasing new devices, your reseller sets up your Zero-Touch Enrollment account.

With ZTE, the device user only needs to turn on or reset a device, and the device provisions itself with the desired applications and settings.

ZTE is available for all Google Mobile Services (GMS) certified devices running Android 9 or newer, and for selected Android 8 devices. If you’re not able to use ZTE, you can also enroll your devices using NFC, QR code, or token.

What is Samsung Knox Mobile Enrollment?

Samsung Knox Mobile Enrollment (KME) is a similar mobile security platform that comes preinstalled on devices bought from certified device resellers.

The Knox-enabled Samsung devices have built-in support for many additional security features, which enables you to easily enroll, control, and secure your devices with MDM.

What’s the difference?

Unlike ZTE, KME enables you to add Android devices to KME also afterward. You can do that by installing a Samsung application on another Android device and using Bluetooth or NFC to add the device to your KME account. However, it’s good to note that this requires a factory reset.

KME also has better support for older Android versions, whereas ZTE works best for devices running Android 9 and newer.

Enrollment Helper: Find the right enrollment and management method for your devices

Six most essential MDM features for Android devices

So, what exactly can you do with MDM? Here are the most essential features for Android devices:

1. Real-time device inventory and analytics

Instead of manually updating an Excel sheet of your devices, MDM enables you to view real-time data on your devices, including essential hardware and software information. You can stay informed of the status of your devices but also manage your budgets with reporting that’s based on real-time device information.

2. Device configurations

If you’re just getting started with MDM, installing basic configurations on your devices is a must. You can configure company email (Outlook for Android, Gmail for Android), enterprise Wi-Fi, and VPN setting on your devices, or add web shortcuts to important websites on the home screen, among other configurations.

3. Device restrictions

Sometimes you might want to restrict device functionalities to ensure the proper use of devices. You can, for example, use MDM to block potentially harmful applications or certain URLs or deny data connections when roaming. If you want to configure your device to a very specific use case, you can set it into Android kiosk mode.

4. Application management

One of the biggest advantages of using MDM is the possibility to configure and push applications on devices. This way your device users always have access to the most important applications. As mentioned earlier, you can manage applications and application updates through Managed Google Play which is linked to your MDM platform. It’s also possible to install in-house applications using Android APK (Application Package) files.

5. Android system updates

Keeping devices up to date with the latest Android OS updates is one way to secure them. Instead of letting your device users be in charge of updating their smartphones and tablets, with MDM, you can make sure that new updates are installed on devices automatically. You can also schedule or postpone updates.

6. Device and data security

MDM helps you keep your Android devices secure with features like passcode enforcement, Android device encryption, and Android Factory Reset Protection (FRP). And in case one of your devices gets lost or stolen, you can track its location and wipe it remotely.

Miradore offers a wide variety of Android management features.

Android MDM with Miradore

Miradore supports the management of Android devices running Android 6 and newer. In addition to Android devices, our MDM platform also enables you to manage all your Windows and Apple devices in the same portal – making it easier for you to take control of your entire device fleet.

Getting started with Miradore is easy — you can create your account in minutes and start enrolling your devices immediately. It’s also risk-free as you can use our Free plan for as long as you want and upgrade when you want to take additional features into use.

If you want to know more about Miradore, our Account Management team is always happy to help!

 

Discover more

Katja Keinänen Author background

by Katja Keinänen

Katja works as an Inbound Marketing Manager at Miradore and she enjoys transforming technical jargon into easily understandable content pieces.

LinkedIn