Android adoption has increased rapidly over the last few years, becoming the go-to OS for many organisations the world over. Due to the diversity of the platform and flexibility of form factor, application and budget, Android is making a huge impact on how employees undertake their daily responsibilities.
While iOS has typically (though not exclusively) been reserved for C-levels and senior management, employees lower down the corporate ladder are often provided more budget-friendly Android handsets. It makes sense really, although there are many flagships competing directly with Apple, there are even more directly targeting the mid-to-low end of the market at very attractive prices – perfect for mobility on a budget, right?
Up until relatively recently, not really.
EMM (Enterprise Mobility Management) platforms rely on APIs to communicate with and control managed devices. Things like disabling the camera, Bluetooth or preventing access to system settings are all individually exposed via one or multiple APIs. This is important to know and it’s not limited to Android.
The difference is while iOS, Windows (Phone), QNX (BlackBerry) and others include these APIs with their respective operating systems and system applications, for many years Android did not, or offered very few – certainly not enough to consider manageable by any stretch.
That wasn’t the end of the world however; because Android is open source, manufacturers can build upon it and tweak it as much as they see fit. While other manufacturers tested the waters, offering some API functionality here and there, Samsung saw the gap in the market and devoted resources to making a splash.
And it paid off.
Today Samsung is by far the strongest Android device manufacturer for the enterprise due to their early efforts and not only that, they’re the most-supported Android manufacturer for EMM solutions. Other manufacturers have since added APIs to try and compete but compared to Samsung with Knox (SAFE) and Knox Premium, there’s really no comparison.
The downside is how Samsung deploy their APIs; the more expensive devices tend to get the newest versions of Knox, while the mid-market and budget have to endure older versions, occasionally causing confusion (if they’re all 2017 models, why don’t they all have the same management capabilities?) and often meaning the newest EMM functionality won’t work with the cheaper devices as well (if at all).
The same goes for system applications, too. EMM requires APIs in order to push PIM data to the email, contacts and calendar apps on devices. For a long time it was either not possible or very unreliable to try to push Exchange data to a mid-range HTC, for example, and near impossible on other devices. Finding devices besides Samsung that could be reliably managed was no trivial task – eventually 3rd party apps such as K9, touchdown and many others began showing up offering EMM integration; for organisations only really needing basic management and PIM who were prepared to purchase licenses for these 3rd party apps, they could relatively safely look beyond Samsung.
And that’s really how it’s been until recently, when it seems Google had taken notice of both the uneven playing field for enterprise device selection and a recurring perception that Android security is somewhat lacking.
Or, as it was until 2016, Android for Work.
Android enterprise debuted with 5.0 Lollipop in 2014 as an optional* solution manufacturers could add to their OS images in order to integrate a common set of device management and EMM APIs. From 6.0 Marshmallow it was no longer optional and has since been a mandatory component for all GMS-certified manufacturers. There are still some optional components for Android enterprise today and the occasional feature released only for newer versions of Android, however these have little impact on core management.
Android enterprise (AE) offers a few things:
Here’s a breakdown of the management scenarios Android enterprise supports:
As can be seen, there’s a lot of flexibility for supporting most business requirements baked right in, with the additional – the most common – management scenario, where the organisation controls the device but permits some personal usage, available with Android 8.0 and so far supported only by MobileIron. All of these scenarios are available as soon as Android enterprise has been enabled on the EMM platform of choice.
There are two ways of enabling Android enterprise, the first and original is through a G Suite managed domain that requires either an existing G Suite subscription or a free single-user account used for little more than initial setup and, optionally, managed app approval. If domain verification hasn’t already been done through G Suite, the business will need to undertake a couple of tasks to prove they own the domain they’re setting AE up against.
The second and newer method is managed Google Play accounts and works with any Google account – No domain verification required, takes practically minutes to set up and Google manages the individual Android enterprise accounts on the managed devices, meaning there’s no need for additional Google account or GSuite user management.
Whichever method is used, it’s then possible (but not necessarily required since G Suite has basic EMM functionality) to link one of many existing EMM platforms which support AE and configure the corporate Play Store, Managed Google Play.
Some EMM platforms don’t make use of the Managed Google Play Store and instead manage apps through the integrated EMM app catalogue as has always been traditionally available, an example would be MobileIron (note, as of 9.3 MobileIron also uses Managed Google Play and from 9.5 the administrator can choose between the two):
The benefit of utilising an EMM platform for app management is managed app configs, making it extremely easy to tailor applications to the business for immediate use on deployment, no additional end-user configuration required:
For EMM admins the above config may look familiar, though apps like Chrome offer far more granular functionality around permitted domains, browser functionality and more.
Even better, because Android enterprise takes care of the device accounts via managed Google Play accounts, there’s no need for a per-user or shared Google account to be on the device, and applications can be pushed down silently!
With the introduction of Android 5.0 Google made user profiles available to phones in addition to tablets that already had it. Using the same underlying functionality, Android enterprise is able to create a managed user profile that although sits entirely separately encrypted on disk (and as of Android 8.0, utilises completely different encryption keys for work/personal), integrates directly with the current user on the device in order to provide both personal and work applications in the same app drawer – the latter indicated by a briefcase:
The mix of work and personal apps together on the above BYOD handset demonstrates the level of integration; as an end-user it feels like just another few apps installed, despite the underlying profile configurations working to separate and secure the corporate data. DLP policies can prevent the transfer of enterprise information outside of the work profile, and should an enterprise wipe be issued, it simply removes the work profile and leaves all user data untouched.
In addition for the work profile, Google have added work profile authentication; it’s essentially a secondary passcode requirement in order to access the corporate applications within the profile much like that of which BlackBerry’s Good, MobileIron’s Apps@Work or AirWatch’s Container have supported for many years.
Furthermore, the ability to pause (temporarily turn off) the work profile for evenings, weekends or holidays is a great asset to employees and can help tremendously in promoting a healthy work/life balance, even more so in countries where working hours are enforced.
The biggest issue with the whole BYOD approach is, as might be guessed, the limited control and visibility over the device itself since organisations cannot “see” anything outside of the work profile and may only enforce very basic device-wide policies such as passcode. For organisations needing more of a traditional managed device implementation, consider looking at work-managed, previously device owner (DO) mode.
Provisioning guides for the work profile deployment scenario can be found here: Android enterprise provisioning guides
With work-managed devices there is normally no user space. As the intended use is for wholly company-owned devices, the process of provisioning a work-managed device removes any typically BYOD or COPE (Corporately Owned, Personally Enabled) scenarios and locks the device down strictly to the environment set by the EMM administrator. As of Android 8.0 however, the COPE scenario has been introduced with managed work profile support.
Provisioning a work-managed device strips out almost all non-critical system applications by default unless white-listed and instead provides access only to authorised apps via Managed Google Play. Nothing more. This means should an app require the Camera to function, for example, a Camera app would need to also be authorised or white-listed for use by the business – a scenario I’ve seen cause issues a number of times. There is support for enabling system applications, however this will include all of the OEM/carrier bloat most would want to see removed and will therefore require particular apps be disabled, rather than enabled as described above.
Work-managed provisioning is currently initiated on first boot of a new device – or one that’s been freshly factory-reset – using:
With the NFC bump, depending on the EMM provider provisioning app used, the process will vary slightly in terms of pre-applied settings, what agent is downloaded in order to enrol the device on the relevant platform, etc; AirWatch for example allows for the additional configuration of a named account to directly enrol the device against – very useful for quick staging in bulk. MobileIron and others stay closer to the example set out by Google’s own provisioning app (github source).
Given the need for an NFC bump for this method of provisioning there are some limitations:
The arguably more flexible but geekier option is the DPC identifier introduced in Android 6.0 Marshmallow. Essentially when prompted to add or create an account on a freshly wiped (or directly from the box) device, rather than pop in a Google account such as email@example.com, the user/administrator/device provisioner would type in afw#dpc, where DPC would be the EMM solution being enrolled into:
Utilising this method foregoes the need for the device to be local to administrators and requires no additional provisioning device. It is however less straightforward and more prone to user-error, so clear communications need to be in place to minimise support requests when users are typing awf#dpc or other simple typos.
In Android 7.0 Nougat, the ability to provision a device with a QR code was added for both local and remote provisioning. By tapping on Welcome 6 times when the device boots into the setup Wizard, it will prompt the device to connect to WIFI and start QR enrolment, downloading a QR reader with which to scan an EMM enrolment code such as this one for MobileIron (and it will scan, if you’d like to try, however you’ll need a MobileIron Core to complete enrolment):
In Android 9.0 P, the QR payload is bundled into the system and therefore doesn’t require a download. This offers both much faster provisioning as the device no longer needs to connect to the internet to download the QR package, and the ability to add WiFI credentials to the QR, thus removing one further step from the process. It easily provisions 3x faster than in older Android versions.
Guides for all three of the above work-managed provisioning methods can be found here: Android enterprise provisioning guides
As of Android 8.0, zero-touch has been introduced as a direct competitor to Apple’s DEP. Devices are purchased through authorised resellers, assigned to a zero-touch console and later, when the end-user first takes the device freshly out of the box, will be ready to enrol as a work-managed device straight away; using this method administrators can now finally send devices directly to end-users without the worry of devices not being provisioned due to the number of steps required in the above deployment scenarios. More about zero touch can be read here.
Hopefully the benefits of Android enterprise have been adequately conveyed above. To summarise:
According to Google this is just the beginning. Their aim in the short term is feature parity between other offerings provided by the likes of Samsung and Apple, and long-term to far surpass the management capabilities of everyone else to make Android enterprise the de facto choice for enterprise device management. Of course in doing so, they hope the perception of Android security improves in the process.
If your organisation has struggled in the past managing Android devices, is sick of dealing with Google accounts, is looking for more tools for entirely corporately-owned devices or anything else above, it could well be time to consider Android enterprise.
Furthermore, for assistance in choosing the right devices, please take a look at the supported devices list.
*I mentioned the voluntary incorporation of Android enterprise there because as 5.0 devices began showing up on the market, they were being bought with Android enterprise usage in mind and seemingly found to be missing the needed APIs for reliable management. Not all manufacturers – particularly less popular ones – felt the need to add this new, optional functionality.