Enrollment types

There are three different types of enrollment available for Android Enterprise. Each has special functionalities suitable for specific use cases.

Managed Device #

The Managed Device enrollment type is suitable, for example, for organizations or schools to hand over devices to users who use them exclusively for official or school activities.

• Administrator access: full access to the device, including insight into the list of installed apps and the ability to reset the device to factory settings.
• Requirement: the device must be reset to factory settings before it is commissioned.
• Restriction: no personal profile, the device is intended exclusively for work use. Relution does not automatically prevent additional accounts, such as a private Google ID, from being added. The Disable adding and removing accounts option in the Restrictions → configuration is available for this purpose.

Details on setup: Managed Device →

Managed Device with Personal Profile (Company Owned, Personally Enabled COPE) #

The enrollment type is the counterpart to the work profile and allows devices of an organization to be issued to users who may also use them for private purposes.

• Personal profile: users register their private GoogleID there and install their own apps; private and company-related data are strictly separated.
• Administrator access: full access to the device, but no insight into the personal profile (e.g. no view of installed apps or activated settings).
• Factory reset: required before the device is commissioned; a later factory reset performed by administrators deletes both private and company-related data completely.

Details on setup: Personal profile →

Work Profile / BYOD #

The Work Profile enrollment type is the right choice for the Bring Your Own Device (BYOD) approach: users provide their private device, on which the organization sets up a work profile.

• Requirement: no reset of the device is necessary.
• Usage: the mail app or other apps of the organization can, for example, be made available within the work profile; private and organization-related data are strictly separated.
• Administrator access: no insight into installed private apps, no access rights to functions or settings of the private device.
• Removal: if the work profile is removed, only the organization-related data is deleted — private data is retained.

Details on setup: Work profile / BYOD →

Enrollment options #

When an enrollment is created under Devices → Enrollments, the form shows further options for the Android Enterprise platform in addition to Type and Ownership. They are available for all three enrollment types; restrictions are noted where they apply.

Authentication, Multi-use enrollment and Allow cellular enrollment cannot be changed after saving. According to a notice in the form, every change to an existing Android Enterprise enrollment recreates the registration on Google’s servers; the previous QR code and DPC identifier become invalid as a result.

Authentication #

The Authentication selection field in the Assignment section defines whether a user has to sign in during enrollment:

• Not required (default): the enrollment takes place without sign-in.
• Using Relution Companion app (supports single-use & expiration): the Relution Companion app requires the user to sign in during enrollment. If multi-factor authentication → is set up or enforced for the user, the second factor is confirmed after the password; only then is the device assigned to the user. Users of an organization other than the device’s are rejected as soon as the password has been entered. Multi-use enrollment and Valid until remain available.
• Using Android’s built-in app (enforces multi-use): sign-in takes place without the Companion app during device setup via the Relution login page. If exactly one user in the enrollment’s organization has the email address of the account signed in to Google and this user is neither locked nor deactivated, the user is signed in automatically; otherwise the login page appears. The information Google provides about the signed-in account can only be used once; if the flow is run again, the login page appears as well. If a user with an email address is assigned to the enrollment, it is pre-filled with this user’s email address, otherwise with that of the Google account. The enrollment is assigned to the signed-in user, with Relution creating a separate single-use copy of the enrollment for each device. The form hides Multi-use enrollment and Valid until.

The sign-in flow via Android’s built-in app is only used if the Show Google work account sign-in option is enabled as well. This option is only offered for the Managed device type and requires a managed Google domain, see Google Work-Account-Setup →. Enrollments with this option can always be used for multiple devices and do not expire.

Expiration #

In the Expiration section, Multi-use enrollment defines whether the enrollment can be used for multiple devices. After the date set under Valid until, the enrollment can no longer be used; the default is a date seven days after creation. With the Using Android’s built-in app (enforces multi-use) authentication, the section is not shown.

Compliance #

The Compliance section contains the following options:

• Always require a device password (enabled by default): a device password is required even without an explicit password policy. For this purpose, Relution adds a device password requirement to the enrollment’s default policy, as well as a compliance rule that disables apps as long as no password has been set.
• Allow cellular enrollment: setup may take place via mobile data. Relution adds a corresponding entry to the QR code.
• Language: the selected language is included in the QR code as the language for device setup. Without a selection, the entry is omitted.
• Keep system apps enabled: non-vital system apps remain enabled after enrollment, see Managed Device →.

WiFi #

In the WiFi area, a network for device setup can be stored:

• Connection section: The network’s SSID, This network is hidden, Encryption type (None / Open, WEP or WPA/WPA2 PSK) and, for WEP and WPA, the Password.
• Proxy type section: None, Manual with Host, Port and Bypass proxy for (list of addresses that should not be routed through the proxy) or Automatic configuration with PAC URL (address of the PAC file).

Relution only includes WiFi and proxy in the QR code if The network’s SSID is filled in. A restriction applies to enrollment via NFC, see Enroll devices via NFC →.

Agreements #

In the Configuration section, Agreements can be selected that were created under Settings → General → Agreements. Relution provides their texts to the device during enrollment. The selection is only shown to users with read permission for agreements.