Create a Work Profile on Android Devices

General Overview

Q1. What is an Android Work Profile?

An Android Work Profile is a dedicated, isolated container on an Android device where corporate apps and data are kept separate from personal content. It is part of the Android Enterprise framework and allows IT admins to manage work apps and policies without touching the personal data on devices.

Q2. What are the different ways a work profile can be deployed?

A work profile can be created in two primary ways, depending on who owns the device:

• Bring Your Own Device (BYOD / Profile Owner): For devices that belong to the employees, you can enroll the devices in Profile Owner mode. This creates a secure work profile on the user’s personal device to manage corporate apps and data.
• Company-Owned Devices (WP-C): For devices that belong to the company, but where a personal space needs to be intentionally preserved for the users, the WP-C enrollment method can be used to create a work profile on the device. Here, IT admins retain greater control over the device’s security while still giving the employee a private space for personal use.

Q3. How are work and personal apps kept separate in Android Work Profile?

Once a work profile is created, there is a strict boundary between personal and work apps. Data cannot seamlessly flow between the two sides—for example, you cannot copy text from a secure work email and paste it into a personal messaging app. Work apps are easily identifiable by a small “briefcase” badge on their icons.

Q4. Can IT view or access the employee’s personal data?

No. Whether the device is employee-owned or company-owned, the Work Profile enforces strict privacy. IT can manage the work container (wiping corporate data, pushing work apps, enforcing security policies) but cannot view, access, or wipe the employee’s personal apps, browsing history, photos, or messages.

Setup & Requirements

Q5. What are the device requirements to support a Work Profile?

To support a Work Profile, devices generally must meet the following requirements:

• Standard Android devices must run Android 10.0 or later.
• Samsung Knox devices must run Android 11.0 or later.
• Google Play services must be up to date.
• Android Enterprise must be available in your country or region.

Q6. How is a work profile created on a device?

The work profile creation process depends on the device ownership model:

• For BYOD (Personal Devices): The user typically downloads the Hexnode UEM app from the Google Play Store and follows the on-screen prompts to authenticate and generate the work profile. A factory reset is not required.
• For Company-Owned Devices: The device must be provisioned from an out-of-the-box state. It requires a factory reset and is typically set up by scanning a QR code on the initial welcome screen before any personal accounts are added.

Managing the Profile

Q7. Can an employee remove the work profile themselves?

This depends entirely on how the work profile was deployed:

• BYOD (Personal Devices): Yes. Because the employee owns the device, they can remove the Work Profile at any time from their device settings.
• Company-Owned Devices: No. The option to remove the work profile is intentionally disabled. It can only be removed by an IT administrator or by performing a full factory reset.

Q8. How do I know when the work profile is successfully created?

Once setup is complete, you will see a separate “Work” tab in your app drawer. You will also notice a “Hexnode for Work” app icon featuring a briefcase badge, and the device will become visible and manageable within the Hexnode UEM console.

Troubleshooting

Q9. What are the most common reasons work profile creation fails?

Work profile creation failures usually occur if prerequisites are missed. The common culprits include:

• Google Play services are outdated on the device.
• For company-owned setups, the device was not fully factory reset, or a personal Google account was added too early.
• The required enrollment profile was altered or deleted from the Hexnode UEM console during the setup process.
• Android Enterprise is not supported in the device’s region.

Q10. Who should I contact if I cannot resolve a setup issue?

If a device repeatedly fails to create the Work Profile, contact your IT administrator or raise a support ticket via the Hexnode Help Center. Providing the exact error message, device model, Android version, and the deployment type (BYOD vs. Company-Owned) will help speed up the resolution.