# Getting Started with Android Enterprise Program Overview: The Modern Android Management Framework -------------------------------------------------- Android Enterprise (AE) is Google’s native framework for managing Android devices in the workplace. It replaces the legacy “Device Administrator” mode with a more secure, flexible, and privacy-conscious architecture. By integrating AE with Hexnode UEM, organizations can secure corporate data while providing a seamless user experience. ### Core Strategic Benefits - **Standardized Security**: Consistent management across different hardware manufacturers (Samsung, Pixel, OnePlus, etc.). - **Data Containerization**: Strict separation between personal and work data through the “Work Profile.” - **Managed Google Play**: Silent deployment of apps without requiring personal Google Accounts. - **Zero-Touch Enrollment**: Automated, out-of-the-box provisioning for large fleets. ### Supported Versions To successfully get started with Android Enterprise program, ensure your hardware meets these minimum requirements: - **General Android Devices**: Version 5.0 and above. - **Samsung Knox Devices**: Version 6.0 and above. Understanding Management Modes Android Enterprise offers two distinct operational modes. Choosing the right one is critical before you begin. FeatureDevice Owner ModeProfile Owner ModeTarget DeviceCorporate-OwnedPersonal (BYOD)Control LevelFull Device ControlLimited to Work ProfileData PrivacyAdmin manages all dataAdmin cannot see personal dataKey FeatureKiosk Mode & Silent InstallContainerization (Work vs. Personal)### The Containerization Concept For devices enrolled as **Profile Owner**, Android Enterprise creates a “Work Profile.” - **Visual Distinction**: Work apps are marked with a “briefcase” badge icon. - **Data Separation**: Creates an encrypted container for work data. - **Privacy**: Admins cannot interact with, view, or wipe personal apps, photos, or data outside the work container. Steps to Get Started with Android Enterprise Program ----------------------------------------------------- Follow these steps to register your organization and devices. ### Step 1: Enroll your Organization #### Choice of Integration Mode Before touching the devices, you must link your organization to Google. 1. **[Google Workspace](https://www.hexnode.com/mobile-device-management/help/how-to-enroll-organization-in-android-in-the-enterprise-using-hexnode-mdm/) (G Suite)**: Ideal for organizations already using Google for their identity provider (IdP). This requires domain verification. 2. **[Managed Google Play Accounts](https://www.hexnode.com/mobile-device-management/help/configure-android-in-the-enterprise-using-gsuite-in-hexnode-mdm/) (Gmail-based)**: Ideal for organizations using Microsoft 365 or other IdPs. No domain verification is required; you simply link a standard Gmail account to act as the “Enterprise Admin.” ### Step 2: Enroll the Devices Once the organization is linked, enroll the specific devices based on ownership: - [**As Device Owner**](https://www.hexnode.com/mobile-device-management/help/how-to-enroll-a-device-in-android-in-the-enterprise-as-device-owner-using-hexnode-mdm/): Enroll fresh/factory-reset devices. Use methods like QR Code enrollment, Zero Touch, or NFC. - [**As Profile Owner**](https://www.hexnode.com/mobile-device-management/help/how-to-enroll-a-device-in-android-in-the-enterprise-as-profile-owner-using-hexnode-mdm/): Send an enrollment request to an existing device. The user accepts, and the Work Profile is created. ***Note**: You can also utilize [Google Workspace](https://www.hexnode.com/mobile-device-management/help/how-to-enroll-android-devices-in-android-in-the-enterprise-using-gsuite-in-hexnode-mdm/) (formerly G Suite) to facilitate enrollment for both modes.* App Management and Distribution -------------------------------- Android Enterprise significantly streamlines how applications are deployed and controlled. ### Silent App Distribution You can push apps without user interaction (no prompts). 1. [**Managed Google Apps**](https://www.hexnode.com/mobile-device-management/help/how-to-approve-and-add-afw-apps-using-hexnode-mdm/): Approve and add to inventory -> Distribute -> Installs silently. 2. **Store Apps**: Automatically converted to Managed Google Apps for silent deployment. 3. **[Enterprise Apps (APK)](https://www.hexnode.com/mobile-device-management/help/how-to-silently-install-enterprise-apps-on-android-in-the-enterprise-enabled-devices-for-kiosk-mode/)**: Installs silently on **Device Owner** modes (requires the latest Hexnode for Work agent). ### Configuration and Permissions - **[Pre-configurations](https://www.hexnode.com/mobile-device-management/help/set-up-permissions-and-configurations-for-an-app-using-hexnode-mdm/)**: Define app settings (like server URLs) before installation. - **[Permissions](https://www.hexnode.com/mobile-device-management/help/set-up-permissions-and-configurations-for-an-app-using-hexnode-mdm/)**: Pre-approve or deny runtime permissions (e.g., Camera, Location) so the user isn’t prompted. - **[Blocklist/Allowlist](https://www.hexnode.com/mobile-device-management/help/how-to-blacklist-whitelist-apps-in-android-in-the-enterprise-enabled-devices-using-hexnode-mdm/)**: Restrict device usage to a specific set of approved applications. Advanced Customization ----------------------- - [**Kiosk Mode**](https://www.hexnode.com/mobile-device-management/help/kiosk-mode-in-devices-enrolled-via-android-for-work/): Lock **Device Owner** devices to a single app or specific set of apps. - [**Custom Play Store**](https://www.hexnode.com/mobile-device-management/help/customize-play-store-with-custom-apps-using-hexnode-mdm/): Design a “Play for Work” store layout that displays only the apps approved by your organization. Troubleshooting Android Enterprise Issues ------------------------------------------ Common hurdles when you get started with Android Enterprise program and how to fix them. ### Issue 1: “Can’t create Work Profile” error. **Cause**: The device may already have a work profile, or the device manufacturer does not support it. **Solution**: Check *Settings > Accounts* to see if a work profile exists. If not, verify the device is Android 5.0+ and GMS (Google Mobile Services) certified. ### Issue 2: Briefcase icons are missing. **Cause**: The device was enrolled as a “Device Owner” instead of “Profile Owner,” or the launcher doesn’t support badging. **Solution**: “Device Owner” manages the whole device, so badges are sometimes not shown (as the whole device is work). Re-enroll as Profile Owner if separation is needed.