Category filter

How to enroll a device in Android Enterprise as Work Profile on Company-Owned Device

Google has introduced a new feature for managing Work Profile on Company-Owned Devices (WP-C) in Android Enterprise. WP-C consists of devices owned by the organization and provided to employees for work and personal use. Enrolling these devices creates a dedicated work profile that effectively separates work-related data from personal information. This enrollment allows you to maintain control over the devices and enhance the device security without compromising user privacy. With Hexnode, you can enroll your device in Android Enterprise as a Work Profile on a company-owned device.


  • Android Enterprise enrollment is available with Hexnode UEM’s Pro and above plans.
  • Device requirements:
    1. Samsung Knox devices: Android version 11.0 and above.
    2. Standard Android devices: Android version 10.0 and above.

Initially, enroll your organization in Android Enterprise program and then follow the steps mentioned below to enroll your device as a Work Profile on Company-Owned Device (WP-C).

Hexnode UEM console configuration

  1. Navigate to Admin > Android Enterprise.
  2. Configure the QR Code Settings.
    • Skip encryption: Enable this option to skip device encryption while enrolling the device. This option is enabled by default.
    • Enable system applications: Enable this option to allow system applications on the device. This option is also enabled by default.
    • Note:

      If Enable system Applications is not checked in the portal, then Okta authenticated Android Enterprise Device Owner enrollment will be disrupted with an error message: “No browsers detected! Install one to complete authentication to enroll in Hexnode”.

    • Wi-Fi Settings: You can either choose No Wi-Fi network configuration or Add Wi-Fi network configuration to QR Code. If latter option is chosen, specify the following parameters to add a Wi-Fi configuration to the QR Code:
    • Wi-Fi Settings Description
      SSID Specify the Service Set Identifier (SSID) of the Wi-Fi network.
      Security Type There are three options to choose from – None, WEP, WPA/WPA2. The rest of the Wi-Fi network configurations depend on the security type selected.
      Password Enter the password of the Wi-Fi network if WEP or WPA/WPA2 security type is selected.
      Connect to hidden network Allow users to connect to a hidden Wi-Fi network, the one whose SSID is not broadcasting. By default, connecting to hidden networks is disabled.

      • Devices without a built-in QR Code scanner will prompt users to connect to a network before scanning the QR Code. In such cases, if the Add Wi-Fi network configuration to QR Code option is configured, connect the device to the same network as configured in the portal before scanning the QR Code; otherwise, the scan will fail.
      • If the device is not in the range of the configured Wi-Fi network after scanning the QR Code, it will continue returning to the QR Code scanning page until the device can be connected to the configured network.

  3. Click Save

Configure Android Enterprise settings under the admin tab

Device enrollment steps

If your device is already set up, perform a factory reset to initiate enrollment. Make sure to remove all associated accounts from the device before executing the factory reset. You can start the enrollment directly from the welcome screen for new devices.

  1. Tap on the welcome screen 6 times.
    Welcome screen appears on the device after it is reset or powered on
  2. A QR code reader will get installed on your device.
  3. Using the QR code reader, scan the QR code for ‘Work Profile on Company-Owned Device (WP-C)’. You can locate this QR code within your Hexnode portal by navigating to Admin > Android Enterprise> Work Profile on Company-Owned Device (WP-C) Settings to view the QR code.

    You can also view the QR code on your Hexnode UEM portal from:

    Enroll > All Enrollments > Enterprise > Android Enterprise > Work Profile on Company-Owned Device (WP-C) Settings


    Enroll > Platform-Specific > Android > Android Enterprise > Work Profile on Company-Owned Device (WP-C) Settings

    Screen displaying a QR code scanner on the device

  4. Click on Agree to continue the installation process.

    Screen displaying the permission to set up a work profile

  5. Click on Agree after reading the Hexnode End-User License Agreement.
    Screen displaying the permission to complete work profile on company-owned device enrollment
  6. Your device will begin enrolling with Hexnode UEM.
    Hexnode app page showing that the device is currently undergoing enrollment
  7. Next, you will be brought back to some standard setup screens such as the option to add their personal Google account. You can either skip this option or continue with this step to complete the setup.
    Screen displaying the option to set up a Google account on the device
  8. The installation is successfully completed as soon as a work profile is created on your device.
    Hexnode home page displaying that work profile on company-owned device enrollment has been successfully completed
  9. After the work profile is created, an additional Hexnode for Work app, with a work badge on the icon, will be generated under the work profile.
    Hexnode for Work app with a badge after work profile on company-owned device enrollment
  10. Now open the Hexnode for Work app without the badge.
  11. The app will prompt its uninstallation. Tap Uninstall to uninstall the app.

There might be some device-specific differences in the enrollment procedure. For example, some devices might ask for additional permissions, which the user must agree to before proceeding.

After enrollment, the device will have a container that separates personal data from company data. You will also have the option to turn off the work profile on the device.

  • Managing 'Android Enterprise' Devices