Android Enterprise

How it works

Google launched the program in 2015 as Android for Work and renamed it Android Enterprise in 2018. The idea hasn't changed: instead of each manufacturer shipping its own management hooks, Android itself exposes a standard set of APIs that any MDM can call. An enrolled device runs a device policy controller app that receives policies from the MDM and enforces them locally, even offline.

Four management modes cover the usual ownership situations. The work profile isolates a company container on a personal phone. Fully managed mode (COBO) hands the whole device to the MDM. Dedicated mode, formerly COSU, locks a device to one or a few apps for kiosks and scanners. And since Android 11, the work profile on a company-owned device covers COPE: more control than plain BYOD, but a private space the admin can't read.

Enrollment depends on the mode. A personal phone joins through a Google account or a link sent by the admin. A company device gets provisioned from the setup wizard: QR code, the afw# identifier typed into the Google sign-in field, or zero-touch when the device was bought from a zero-touch reseller. Apps come from Managed Google Play, the store the company curates.

Why it matters for a fleet

Before Android Enterprise, managing Android meant the legacy device admin APIs, deprecated in Android 10 and inconsistent across brands. You'd write a policy for Samsung and watch it fail on a Zebra scanner.

The program fixes that. A password policy, an app allowlist or a Wi-Fi configuration works the same on a Pixel, a Galaxy or a rugged Honeywell terminal, as long as the device passes Google's certification. Manufacturer extras (Knox settings, scanner triggers) come through OEMConfig rather than through a separate agent. For an IT team, that means one policy set instead of five, and a device that's either provably managed or provably not.

It also matters for audits. Fully managed devices can be wiped remotely, work profiles removed without touching photos, and Factory Reset Protection keeps a stolen device out of circulation.

How Appaloosa handles it

Appaloosa supports Android Enterprise in its four modes from one console. You enroll devices by QR code, afw# identifier or zero-touch, bind your Managed Google Play organization to publish public and private apps, and push OEMConfig schemas for Samsung, Zebra and Honeywell hardware. Kiosk mode, remote wipe and app configuration belong to the same policy set. The full feature list is on the Android MDM page.