COBO

How it works

A COBO device is enrolled as fully managed. On Android, that's the "fully managed device" mode of Android Enterprise, usually triggered at first boot via zero-touch or a QR code. On iOS and iPadOS, it's a supervised device enrolled through Apple Business Manager. Windows uses Autopilot with a corporate Entra ID join.

Once enrolled, IT controls the whole stack. Only allowlisted apps install. Personal accounts are blocked. Settings the user shouldn't touch (Wi-Fi, VPN, developer options) are locked. On many fleets, the launcher is replaced by a kiosk showing three or four icons.

Factory reset protection makes sure a wiped device comes back under management rather than becoming a free phone.

Why it matters for a fleet

COBO is where security and simplicity meet. A warehouse scanner, a nurse's shared tablet or a point-of-sale terminal has one job. Every extra app is attack surface and helpdesk noise.

It's also the easiest model to defend in an audit. No personal data on the device means no GDPR ambiguity about what IT may wipe or inspect.

The downside is user experience on individually assigned phones. Sales reps handed a locked-down COBO phone will carry a second, personal one. If that's the case, COPE is usually the better fit.

Pick COBO for shared devices, dedicated hardware and anything touching payment or health data. For a sales team that needs one phone for calls, email and the CRM, COPE with a work profile keeps the same security on the work side without the second-phone problem.

How Appaloosa handles it

Appaloosa enrolls COBO devices through Android zero-touch, Apple Business Manager and Windows Autopilot, so a device is managed before anyone touches it. From the MDM console, you apply the security policies, push only the approved apps from the enterprise app store, switch on kiosk mode where needed and wipe the device remotely if it goes missing. Remote support via TeamViewer helps when a field device misbehaves.