Manage Android Devices with Workspace ONE UEM

Through the use of the Workspace ONE UEM platform, you have access to a comprehensive range of solutions for effectively enrolling, protecting, adjusting, and overseeing your Android devices. The Workspace ONE UEM console offers a variety of tools and capabilities to effectively handle all stages of both company-issued and personally-owned device.

The guide explains how to integrate Workspace ONE UEM as your Enterprise Mobility Manager (EMM) with Android devices.

Key Terms for Android

Before getting started, familiarize yourself with these key terms associated with Android to better understand how to configure and deploy settings to your users:

• Custom DPC - With Custom DPC, Workspace ONE UEM distributes policies, internal apps, and more to Workspace ONE Intelligent Hub, which acts as the primary management application of the device or Work Profile. Intelligent Hub applies these resources to the device and returns device information to Workspace ONE UEM.
• Android Management API (AMAPI) - Android Management API, or AMAPI, is native to the Android operating system making it easier to manage devices used for Android Enterprise purposes. With AMAPI, Workspace ONE UEM builds the desired state of the device and transmits it to AMAPI, which AMAPI applies to the device.
• Work Profile– Work Profile mode, also known as Profile Owner, creates a dedicated container on your device for only business applications and content. - -Work Profile mode allows organizations to manage the business data and applications but not have access to the user's personal data and apps. The Android apps are denoted with a briefcase icon so they are distinguishable from the personal apps.
• Work Managed– Work Managed mode, also referred to as Device Owner or Fully Managed Mode, locks the whole device. Users will have access to corporate apps and no access to personal apps through the Google Play store. Fully managed mode is available on Android 5.0 and later devices.
• Corporate Owned Personally Enabled – Corporate Owned Personally (COPE) refers to company-owned devices, similar to Work Managed Device, but users receive a Work Profile to access corporate applications while also being able to use the device for personal use. Like BYOD, these devices have a dedicated work profile to separate work data from personal data during UEM enrollment. COPE is available on Android 8.0 or later devices.
• Managed Google Account – Setting up Android Enterprise using a Google Workspace domain (formerly G Suite) requires you to register a Google domain for your organization and follow a verification process to prove that you own the domain. This domain can only be linked to one verified EMM account. To enable Android Enterprise enrollment using Google Workspace, your organization should create a service account with Google, and provide specific API access to apply the configurations to the managed devices.
• Managed Google Play Account - A managed Google Play account is used when your business does not use Google Workspace (formerly G Suite) and allows binding Workspace ONE UEM with Android Enterprise using a personal Gmail account. No Active Directory sync or Google verification is required here.
• Google Service Account –The Google Service Account is a special Google account that is used by applications to access Google APIs recommended for G Suite customers.
• EMM Token – Unique ID that Workspace ONE UEM uses to connect the Workspace ONE UEM console to the Managed Google Account.
• Managed Google Domain – Domain claimed for enabling Android associated with your enterprise.
• Google Domain Setup – Google's process for claiming a managed Google domain.
• AirWatch Relay – The Workspace ONE UEM application admins use to bulk-enroll Android Devices into Workspace ONE UEM.
• NFC Bump – A communication technology that allows devices to exchange information by placing them next to each other - known as a 'bump'. This is done while using the AirWatch Relay app to pass information from the parent device to the child device.
• AOSP/Closed Network – Android Open Source Project or Closed Network refers to Android devices without Google Mobile Services (GMS) and Console environments with no access to Google. No Google account is created with this enrollment mode.
• User-based enrollment - When a device is enrolled, the Google account that is created is the same across all devices enrolled by this employee. This enrollment method is ideal for when you assign employees to devices with no staging involved.
• Device-based enrollment - The generated Google account is unique to each device enrolled by the same user. This is ideal for staging devices or dedicated devices.
• Cap and Grow - Cap and Grow allows you to continue using your current device deployment as you make the transition from Android (Legacy) to Android Enterprise. Any new device rollouts can be enrolled into Android Enterprise and be managed with older devices.

Requirements for Using Android With Workspace ONE UEM

Before deploying Android devices, consider the following pre-requisites, requirements for enrollment, supporting materials, and helpful suggestions from the Workspace ONE UEM team.

Supported Operating Systems

Android 8.X.X

Android 9.X.X

Android 10.X.X

Android 11.X.X

Android 12.X.X

Android 13.X.X

Android 14.X.X

Android 15.X.X

Android 16.X.X

Note: Customers will experience an updated privacy conscious feature set when a COPE enrolled device is upgraded from Android 10 to Android 11. A summary of the key features and functionality of COPE devices can be found in Understanding Android Device Modes.

Note: If your organization requires more time to complete testing, there are two options to delay your devices upgrading to Android 11. See Manage System Updates for Android Devices.

If your devices do not support Google Play EMM Integration, use the AOSP/Closed Network configuration.

For more information on AOSP/Closed Network, see Understanding Android Device Modes.

Network Requirements for Android

End-user devices must be able to reach certain endpoints for access to apps and services. The Network Requirements for Android is a list of known endpoints for current and past versions of enterprise management APIs.

To reach all the endpoints successfully, a direct connection is required. If the devices are connected behind a proxy, the direct communication is not possible and certain functions fail.

Device Services Proxy Requirements

The Workspace ONE UEM Device Services application uses Google's SafetyNet Attestation API to verify the integrity of Android devices and ensure they are not compromised. To do so, it makes outbound API calls to Google servers. In On-Premise environments, organizations may choose to only allow the Device Services application to make outbound connections via a proxy. In these cases, besides configuring the proxy settings at the application level via the Workspace ONE UEM Console, customers must also configure this outbound proxy at the system level for the Windows server that hosts the Device Services application. If the Windows server is unable to make outbound connections to the required Google endpoints, SafetyNet Health Attestation will fail.

Firewall Rules for Consoles

If an EMM console is located on-premise, the destinations below need to be reachable from the network in order to create a Managed Google Play Enterprise and to access the ​Managed Google Play iFrame​.

These requirements reflect current Google Cloud requirements and are subject to change.

UEM Certificate Requirements

Android devices have a preloaded set of trusted certificate authorities. This list varies across devices and is updated over time to include new commercial SSL certificate vendors. As a result, older Android device models may not trust newer SSL certificate vendors.

The SSL certificate in the Workspace ONE UEM Device Services nodes must be trusted by Android devices. In cloud-hosted Workspace ONE UEM environments, widely trusted certificate vendors are used to mitigate the risk of this issue. In on-premises Workspace ONE UEM environments, you will provide the SSL certificate as detailed in Configure Your External DNS Record and Certificates.

If trust cannot be established, Intelligent is unable to communicate with Workspace ONE UEM. As a result:

• Device management functions are limited. In Custom DPC, almost no device management functions can operate without this trust.
• When users attempt to enroll Android device into Workspace ONE UEM, they will see a “Something went wrong with discovery” error.

If needed, you may install the root certificate of the certificate authority on devices before enrolling them into Workspace ONE UEM.

• For employee-owned devices, the certificate must be manually installed by the user.
• For corporate-owned devices, see Additional Flags for Enrollment for steps to include the certificate in a QR code or out-of-box enrollment configuration.

Enrollment Requirements

Each Android device in your organization's deployment must be enrolled before it can communicate with Workspace ONE UEM and access internal content and features. The following information is required prior to enrolling your device.

If an email domain is associated with your environment – If using Auto Discovery:

• Email address – This is your email address associated with your organization. For example, JohnDoe@acme.com.
• Credentials – This username and password allows you to access your Workspace ONE UEM environment. These credentials may be the same as your network directory services or may be uniquely defined in the Workspace ONE UEM console.

If an email domain is not associated with your environment - If not using Auto Discovery:

If a domain is not associated with your environment, you are still prompted to enter your email address. Since auto discovery is not enabled, you are then prompted for the following information:

• Group ID – The Group ID associates your device with your corporate role and is defined in the Workspace ONE UEM console.
• Credentials – This unique user name and password pairing allows you to access your Workspace ONE UEM environment. These credentials may be the same as your network directory services or may be uniquely defined in the Workspace ONE UEM console .

To download the Workspace ONE Intelligent Hub and subsequently enroll an Android device, you need to complete one of the following:

• Navigate to https://www.getwsone.com and follow the prompts.
• Download Workspace ONE Intelligent Hub from the Google Play Store.

Enrollment Restrictions for Android

Enrollment restrictions allows you to provision enrollment such as restricting enrollment to known users, user groups, and number of enrolled devices allowed.

These options are available by navigating to Groups & Settings > All Settings > Devices & Users > General > Enrollment and choosing the Restrictions tab allows you to customize enrollment restriction policies by organization group and user group roles.

You can create enrollment restrictions based on:

• Android manufacturer and model to ensure only approved devices are enrolled into Workspace ONE UEM. When an Android device is enrolled, smart group and enrollment restriction criteria is updated to include the new make and model of the device.

  Note: Some devices are manufactured by other vendors. You can create a policy with the actual manufacturer of the device for policies to come into effect.The following are some ways to identify the device manufacture:

  • Navigate to the About page in device settings.
  • With an adb command: adb shell getprop | grep "manufacturer".

• Blacklist or whitelist devices by UDID, IMEI, and serial number.

  Note: When enrolling Android 10 or later devices into Work Profile mode, the devices are held in a pending status until the UEM console is able to retrieve the IMEI or Serial Number from the the devices to see if they are whitelisted or black listed. Until this is verified, the device will not be fully enrolled nor any work data sent until enrollment is complete.

Custom DPC

With Custom DPC, you can separately manage access to work apps and data on supported Android devices. Custom DPC:

• Communicates with the Workspace ONE UEM to apply profiles, device restrictions, and settings.
• Implements managed configurations and verifies device compliance with the UEM's policies.

To provision public applications to Android devices, Workspace ONE UEM leverages Google’s Play EMM API.

Android Management API (AMAPI)

When you devices are managed under Android Management API or AMAPI, the devices are enrolled through Work Profile management settings. With AMAPI, Workspace ONE UEM transmits the device's desired settings and configuations to AMAPI as the ADP. In a similar manner to Custom DPC, this includes what public apps AMAPI should install on the device. Workspace ONE UEM also transmits which management policies, and/or profiles, — passcode requirements, certificates, app permission settings, data collection — to AMAPI. In turn, AMAPI pushes policies to the Android Device Policy (ADP) client, which applies them to the device.

Workspace ONE Intelligent Hub for Android still handles distribution of certificates and internal apps, and it makes possible unique features like Product Provisioning and Freestyle Orchestrator. Intelligent Hub for Android remains a part of the process because it hosts our unified app catalog, Mobile Threat Defense SDK, integrations with Intelligence for advanced analytics, and more.

How is the AMAPI experience different for admins and end users?

As an admin, you will see two major updates in the Workspace ONE UEM Console:

• When creating Android Profiles, you will now choose whether to create profiles for Custom DPC or AMAPI.
• When enrolling devices, you will choose whether new devices enrolling into Workspace ONE UEM will be managed using Custom DPC or AMAPI. This can be set by mode (Work Profile, COPE, or Fully Managed) and by Organization Group.

As a device end user:

• When enrolling your devices, you can now initiate enrollment of your personally owned devices by launching an AMAPI Enrollment URL in addition to initiating enrollment through Intelligent Hub. This Enrollment URL is shared by the UEM administrator and can be distributed through a QR code, text, email, internal site, or other means.
• When you set a policy that requires end-user interaction, AMAPI takes action to make sure the policy requirements are enforced. For example, when you set minimum device passcode requirements through Profiles, AMAPI suspends managed applications until the device passcode meets the policy requirements. AMAPI also guides the end user to set a passcode that is compliant with the policy.

Understanding Android Device Management Types

Workspace ONE UEM offers various methods for managing Android devices that can be used as Personally Owned or Corporate-Owned devices. With so many options available with Workspace ONE UEM, you'll need to understand the differences and choose the best solution for your organization's business needs.

Personally Owned refers to devices that are owned by the end user, which they can use to access company resources. These devices are also referred to as BYOD (Bring Your Own Devices).

Corporate-Owned devices belong to your company and are provided to the employee (end user) for work purposes. If a device is corporate-owned but is also enabled for personal use, that is called Corporate Owned Personal Personally-Enabled (COPE).

You can select the appropriate management type based on the required level of security and privacy for your end users. The available management options include the following:

Note * AMAPI is only supported for Corporate-owned Personally Enabled devices using Android 11 or later.

This chart will also introduce the enrollment methods and profile management with each management type.

Work Profile Mode

**Work Profile for Employee-Owned devices (Also referred to as BYOD) **

Devices managed under Work Profile policies create a secure space, or container, on the device for only work applications and data. This is the ideal deployment for Bring Your Own Device (BYOD) applications. The device owner's personal and corporate data are kept separate at all times. Applications in the Work Profile are differentiated by a red briefcase icon, called badged applications, and are shown in a unified launcher with the user's personal applications. For example, your device shows both a personal icon for Google Chrome and a separate icon for Work Chrome denoted by the badge. From an end-user perspective, it looks like two different applications, but the application is only installed once with business data stored separately from personal data.

The Workspace ONE Intelligent Hub is badged and exists only within the Work Profile data space. There is no control over personal applications and the Workspace ONE Intelligent Hub does not have access to personal information.

There are a handful of system applications that are included with the Work Profile by default, such as Work Chrome, Google Play, Google settings, Contacts, and Camera – which can be hidden using a restrictions profile.

Certain settings show the separation between personal and work configurations. Users will see separate configurations for the following settings:

• Credentials – View corporate certificates for user authentication to managed devices.
• Accounts – View the Managed Google Account tied to the Work Profile.
• Applications – Lists all applications installed on the device.
• Security – Shows device encryption status.

Upon unenrollment or an enterprise wipe, the Work Profile is removed from the device without affecting any of the personal side settings or configurations.

Corporate-Owned, Personally Enabled (COPE)

**Work Profile for Company-Owned Personally Enabled devices **

Corporate devices are issued to end users with corporate resources already installed. Like BYOD devices, users will have a dedicated work container and will have access to configure and use personal applications as well. Admins can configure additional restrictions and privacy settings by applying Work Managed Profile settings to these devices.

Key considerations across all OS versions for COPE mode:

• You can apply policies that apply only in the Work Profile as well as in the entire device.
• Product Provisioning is not supported on COPE enrollments.
• Pin-Based encryption and Workspace ONE UEM Single Sign On by using SDK is not supported for Corporate Owned, Personally Enabled devices. A work passcode can be enforced to ensure that the use of work applications requires the use of a passcode.
• Like Work Profile, only for enrollments; devices in COPE mode provide users with the option to deactivate the Work Profile (for example, if the user is on vacation). When the Work Profile is deactivated, the work applications no longer present notifications and cannot be launched. The status (Enabled or Disabled) of the Work Profile is presented to the admin on the Device Details page. When the Work Profile is deactivated, the latest application and profile information cannot be retrieved from the Work Profile. Administrators can define how many days the Work Profile can stay deactivated.

Note: With Android 11, Google made some updates to the privacy configurations, which can be viewed here

Corporate Owned Personally Enabled (COPE) Mode, Android 10 and lower

COPE mode on Android 10 and lower is only supported with Custom DPC.

With Android 10 and lower, COPE devices are fully controlled by the organization. Organizations have visibility into applications installed in the personal profile, and Workspace ONE Intelligent Hub for Android runs in both the personal and work profile. Organizations are strongly recommended to use COPE mode on Android 11 and higher devices to achieve a better balance between user privacy and control over the device.

Corporate Owned Personally Enabled (COPE) Mode, Android 11 and higher

COPE mode on Android 11 and higher is supported with both Custom DPC and AMAPI.

With Android 11 and higher, Android allows organizations to set policies over the entire device while protecting user privacy by limiting visibility into the personal profile. For example, organizations can set an allowlist of applications that users can install in the personal profile but cannot see which applications are installed in the personal profile.

Some key considerations of COPE mode on Android 11 and higher:

• (Custom DPC) Users cannot use afw#hub to begin enrollment.
• As with product provisioning, internal applications are not supported. Organizations can only push internally-developed applications to the device by publishing them to the managed Google Play Store.
• Applications can only be directly managed within the work profile. In the personal profile, organizations can still set application allowlists and denylists.
• You can choose to Enterprise Wipe devices instead of performing a full Device Wipe. When you do an Enterprise Wipe, the device deletes the Work Profile and returns ownership of the device to the user. The user’s personal data is untouched. You can still use the Device Wipe command to initiate a factory reset of the device.

Fully Managed

**Work Managed for Company Owned Devices **

When devices are enrolled in Work Managed Device mode, a true corporate ownership mode is created. Workspace ONE UEM controls the entire device and there is no separation of work and personal data.

Important things to note for the Work-Managed mode are:

• The home screen does not show badged applications like Work Profile mode.
• Users have access to various pre-loaded applications upon activation of the device. Additional applications can only be approved and added through the Workspace ONE UEM console.
• The Workspace ONE Intelligent Hub is set as the device administrator in the security settings and cannot be disabled.
• Devices that are fully managed are usually issued to a single user or shared among users who work in shifts.
• Unenrolling the device from Work Managed mode prompts device's factory reset.

Fully Managed (Closed Network)-AOSP (Android Open-Source Project)

**Work-Managed Device Without Google Play Services **

If you are using Workspace ONE UEM on Android Open Source Project (AOSP) devices, non- GMS devices, or using closed networks within your organization, you can enroll your Android devices using the Work Managed Device enrollment flow without Google Play Services. You can host apps on your organization's intranet and use OEM specific enrollment methods for deployment.

You will need to specify in the UEM console that you are using AOSP/Closed Network during Android EMM Registration.

Things to consider when using Work-Managed Device Without Google Play Services on AOSP/Closed Network deployments:

• If you have already set up Android at a top Organization Group and want to deploy AOSP/ Closed network at a specific child Organization Group, only the UEM console admin has an option to specify that out-of-box enrollments at the child Organization Group will not have a managed Google account. For more information, see Enrollment Settings in the Android EMM Registration.
• If you are deploying devices using Workspace ONE UEM 1907 and below, there is no UEM console configuration required.
• If you are deploying devices using Workspace ONE UEM 1908 and higher, you must configure the settings in the Android EMM Registration page.
• The supported enrollment methods are:
  • QR Code
  • StageNow for Zebra devices
  • Honeywell Enterprise Provisioner for Honeywell devices
• Enrollment through Workspace ONE Intelligent Hub identifier is not supported on AOSP devices.
• Public Auto Update profile is not supported. This profile is specifically for public apps and will not function on devices on AOSP or closed networks
• Factory Reset Protection profile is not supported.
• Internal apps (hosted in the Workspace ONE UEM console) will deploy silently to the AOSP/ Closed network devices.
• Work Managed devices enrolled without a managed Google account should not be assigned any public apps and should not be considered in public app assignment device counts.
• OS Version & OEM requirements for Work-Managed Device without Google Play Services:
  • AOSP (non-GMS)
    • Zebra and Honeywell - Must be on an OS version that supports StageNow or Honeywell Enterprise Provisioner enrollment.
    • Other OEMs - Not supported unless the OEM develops support for it via a client like StageNow or by allowing users to access QR Code enrollment.
  • Closed Network
    • Zebra and Honeywell - Android 7.0 and higher or must be on an OS version that supports StageNow (also 7.0 or higher) or Honeywell Enterprise Provisioner enrollment.
    • Other OEMs - Android 7.0 or higher since QR Code enrollment is the only supported method.
• When a Work-Managed device is configured without Google Play Services, Workspace ONE Intelligent Hub needs to be configured to use AWCM instead of Firebase Cloud messaging. Without this update, devices will not receive push notifications from the console.

Android GO Support

Android Go (officially “Android Go Edition”) is a lightweight version of the Android operating system created by Google. It’s designed specifically for entry-level smartphones that have limited hardware resources. Workspace ONE UEM supports devices running Android GO in Work-Managed mode only.

For these, all device management capabilities for the Work Managed mode are supported with the exception of the following:

• Workspace ONE Launcher
• Product Provisioning features that require accessing or modifying files or directories on the device
  • Files/Actions - Only Reboot and Run Intent Actions are supported
  • Conditions - All conditions except Launcher are supported
  • Event/Actions - All Actions except Apply Custom Settings are supported