Complete Guide to Configuring Android Enrollment Profiles in Microsoft Intune

In-Depth Guide to Configuring Android Enrollment Profiles in Microsoft Intune

Android enrollment profiles in Intune let you define how devices join your corporate environment. Each profile controls ownership, management level, user experience, and supported features. Picking the right profile ensures devices get the right balance of security, control, and user privacy.

---

Why Enrollment Profiles Matter

Enrollment profiles determine:

• Ownership model: Corporate-owned vs. personally owned
• Management scope: Full device management, app-level protection, or kiosk restrictions
• User experience: Seamless work-profile separation, guided setup, or single-purpose mode
• Prerequisites: Factory resets, Google Mobile Services, or managed accounts

Well-chosen profiles simplify device onboarding, enforce compliance, and reduce help desk calls.

---

Available Android Enrollment Profiles

1. Android Enterprise Work Profile
   • Use case: BYOD devices
   • Control: Separates work apps/data from personal ones
   • Requirements: Google Mobile Services (GMS) and a Managed Google Play account
2. Android Enterprise Fully Managed
   • Use case: Corporate-owned devices needing full control
   • Control: IT can enforce device settings, install apps, and wipe devices remotely
   • Requirements: Device must be factory-reset before enrollment
3. Android Enterprise Dedicated (COSU)
   • Use case: Kiosks, digital signage, retail point-of-sale
   • Control: Locks device to specific apps and settings; prevents user modifications
   • Requirements: Factory-reset and QR code or zero-touch provisioning
4. Android Enterprise Corporate-Owned Work Profile (COPE)
   • Use case: Corporate devices used for both work and personal tasks
   • Control: Full device management plus work-profile separation for user privacy
   • Requirements: Factory-reset and GMS
5. Android Open Source Project (AOSP)
   • Use case: Non-GMS devices (e.g., some rugged devices)
   • Control: Limited management through Intune Device Administrator APIs
   • Requirements: Enrollment via Device Administrator; fewer features
6. Android Device Administrator (Legacy)
   • Use case: Older devices not supported by Android Enterprise
   • Control: Basic device management; full device Administrator rights
   • Recommendation: Deprecated—avoid new deployments

---

Planning Considerations

• Profile prerequisites: Fully managed and dedicated profiles need a factory-reset device. Work profiles and COPE require GMS and Managed Google Play linkage.
• Privacy vs. control: Choose work profile for BYOD to protect corporate data while preserving personal privacy. Use COPE when you need both corporate control and user freedom.
• Legacy support: Only use Device Administrator for unsupported legacy devices; plan to migrate to Android Enterprise.
• Ownership tagging: Tag devices in Intune as Corporate or Personal to drive scope and compliance policies.

---

Step-by-Step Configuration in Intune

1. Sign in to the Intune Admin Center (https://intune.microsoft.com).
2. Navigate: Devices > Android > Android enrollment.
3. Connect Managed Google Play if not already done: Tenant administration > Connectors and tokens > Managed Google Play.
4. Select Profile Type:
   • Corporate-owned fully managed
   • Corporate-owned dedicated devices
   • Corporate-owned work profile (COPE)
   • Work profile (BYOD)
   • AOSP (Non-GMS)
5. Create Enrollment Profile:
   • Give it a clear name and description.
   • Configure settings: supervision, lock-down mode, user affinity, provisioning method (QR, NFC, ZTP).
   • Assign to Azure AD security groups for targeted rollout.
6. Save the profile and export provisioning instructions (QR code or token).
7. Distribute instructions to IT or end users based on the enrollment method.

---

Testing and Validation

• Enroll a test device for each profile type.
• Verify that the device receives policies, apps, and restrictions as intended.
• Check compliance reports in Intune to ensure policies are applied.
• Adjust profile settings based on feedback before full deployment.

---

Best Practices

• Use Azure AD groups to pilot specific profiles with small user sets.
• Document profile settings and ownership rules for audit and compliance.
• Plan migration away from Device Administrator to Android Enterprise.
• Combine with Conditional Access: Require device compliance for sensitive app access.
• Regularly review enrollment profiles and update them as Android versions and device fleets evolve.

By tailoring enrollment profiles to each Android scenario, you’ll streamline onboarding, enforce security, and improve user experience across corporate and BYOD devices.