When managing mobile devices in an organization, it’s important to understand the different management modes available. These modes determine the level of control IT administrators have and the degree of privacy afforded to the user.
Learn more at How Android Enrollment Works.
1. Full Managed
Full Managed (also known as "Fully Managed Device") refers to a device owned by the organization and fully controlled by IT administrators. This mode is typically used for company-issued devices where personal use is not permitted.
Ownership: Company-owned.
Control: The organization has complete authority over the entire device.
Capabilities: IT can enforce global security policies, install/remove any app, and restrict hardware features (e.g., camera, Bluetooth).
Use Case: Best for employees who require a dedicated business device for high-security tasks.
2. Work Profile
A Work Profile separates work data and apps from personal data on a single device. Within our Android EMM (Enterprise Mobility Management) framework, this is further categorized into two distinct ownership models: COPE and Full BYOD.
COPE (Corporate-Owned, Personally Enabled)
COPE allows an organization to maintain ownership of the hardware while providing employees with a private space for personal use.
Ownership: Company-owned.
Setup: The device is enrolled after a factory wipe using the
PERSONAL_USAGE_ALLOWEDflag.Control: The organization has full management authority over the device but allows a "Work Profile" to coexist with personal applications.
Privacy: Employees have privacy for personal apps, while the organization maintains high security for the work container.
Full BYOD (Bring Your Own Device)
In a Full BYOD model, the employee retains ownership of the device, and the organization only manages a secure container for work-related data.
Ownership: Employee-owned.
Setup: A "Work Profile" is added to an existing device without requiring a factory wipe.
Control: The organization manages only the Work Profile container. IT cannot view personal data, track personal location (unless specified by policy), or factory reset the entire device.
Capabilities: IT can only wipe work-related data; they cannot perform a full device wipe.
3. Technical Considerations & Limitations
Based on current testing and Google Android Management API behavior, please note the following device-control statuses:
Wiping: Successfully verified for COPE devices. For Full BYOD, wiping is limited to the work profile container only.
Remote Locking: Currently, remote locking for COPE devices is non-functional. While the command may report as sent successfully, it does not yet trigger a lock on the physical device.
Command Queueing: Commands such as
rebootare accepted by the management API but may experience delays depending on the device's synchronization state with Google Services.
Summary Table
Mode | Device Ownership | IT Control Level | Personal Use | Typical Use Case |
Full Managed | Company | Full Device | Limited/None | Company-only devices |
Work Profile (COPE) | Company | Full Device + Work Profile | Yes (Private) | Corporate devices with personal use |
Work Profile (BYOD) | Personal | Work Profile Only | Yes | Employee-owned devices |