Android Enterprise

This page connects a client to Android Enterprise and enrolls its Android devices in Outpost mobile device management. When you finish, the client’s Android phones and tablets enroll as fully managed, dedicated, or work profile devices and receive settings from your profiles.

Before you begin

• The mdm:manage permission to connect Android Enterprise, and mdm:enroll to create enrollment tokens and Knox profiles. See Roles and permissions.
• The Android Enterprise provider must be available for your account. Providers become available as Outpost enables them.
• A Google account for the client’s administrator, used to complete Google’s Android Enterprise signup.

Outpost talks to Google’s Android Management API on your behalf. Google’s service account and notification feed stay with Outpost. Your Outpost never holds them, including a self-hosted one.

Connect the client to Android Enterprise

Each client has one Android Enterprise.

1. Start the Android Enterprise signup for the client in the console. Outpost asks Google for a signup page and opens it.
2. Complete Google’s signup with the client administrator’s Google account.
3. Google returns to Outpost, and Outpost binds the new enterprise to the client.

Removing the binding deletes the enterprise at Google. Devices enrolled in it stop being managed.

Choose an enrollment mode

Mode	Ownership	Use it for
Fully managed	Corporate	A company device that one person uses for work
Dedicated	Corporate	A kiosk, scanner, or shared device locked to the apps you choose
Work profile	Personal (BYOD)	A personal device, where Outpost manages only the separate work profile

A personal device can enroll only with a work profile. See Enrollment methods.

Enroll a device with a token or QR code

1. Create an enrollment token for the client and choose its mode.
2. Enroll the device:
   • Fully managed or dedicated. Factory reset the device, then scan the token’s QR code during setup.
   • Work profile. On the personal device, open the enrollment link and sign in with the work account through the client’s identity provider.
3. Delete the token when you no longer need it, so it cannot enroll more devices.

Use zero-touch enrollment

Zero-touch enrollment lets corporate devices bought from a zero-touch reseller enroll the first time they connect, with no QR code.

1. Ask your reseller to link the devices to the client’s zero-touch customer account.
2. Link the zero-touch customer account to the client in the console.
3. Create a zero-touch configuration and apply it to the devices.

Export a Samsung Knox Mobile Enrollment profile

For Samsung devices enrolled through Knox Mobile Enrollment, Outpost exports a profile that you upload to Samsung’s Knox portal.

1. Export the Knox Mobile Enrollment profile for the client from the console.
2. In the Samsung Knox portal, create or edit a Knox Mobile Enrollment profile with the exported values, and assign it to the devices.

Verify

The device appears as one device record for the client with its enrollment mode and ownership. After a profile change, its delivery timeline shows the new policy version sent, then applied by the device. Any setting the device could not apply is listed with a plain explanation and a suggested fix.

Next steps

• Deploy apps to mobile devices
• Profiles and policies
• What IT can see on enrolled devices