---
title: "Android Enterprise"
description: "Connect a client to Android Enterprise and enroll fully managed, dedicated, and work profile Android devices, including zero-touch and Knox. In preview."
url: "https://support.outpostplatform.com/mdm/android/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Android Enterprise in Outpost MDM (preview). Bind one Android Enterprise per client through a Google signup brokered by Outpost; your Outpost never holds Google's service account. Enroll fully managed, dedicated (kiosk), or work profile devices with enrollment tokens or QR codes. Zero-touch enrollment and Samsung Knox Mobile Enrollment profile export."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "mdm:manage"
  preview: true
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/mdm/android.md"
license: "CC BY 4.0"
---

# Android Enterprise

This page connects a client to Android Enterprise and enrolls its Android
devices in Outpost [mobile device management](/mdm/). When you finish, the
client's Android phones and tablets enroll as fully managed, dedicated, or
work profile devices and receive settings from your profiles.

## Before you begin

- The `mdm:manage` permission to connect Android Enterprise, and `mdm:enroll`
  to create enrollment tokens and Knox profiles. See
  [Roles and permissions](/depot/roles-and-permissions/).
- The Android Enterprise provider must be available for your account.
  Providers become available as Outpost enables them.
- A Google account for the client's administrator, used to complete Google's
  Android Enterprise signup.

Outpost talks to Google's Android Management API on your behalf. Google's
service account and notification feed stay with Outpost. Your Outpost never
holds them, including a self-hosted one.

## Connect the client to Android Enterprise

Each client has one Android Enterprise.

1. Start the Android Enterprise signup for the client in the console. Outpost
   asks Google for a signup page and opens it.
2. Complete Google's signup with the client administrator's Google account.
3. Google returns to Outpost, and Outpost binds the new enterprise to the
   client.

Removing the binding deletes the enterprise at Google. Devices enrolled in it
stop being managed.

## Choose an enrollment mode

| Mode | Ownership | Use it for |
| --- | --- | --- |
| Fully managed | Corporate | A company device that one person uses for work |
| Dedicated | Corporate | A kiosk, scanner, or shared device locked to the apps you choose |
| Work profile | Personal (BYOD) | A personal device, where Outpost manages only the separate work profile |

A personal device can enroll only with a work profile. See
[Enrollment methods](/mdm/enrollment/).

## Enroll a device with a token or QR code

1. Create an enrollment token for the client and choose its mode.
2. Enroll the device:
   - **Fully managed or dedicated.** Factory reset the device, then scan the
     token's QR code during setup.
   - **Work profile.** On the personal device, open the enrollment link and
     sign in with the work account through the client's identity provider.
3. Delete the token when you no longer need it, so it cannot enroll more
   devices.

## Use zero-touch enrollment

Zero-touch enrollment lets corporate devices bought from a zero-touch reseller
enroll the first time they connect, with no QR code.

1. Ask your reseller to link the devices to the client's zero-touch customer
   account.
2. Link the zero-touch customer account to the client in the console.
3. Create a zero-touch configuration and apply it to the devices.

## Export a Samsung Knox Mobile Enrollment profile

For Samsung devices enrolled through Knox Mobile Enrollment, Outpost exports
a profile that you upload to Samsung's Knox portal.

1. Export the Knox Mobile Enrollment profile for the client from the console.
2. In the Samsung Knox portal, create or edit a Knox Mobile Enrollment profile
   with the exported values, and assign it to the devices.

## Verify

The device appears as one device record for the client with its enrollment
mode and ownership. After a profile change, its delivery timeline shows the
new policy version sent, then applied by the device. Any setting the device
could not apply is listed with a plain explanation and a suggested fix.

## Next steps

- [Deploy apps to mobile devices](/mdm/apps/)
- [Profiles and policies](/automation/profiles/)
- [What IT can see on enrolled devices](/mdm/privacy/)