Using Android devices in your company: What do you need to bear in mind?

Many companies are increasingly concerned with the question of how they can use mobile devices securely and effectively in their businesses. In our step-by-step guide, we explain what you need to bear in mind when using Android devices in your company, how you can set them up properly and how Android devices can be secured.

Android for business with Android Enterprise

Android Enterprise is a platform developed by Google that optimises Android devices specifically for professional use in companies. It provides functions for security, device management and the separation of private and business data. In addition, the platform enables IT departments to manage Android devices centrally and efficiently.
The main advantage of Android Enterprise is that company devices are seamlessly integrated into an MDM (Mobile Device Management) system.
Android Enterprise also provides an overview of devices that are particularly suitable for businesses: Android Enterprise Recommended. This is a quality programme for devices that meet particularly high requirements for security, performance and update provision. These devices guarantee regular security updates, the latest Android versions and tested compatibility with enterprise solutions. For businesses, this means greater planning security and a longer service life for the devices.

Securing Android devices: Simple and effective with MDM

Android devices must meet high security requirements for use in a company. It is not enough to simply switch them on and let the user set them up, as this does not guarantee that all data protection requirements are met. Therefore, an MDM must always be purchased in conjunction with the use of Android devices in the company.
An MDM includes many security features, such as blocking certain apps or device functions, specifying selected Wi-Fi connections and much more that cannot be achieved via the device settings themselves. This makes mobile devices GDPR-compliant and allows them to be used in sensitive areas such as elderly care. Another advantage of MDM is clear inventory management: since each device, whether a smartphone or tablet, can be clearly assigned to a user, there can be no confusion about the whereabouts of individual mobile phones and tablets. IT administrators can also assign different security levels and specifications via groups, depending on the level of data protection a device must use.

Android Enterprise devices can be easily integrated into any MDM — the only requirement is that your company creates an Android account. It is important that this account is not created with a personal email address, but with one that other people can also access in an emergency, e.g. if the employee leaves the company.
Android devices for businesses can be integrated into an MDM in various ways. One of these is Android Zero Touch, which is particularly useful for large numbers of devices. However, the devices must support Zero Touch and be purchased from a licensed dealer. It is not essential to use Android Zero Touch, as you can also integrate the devices into an MDM manually at any time, which also only takes a few minutes.

In summary, connecting Android devices to an MDM works as follows:
1. Purchase Android Enterprise devices
2. Switch them on
3. Set them up either as business only or for work and personal use
4. The device is registered in the MDM and receives all predefined apps and security policies

Setting up Android devices: COBO, COPE and BYOD

Android and Google offer various usage scenarios for different use cases on Android Business devices. Companies can decide how they want to primarily use mobile devices in their organisation. On the one hand, there is the Business Only model (COBO), in which Android mobile devices may only be used for work. Here, IT administrators have the most access and can apply the most comprehensive security policies. Another option is to allow a private profile on the devices, while the main purpose of the device is work (COPE). This is often used by companies that want to offer mobile devices as a benefit to their employees. However, it should be noted that IT administrators do not have access to the private profile — MDM settings are only applied to the work profile. The user can also hide work apps via a setting on the device. A third option is to integrate employees’ existing devices into the MDM (BYOD). To do this, simply download the MDM app to the device. Here, too, the IT administrator only has access to the work profile.

Finding the right usage model

Basically, the type of setup for your Android devices depends on the security standards you want to apply in your company or are required to apply due to legal requirements. The rule of thumb is: the more employees have to deal with sensitive data, the stricter the mobile devices are usually configured. For such cases, MobiVisor MDM offers a BSI-compliant standard policy that already meets the most important security requirements. For companies with particularly strict data protection requirements, the COBO (Company Owned Business Only) model is therefore usually the only option.  Companies that have increased data protection requirements – for example, because they need to access client data during their work – but still want to allow at least some private use of the devices can use the COPE (Company Owned – Privately Enabled) model. In the private profile, employees can download their own apps and also store their own email account, while in the work profile they only have access to work applications. This keeps private and professional matters separate at all times. This model is recommended for small businesses, such as those in the skilled trades or construction. Learn more about it here. 
The BYOD (Bring Your Own Device) model, on the other hand, is more suitable for companies that do not work with sensitive data or where mobile devices are only used sporadically for work. Because employees install the MDM app themselves and can uninstall it at any time, data security is naturally limited.

COBO, COPE and BYOD: Step-by-step setup guide

Depending on which setup model you choose, the process for registering devices in MDM will vary slightly. However, you will always need to create an Android Enterprise account in your MDM interface first. You can find out how to do this here: How to create an Android Enterprise account.

1. COBO: Use for work only

• Switch on the device

• Tap the welcome screen 7 times

• Scan the device owner QR code in MDM

• Follow the instructions until the end

Note: If you set a password policy in MobiVisor, the installed apps will initially remain greyed out until the user sets a password. Detailed instructions can be found here.

2. COPE: For Business and Private

• Switch on the device and connect it to the internet.

• Select the language and follow the steps until you reach the ‘Add Google account’ section.

• Enter afw#mobivisor there.

• Then select: Use for work and personal use.

• Follow the steps again until the user logs into MobiVisor.

Note: You will then see the work area and the private area on the device. The work apps are marked with a small suitcase icon. By default, some system apps are disabled on the work profile. If you want to use them, you must install them separately. Detailed instructions can be found here.

3. BYOD: Using a private device for business purposes

• The user opens the Google Play Store
• The user downloads the MobiVisor client from the Playstore
• The user selects ‘Activate the profile manager’
• A work profile is created

Note: With this type of setup, the user can remove the MDM profile from their device at any time. MDM policies can also only be applied to a limited extent. Detailed instructions can be found here.

Conclusion:

The successful use of Android devices in your company requires a clear strategy that includes device selection, a security concept and centralised management. With Android Enterprise, companies can create the technical foundation for standardised, secure and long-term device use. The use of MDM is crucial for high Android security, as it allows devices to be centrally configured, secured and managed – regardless of whether COBO, COPE or BYOD is used.
To successfully deploy Android devices in your organisation, you must first define your security requirements and the appropriate usage mode. Then select suitable Android Enterprise Recommended devices and begin setting up the MDM. This ensures that your Android devices are secure, GDPR-compliant and efficiently integrated into your everyday business operations right from the start.