Enroll and manage Android hosts

noahtalerman commented 5 months ago

@noahtalerman: Users will expect that end users can enroll their BYOD Android hosts to Fleet via a self-service webpage. This webpage provides them w/ resources to enroll by adding a work profile to their device.
@noahtalerman: Users will expect that end users who are not in a region that supports work profiles (ex. China) can enroll their BYOD Android hosts to Fleet via a self-service webpage. This webpage provides them w/ resources to enroll.
- For this enrollment scenario, we think Intune uses AOSP
@noahtalerman: Users will expect that, for any enrollment method, they can auto-install software (apps) on the BYOD Android hosts. For devices that have a work profile, these apps are only installed in the work profile.
@noahtalerman: Users will expect that, for any enrollment method, end users can install apps via self-service. For devices that have a work profile, these apps are only installed in the work profile.
@noahtalerman: Users will expect that, for any enrollment method, they can enforce OS settings (e.g. PIN, screenlock, etc.) on the Android hosts.

bolaussen commented 3 months ago

Just want to give a +1 on this feature request! Ty!

dherder commented 3 months ago

noahtalerman commented 2 months ago

enrollments should support Work Profile or Profile Owner mode. See https://www.ibm.com/docs/en/maas360?topic=modes-work-profile-profile-owner-po-mode

Thanks @dherder! I'm curious, who did we get this info from? A customer? If so which one?

noahtalerman commented 2 weeks ago

Enroll via work profile
Enroll in regions that don't support work profiles (mainly China). Intune uses AOSP
For both enrollment methods, auto-install and self-service software
For both enrollment methods, enforce OS settings (e.g. PIN, screenlock, etc.)

ambrusps commented 2 weeks ago

@noahtalerman for customer-pingali the requirements for Android also includes:

Managed Play Store for Android devices
Must be possible to limit MDM capabilities for devices that are not owned by them. Any MDM administrator must not be able to send device wipe commands and data collection should be limited where possible on these types of devices

fleetdm / fleet