Work profile on company-owned devices

As described in Device management modes, Android 11 replaces the fully managed device with work profile with a new work profile on company-owned devices, to enhance the privacy of personal activities on company devices.

With a work profile on a company-owned device:

• Enterprises use a UEM app to serve as a profile owner, which fully manages work apps in a work profile.

• If the enterprise deploys the work profile during device setup using the provisioning tools added in Android 10, the device is recognized as company-owned and a wider range of asset management and device security policies is made available to the device policy controller (DPC).

If a work profile is added after the initial setup using any other method, Android 11 recognizes the device as personally-owned. The behavior and features available to work profiles on company-owned devices remains unchanged.

Migrating to Android 11

New enrollments

With Android 11, you can no longer deploy a fully managed device with work profile. The DPC’s request fails with no workaround.

Existing enrollments

Upon upgrade to Android 11, any existing fully managed device with work profile deployments are auto-migrated to the new work profile on company-owned devices, as follows:

• A new device ownership flag is set to company-owned, granting elevated privileges to the Profile Owner.

• Device-level and personal-use policies previously set by the Device Owner are silently migrated to the Profile Owner or be unset.

• The Android policies that are migrated and policies that are unset can be found in Google’s EMM migration guidelines.

• The now redundant Device Owner is disabled, its privileges are revoked, and any cross-profile communication with the Profile Owner is severed.

The complete list of Android Enterprise policies that are:

• Migrated is found in Appendix A of Google’s EMM migration guidelines. Policies are migrated silently; DPCs need to query policy state if they want to review the details.

• Unset is found in Appendix B of Google’s EMM migration guidelines. Policies not migrated are removed (for example, managed configurations applied to apps in the personal profile).

See also:

• Google’s EMM migration guidelines, which requires a partner login.

• Prepare Knox for Android 11, which impacts a wide range of Knox services.

• Knox policies in the personal profile, to see which Knox policies you can apply to the personal space.