Non-shared Android device enrollment quickstart

Knox Manage has a special method of preparing an Android device, called non-shared. You can consider it as a special enrollment method that’s unique to fully managed devices.

The purpose of non-shared mode is to configure and enroll the device with a staging user, like a shared device, and then seamlessly transfer it to the actual user by transforming it into a fully managed device. Once the transformation takes place, the device can’t be reverted to its non-shared state. Because the majority of the configuration and enrollment activities take place when the device is in the admin’s possession, this new method minimizes disruption of the device user in demanding on-premises environments where they aren’t equipped, capable, or free to enroll the device on their own. It also offers a way to standardize device devices.

During setup, a non-shared device is like a typical shared device intended for a single business purpose, except it’s destined to be operated by only one user. Like shared devices, a non-shared device receives a basic configuration and a staging user for testing and administration, and applies a profile payload when an assigned user account authenticates. You can pre-load content and pre-install apps to the device, so long as you assign them to the group of the user account intended for enrollment.

Supported devices

You can set up devices running Android 9 or higher in non-shared mode.

Supported management features

Non-shared devices are subject to the following limitations in Knox Manage:

• They can be enrolled with the token, QR code, Knox Mobile Enrollment, and Zero-touch enrollment methods.
• They support a subset of the total Android device commands. To see which are compatible, check the Supported system column in the Android Enterprise device command reference.

Set up a non-shared Android device

The process to set up a non-shared device has the following stages:

1. Register a staging user
2. Configure the staging user settings
3. Prepare apps and content for the device
4. Enroll the device
5. Provision the device

1. Register a staging user

A non-shared device must be enrolled and set up with a staging user before it’s deployed. The staging user is an account with a supervisory scope that carries the basic device configuration and settings prior to provisioning the destination user.

To create a staging user:

1. Go to User, then click Add.
2. Fill in the basic and required user account information. For more detailed instructions, see Register a single user account.
3. Set Staging user to Yes.
4. Set Using Type to Non-shared Device.
5. Save and confirm.

2. Configure the staging user settings

Next, configure the device settings for the staging user:

1. Go to Setting > Configuration > Staging Device.

2. Click to add a unique configuration for the staging user.

3. As needed, set Utilities Setting to Allow and select which Android features to enable for the staging user:

   • Powe
   • System Status Ba
   • Notification Ba
   • Key Guard

4. As needed, under Device Setting, select the items that the staging user can access in the Settings app on the device:

   • Wi-Fi
   • Bluetooth
   • NFC
   • Mobile Data
   • Mobile Networks
   • Hotspot
   • Location

5. As needed, turn on Wi-Fi and preconfigure an access point that the device can connect to while in the staging state.

6. Click Select Staging User and select the staging user from the list.

7. Click Save & Apply to finish configuring the staging user settings.

3. Prepare apps and content for the device

Next, pre-install the apps and content for the device. You can take two approaches to accomplish this:

• Add the staging user and destination user accounts to the same group, then assign the apps and content to that group. This approach speeds up enrollment by downloading all the apps and content to the device before it’s deployed.
• Assign the apps and content to individual destination users. This approach offers more flexibility and user-based customization, but results in slower enrollment as the device must download all content and apps once it’s in the user’s possession.

To prepare the apps and content for the non-shared device:

1. (Optional) Add the staging user and destination users to the same user group.
2. Assign the required apps to the group or individual destination users.
3. Assign the required content to the group or individual destination users.

4. Enroll the device

Lastly, after preparing the staging user, apps, and content, you can enroll the device:

1. Enroll the device. For instructions about enrolling a single device with the available methods, see Enroll a single device.

2. After enrollment, go to Device, then search for and find the device. Verify that its value in the Platform & Management Type column is Non-shared Device. Its device name is the name you chose during enrollment, with the staging user name prepended.

   

3. Depending on how many apps and how much content you assigned to the staging user, it takes 5–10 minutes to prepare the staging device. During enrollment, ensure the device is connected to the internet for at least that length of time. After this period, you have two methods to verify that all the apps and content installed to the device:

   • To verify that the apps installed, on the Knox Manage console, go to Device, then click the device’s name. On the Device Detail page, open the Application tab, then the Assigned Application tab. In the app list, if the app installed successfully, its Install Status will be Installed.
   • To verify that the content synced, on the device, open the Knox Manage agent, then go to Setting and tap Exit Non-shared mode. Keep in mind that this interrupts the enrollment flow, and should only be used for testing purposes.

5. Provision the device

After the device is enrolled, it’s ready for deployment and provisioning. The next step is to deploy the device to the destination user.

{{ important}} After the device is provisioned, its name updates to reflect its new management mode. {{ /important}}

Once deployed, the device user must:

1. Power on the device. The Knox Manage agent prompts them to sign in.

   

2. (Optional) Tap Download Configuration, then tap the Wi-Fi configuration you pre-configured for the device. The device connects to the access point.

   

3. Sign in with their Knox Manage account credentials.

4. If they agree to the Privacy Policy, select I agree and tap Next.

Once the device user signs in, the device enters fully managed mode and permanently removes the staging user. You can verify that it provisioned correctly on the Knox Manage console:

• Go to Device, then search for and find the device. Its Platform & Management Type should now be Fully Managed, and Its user and device name should be updated to reflect the provisioned user.

  

See also

• Shared Android device quickstart