Work profile on company-owned devices

As described in Device management modes, Android 11 replaces the fully managed device with work profile with a new work profile on company-owned devices, to enhance the privacy of personal activities on company devices.

The work profile on a company-owned device is:

• similar to that on a personally owned device, in that the enterprise uses a UEM app to serve as a profile owner, which fully manages work apps in a work profile

• different from a personally owned device, in that if the enterprise deploys the work profile from the setup wizard using the provisioning tools added in Android 10, the device is recognized as company-owned and a wider range of asset management and device security policies is made available to the device policy controller (DPC).

If a work profile is added after the setup wizard using any other method, Android 11 recognizes the device as personally owned. The behavior and features available to work profiles on company-owned devices remains unchanged.

Migrating to Android 11

New enrollments

With Android 11, you can no longer deploy a fully managed device with work profile. The DPC’s request fails with no workaround.

Existing enrollments

Upon upgrade to Android 11, any existing fully managed device with work profile deployments are auto-migrated to the new work profile on company-owned devices, as follows:

• A new device ownership flag will be set to company-owned, granting elevated privileges to the Profile Owner.

• Device-level and personal-use policies previously set by the Device Owner will be silently migrated to the Profile Owner or be unset.

• The Android policies that are migrated and policies that are unset can be found in Google’s EMM migration guidelines.

• The now redundant Device Owner will be disabled, its privileges will be revoked, and any cross-profile communication with the Profile Owner will be severed.

The complete list of Android Enterprise policies that will be:

• Migrated is found in Appendix A of Google’s EMM migration guidelines. Policies will be migrated silently; DPCs will need to query policy state if they want to review the details.

• Unset is found in Appendix B of Google’s EMM migration guidelines. Policies not migrated will be removed (for example, managed configurations applied to apps in the personal profile).

See also:

• Google’s EMM migration guidelines, which requires a partner login.

• Prepare Knox for Android 11, which impacts a wide range of Knox services.

• Knox policies in the personal profile, to see which Knox policies you can apply to the personal space.