12.3 Enrolling Devices in Work Profile Mode

With Android enterprise, ZENworks currently supports deployment of only the work profile on devices, which creates a container for all corporate apps and related data.

The scenario elaborated in this section is meant for users who are enrolling their devices to ZENworks for the first time. For users who have already enrolled their devices in the basic mode (Android App only) and want to enroll in the work profile mode, see Work Profile Enrollment for Existing Users.

IMPORTANT:Work profile enrollment fails if the device is connected over a Virtual Private Network (VPN).

12.3.1 Prerequisites

Before enrolling the devices in the work profile mode, you need to ensure the following:

Mandatory Settings

Create an Android Enterprise Subscription. For more information, see Enrolling the Organization to Android Enterprise
Create and assign a Mobile Enrollment Policy. For more information, see Creating a Mobile Enrollment Policy.
Create and assign an Android Profile Enrollment Policy.
Ensure that the Android version is 5.0 or newer.

Optional Settings

Invite users to enroll their devices.

12.3.2 Creating and Assigning Android Profile Enrollment Policy

While assigning this policy, you need to ensure that it is assigned to the same set of users who are part of the user context associated with the Android Enterprise Subscription. To create an Android Profile Enrollment Policy:

Click Policies in the left hand pane in ZCC.
Click New > Policy.
Select Mobile and click Next.
Select Android and click Next.
Retain the default selection, Android Profile Enrollment Policy, and click Next.
Specify a policy name, a policy folder and a short description of the policy. Click Next.
Review the summary page and click Finish.

To assign this policy to relevant users:

In the Policies panel, select the policy you want to assign.
Click Action > Assign to User.
Follow the prompts to assign the policy.

When you complete the wizard, the assigned users are added to the policy’s Relationships page. You can click the policy to view the assignments.

12.3.3 Inviting Users to Enroll Devices

You can send an invite email to users to have them enroll their devices to ZENworks. Before sending this invite, ensure that an SMTP server is configured in the zone. To do this:

Click Users in the left hand pane in ZCC.
Select a user folder or a specific user. The invite email cannot be sent to a user group.
Click Action > Invite User.

You can preview the email notification in different languages by selecting the appropriate language from the Preview Language drop down. However, the email will be sent in the language set in the Mobile Enrollment Policy, which should be assigned to the selected users. For more information, see Creating a Mobile Enrollment Policy.

The contents of the pre-configured email can be customized to suit your requirements. You can edit the content by navigating to Configuration > Event and Messaging > Email Notifications > Invite Users. For more information, see Managing Email Notifications.

Before clicking the Send button, you can also select the MDM Server to which the users should enroll their devices. This MDM Server will be resolved to the macro variable $HOSTNAME$ present in the pre-configured email. All macro variables will be resolved when the email is sent to the user.

12.3.4 Procedure to Enroll Devices

The user installs the ZENworks Agent App from Google Play Store. Alternatively, the user can follow the procedure mentioned in the invite letter to download the ZENworks Agent app.
After installation, the user clicks Open. A brief description of the ZENworks Agent is displayed. The user clicks Continue.
The user clicks Activate this Device Administrator to enable device management using the app.
The user logs into the app by specifying the following:

Username, Password, Domain, Server URL: Specify the username, password, and registration domain (if Allow Simple Enrollment is disabled for the user) along with the server URL of the ZENworks MDM Server. The user can obtain this information from the invite letter.
If you configured the Mobile Enrollment policy to allow the user to specify the device ownership (corporate or personal), the user is prompted for that information. Tap OK.

Follow the prompts appearing in the remaining screens and the device will automatically set up a work profile and enroll to ZENworks. The following screens are displayed during work profile setup.

NOTE:Ensure that you do not interrupt the work profile setup process.
The ZENworks Agent App Home screen is displayed that shows the device as enrolled and active.
The device information can now be viewed in ZCC. Click Devices > Mobile Devices (or navigate to the folder as configured in the Mobile Enrollment Policy) from the left hand navigation pane in ZCC. Click the appropriate device and view its details in the Summary page. The enrollment mode is displayed as Android App and Work Profile Mode is also enabled.
After your device is enrolled, a Badge icon attached to the ZENworks Agent App icon and other system apps will help differentiate work apps from personal apps.

Using managed configurations, you can remotely configure the corporate email account within the work profile of a device using apps such as Gmail. Therefore, it is recommended that you do not assign a Mobile Email Policy to devices that are to be enrolled in the work profile mode. Also, the ActiveSync account should directly communicate with the configured ActiveSync server rather than using ZENworks as the proxy.

Ensure that you approve the ZENworks Agent app, installed within the work profile, in managed Google Play and assign it to all the users. This ensures that the user is notified of any updates made to the ZENworks Agent app and these updates are applied automatically.

12.3.5 Work Profile Enrollment for Existing Users

For users who have already enrolled to ZENworks using the basic mode of enrollment (Android App only) and now want to be enrolled in the work profile mode, assign the Android Profile Enrollment Policy to these users.

NOTE:If you have already configured an ActiveSync account, then it is recommended that you remove this account. With managed configurations, you can remotely configure the corporate email account within the work profile of a device using apps such as Gmail. The ActiveSync account should directly communicate with the configured ActiveSync server rather than using ZENworks as the proxy.

For users who have already enrolled in the basic mode, it is recommended that you enable the Allow Manual Reconciliation by User setting in the assigned Mobile Enrollment Policy, till all the users are enrolled in the work profile mode. This will allow users to manually reconcile their devices to the existing device objects present in ZCC, if required,

After assigning the Mobile Enrollment Policy, the users receive a notification on their devices to set up a work profile when they open the ZENworks Agent app.

The users clicks Set Up and follows the prompts to set up the work profile. The device will automatically set up the work profile. You can view Work Profile Mode enabled in the device’s information page in ZCC (Devices > Mobile Devices ><Click the device> > Summary).