15.4 Enrolling Devices in the Work Profile Mode

The scenario elaborated in this section is meant for users who are enrolling their devices to ZENworks for the first time. For users who have already enrolled their devices in the basic mode (Android App only) and want to enroll in the work profile mode, see Work Profile Enrollment for Existing Users.

IMPORTANT:Work profile enrollment fails if the device is connected over a Virtual Private Network (VPN).

Procedure

  1. The user installs the ZENworks Agent App from Google Play Store. Alternatively, the user can follow the procedure mentioned in the invite letter to download the ZENworks Agent app.

  2. After installation, the user clicks Open. A brief description of the ZENworks Agent is displayed. The user clicks Continue.

  3. The user logs into the app by specifying the following:

    Username, Password, Domain, Server URL: Specify the username, password, and registration domain (if Allow Simple Enrollment is disabled for the user) along with the server URL of the ZENworks MDM Server.

    Alternatively, the user can also scan the QR code in the Invite Email to autofill the login credentials. To do this, tap Scan to autofill in the ZENworks Agent app. If the user has enabled the permission to allow ZENworks to access the device camera, then the camera will automatically open and the user needs to point the camera to the QR code appearing in the To enroll an iOS, Blackberry or Windows > mobile devices section of the default Invite Email. After scanning the QR code, the user is redirected to the ZENworks Agent App, in which all the login details are automatically filled and the user has to only specify the login password.

  4. If you have configured the Mobile Enrollment policy to allow the user to specify the device ownership (corporate or personal), the user is prompted for that information. Tap OK.

  5. Follow the prompts appearing in the remaining screens and the device will automatically set up a work profile and enroll to ZENworks. The following screens are displayed during work profile setup.

    NOTE:Ensure that the user does not interrupt the work profile setup process.

  6. The ZENworks Agent App Home screen is displayed that shows the device as enrolled and active.

  7. The device information can now be viewed in ZCC. Click Devices > Mobile Devices (or navigate to the folder as configured in the Mobile Enrollment Policy) from the left hand navigation pane in ZCC. Click the appropriate device and view its details in the Summary page. The enrollment mode is displayed as Android App and Work Profile Mode is also enabled.

  8. After your device is enrolled, a Badge icon attached to the ZENworks Agent App icon and other system apps will help differentiate work apps from personal apps.

Using managed configurations, you can remotely configure the corporate email account within the work profile of a device using apps such as Gmail. Therefore, it is recommended that you do not assign a Mobile Email Policy to devices that are to be enrolled in the work profile mode. Also, the ActiveSync account should directly communicate with the configured ActiveSync server rather than using ZENworks as the proxy.

Ensure that you approve the ZENworks Agent app, installed within the work profile, in managed Google Play and assign it to all the users. This ensures that the user is notified of any updates made to the ZENworks Agent app and these updates are applied automatically.

NOTE:On an Android 8.0+ device that has a device password already enabled, ZENworks will send a notification to confirm the existing device credentials (PIN, pattern or passcode) immediately after enrollment. When the user confirms the device credentials, the Reset Password Enabled status displayed on the Device Information page in ZCC, is activated. This will enable you to send the Unlock Device quick task, if the user forgets the device’s credentials. For more information on this quick task, see Unlocking a Device.

Work Profile Enrollment for Existing Users

For users who have already enrolled to ZENworks using the basic mode of enrollment (Android App only) and now want to be enrolled in the work profile mode, assign the Android Enterprise Enrollment Policy to these users.

NOTE:If you have already configured an ActiveSync account, then it is recommended that you remove this account. With managed configurations, you can remotely configure the corporate email account within the work profile of a device using apps such as Gmail. The ActiveSync account should directly communicate with the configured ActiveSync server rather than using ZENworks as the proxy.

For users who have already enrolled in the basic mode, it is recommended that you enable the Allow Manual Reconciliation by User setting in the assigned Mobile Enrollment Policy, till all the users are enrolled in the work profile mode. This will allow users to manually reconcile their devices to the existing device objects present in ZCC, if required,

After assigning the Android Enterprise Enrollment Policy, the users receive a notification on their devices to set up a work profile when they open the ZENworks Agent app.

The user clicks Set Up and follows the prompts to set up the work profile. The device will automatically set up the work profile. You can view Work Profile Mode enabled in the device’s information page in ZCC (Devices > Mobile Devices ><Click the device> > Summary).