What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft Intune has no single Android management mode. You choose one of four Android Enterprise options based on three questions: who owns the device, whether one person is assigned to it, and whether personal use is allowed. Answer those three questions first, then confirm the prerequisites for the mode you pick. The rest of this guide explains how to do that, what each mode controls, and what is changing in the personal work-profile flow.
Which Android enrollment mode should you use in Intune?
Use the table to match your device to a mode. Ownership and personal use are the two decisions that matter most; user assignment separates the single-user modes from shared or kiosk devices.
As an Amazon Associate I earn from qualifying purchases.
| Mode | Ownership | User assignment | Personal use | Typical device |
|---|---|---|---|---|
| Personally owned work profile (BYOD) | Personal | Single user | Allowed; the personal side stays under the user’s control | An employee’s own Android phone |
| Corporate-owned work profile (COPE) | Corporate | Single user | Allowed | A company phone that employees may also use personally |
| Fully managed (COBO) | Corporate | Single user | Not allowed; work use only | A company phone issued for work |
| Dedicated (COSU) | Corporate | Userless or shared | Not stated in Microsoft’s Android Enterprise enrollment guide (Microsoft Learn) | Inventory, ticketing, or kiosk devices |
Personally owned work profile (BYOD)
Use this mode when the user owns the device and needs work apps and data on it. The work profile holds work apps and data in a separate area; Intune policies apply to that profile, and the personal side remains under the user’s control. Intune supports app-based enrollment through Company Portal and web-based enrollment. Web enrollment is part of Microsoft’s move to the Android Management API, covered below, so check your tenant’s migration state and authentication configuration before you turn it on.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCorporate-owned work profile (COPE)
Use this mode when the organization owns a single-user device but allows personal use. The work profile separates work material from personal apps and data. Administrators can also manage some device-wide settings, which is the main difference from BYOD (see the privacy section).
#1 Best Overall
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Fully managed (COBO)
Use this mode for a corporate-owned, single-user device that is for work only. Because the whole device is managed, Microsoft describes controls that apply to the entire device, including controls that are not available in work-profile management.
Dedicated (COSU)
Use this mode for organization-owned devices that have no assigned user, are shared, or run as kiosks, such as inventory or ticketing devices. Do not select it for a normal single-user phone, even if the phone is company-owned.
Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
Prerequisites and setup sequence
Complete these steps in order. The first two are prerequisites for every mode.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Confirm device and region support. Check the Android version, Google Mobile Services (GMS) availability, and Android Enterprise support for your exact model and country or region in Intune’s device requirements. Some options depend on GMS. Do not assume a model is supported based on its brand or age; verify it before procurement.
- Connect Intune to Managed Google Play. In the Microsoft Intune admin center, complete the Managed Google Play connection. Microsoft states this connection is required for all of its supported Android Enterprise management options: personally owned work profile, corporate-owned work profile, fully managed, and dedicated.
- Create the enrollment profile and groups. Configure the enrollment profile and the device or user groups that match the mode you chose. Group membership determines which policies and apps reach each device, so set this up before users enroll.
- Choose and communicate an enrollment route. The routes differ by mode, as shown in the table below. Confirm the methods supported for your exact device and mode before you write user instructions.
- Plan any factory reset. For corporate-owned fully managed, dedicated, and corporate-owned work-profile devices, Microsoft’s guide says a factory reset is required before enrollment. Schedule provisioning and tell users that existing data will be erased. The guide does not list this requirement for personally owned devices.
Enrollment routes by mode
| Mode | Documented enrollment routes | Factory reset before enrollment |
|---|---|---|
| Personally owned work profile | Company Portal app-based enrollment, or web-based enrollment, depending on tenant configuration | Not stated in the enrollment guide reviewed |
| Corporate-owned work profile | QR code, token, Google Zero Touch, Samsung Knox Mobile Enrollment, and NFC where supported | Required |
| Fully managed | QR code, token, Google Zero Touch, Samsung Knox Mobile Enrollment, and NFC where supported | Required |
| Dedicated | QR code, token, Google Zero Touch, Samsung Knox Mobile Enrollment, and NFC where supported | Required |
What the work profile means for privacy
A work profile is a separate area on the device for work apps and data. Microsoft states that its policies and settings apply to the work profile, and that apps and data outside the profile remain personal and under the device user’s control. That boundary describes policy scope. It does not mean Intune has no visibility into anything else on the device, so describe the scope precisely to users rather than promising that nothing personal is visible to the organization.
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Microsoft also notes that some user and device information is shared with Google when Android Enterprise management is enabled. Refer users and administrators to Microsoft’s current data disclosure for the specifics, since the list of shared data is a document that can change.
Corporate-owned work-profile devices get more control than BYOD. Microsoft describes additional controls over some whole-device settings, including password requirements, Bluetooth, data roaming, and factory-reset protection. Before you promise a specific control to users or auditors, confirm it in Intune’s current settings catalog for your mode.
Rank #4
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
The personal work-profile transition to Android Management API
Microsoft is moving personally owned work-profile management to Google’s Android Management API. Microsoft describes the API as Google’s recommended interface for Android Enterprise management, and in the API-based flow the Android Device Policy app enforces policies. Microsoft already uses the API for corporate-owned work-profile, fully managed, and dedicated management. Personal work-profile management is the last method still transitioning.
The transition introduces web-based enrollment for personal work profiles. In the migrating flow, the Android Device Policy app replaces Company Portal as the primary user-facing management app.
Best Value
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Before you enable web enrollment
- Test web-based enrollment in a test tenant first.
- Walk through the full user enrollment flow on a test device, from the first prompt to the finished profile.
- Update helpdesk articles and user instructions so they describe the web flow, not Company Portal alone.
- Check the current Intune documentation and your tenant’s state immediately before deployment, because the rollout is changing.
Limits you cannot reverse
- Enabling web enrollment applies tenant-wide to new personal work-profile enrollments. Microsoft states this setting cannot be reversed.
- Devices that already exist need a migration policy to move to the new management method. Microsoft states they cannot roll back after migration.
Legacy: Android device administrator
Microsoft’s platform overview still lists Android device administrator as a supported option, but it says Android Enterprise has superseded this method and that it is not recommended for new enrollments. Mention it in a migration or legacy-management note if your environment still has devices on it. Do not plan new Android deployments around it.
Sources and currency
This guide is based on Microsoft Learn documentation checked on 7 October 2026: the Android enrollment guide, the work-profile overview, the Managed Google Play connection instructions, the Android Management API transition overview, the personally owned work-profile setup guide, and the Android platform deployment guide. Device requirements, tenant settings, authentication support, and regional availability change over time. The evidence is strongest for how Intune implements these modes. It does not certify individual phone models, so confirm device compatibility independently.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
