Mobile Device Management (MDM)
Overview
A Mobile Device Management (MDM) solution, also called an Enterprise Mobility Management (EMM) solution, lets administrators enroll, configure, secure, and update a fleet of devices from a central web console. Instead of setting up each device by hand, an administrator defines policies once and the MDM pushes them to every enrolled device.
An MDM is typically used to:
- Enroll devices in Android Enterprise as fully managed (device owner) devices, or in Android Classic (device administrator) mode
- Install, update, and remove applications through managed Google Play or private app stores offered by MDMs such as SOTI MobiControl
- Apply device policies such as passcodes, restrictions, and Wi-Fi networks
- Configure Datalogic-specific settings, including scanner settings, through OEMConfig
- Deploy firmware and Datalogic Espresso package updates
Datalogic devices work with any Android Enterprise or Android Classic compatible MDM, including SOTI MobiControl, Microsoft Intune, SureMDM, Workspace ONE, and many others.
Management use cases
Android Enterprise supports four management use cases. The use case is chosen at enrollment and determines how much of the device the MDM controls. For more information, see Google's Android Enterprise overview.
Most Datalogic customers enroll their devices as dedicated devices. The use case is set in the enrollment profile you create in your MDM, as covered in Enrollment.
| Fully Managed (dedicated devices) | Fully managed (work-only) | Work profile (company-owned) | Work profile (BYOD) | |
|---|---|---|---|---|
| Device ownership | Company | Company | Company | Employee |
| MDM control | Entire device | Entire device | Work profile, plus device-wide policies | Work profile only |
| Personal use | No | No | Yes, in the personal profile | Yes, in the personal profile |
| Assigned user | No, shared or unattended | Yes | Yes | Yes |
| Typical use | Warehouse, retail, kiosk, and signage devices | Work-only devices for one employee. Teams, Outlook, etc. | Company devices also used personally | Employees' personal phones |
Full management for dedicated devices (recommended)
Dedicated devices (formerly called corporate-owned single-use, or COSU) are fully managed devices that serve a specific purpose, such as employee-facing warehouse and industrial devices or customer-facing kiosks and signage. They are not assigned to a specific user and are typically locked to a single app or set of apps. As with any fully managed device, the MDM can apply Android's full range of management policies, including control of the lock screen, status bar, keyboard, and other features to keep users from opening other apps or changing the device.
Full management for work-only company-owned devices
A fully managed device is company-owned and used only for work. The MDM agent is the device owner and can apply Android's full range of management policies, including device-level policies that are not available with a work profile.
Work profile for mixed-use company-owned devices
A work profile can also be used on a company-owned device that the employee is allowed to use personally. The organization fully manages the work profile. Because the device is company-owned, the organization can also apply device-wide policies, such as Wi-Fi settings or blocking USB file transfers, and some restrictions on the personal profile, such as blocking certain apps. The personal profile's apps, data, and usage remain private.
Work profile for employee-owned devices (BYOD)
A work profile is a separate, self-contained space on the device for work apps and data. The employee keeps using their device as normal, with personal apps and data in the personal profile. The organization fully manages the apps, data, and settings in the work profile, but cannot see or access the personal profile.