Welcome to Android Enterprise Fully Managed Enrollment.

Android Enterprise fully managed devices are corporate-owned devices. These kinds of devices are used by a single user only and they are used exclusively for work. No personal use. Using Android Enterprise fully managed devices allows you to manage the entire device and to enforce policy controls that aren’t available when using personally-owned or corporate-owned work profiles. For example, using Android Enterprise fully managed devices allows you to lock down app installation to only the Managed Google Play. You can block uninstallation of managed apps, and you can prevent users from factory resetting devices, just to name a few.

An Intune standalone tenant is necessary if you need to manage Android Enterprise fully managed devices, and the devices themselves need to be running Android OS version 8.0 and above. They must also run an Android build that has Google Mobile Services connectivity. These devices need to have GMS available and must be able to connect to it.

To set up Android Enterprise fully managed device management, you need to first set your MDM authority to Microsoft Intune. Once that’s been set, you need to connect the Intune tenant account to your Android Enterprise account. Once you’ve connected your Intune tenant to your Android Enterprise account, you can enable the corporate-owned user devices that you want to manage. And lastly, you can enroll the fully managed devices.

To enable your corporate-owned user devices, just sign into the Microsoft Endpoint Manager admin center and browse to Devices > Android > Android enrollment > Corporate-owned, fully managed user devices. Under the Allow users to enroll corporate-owned user devices option, choose Yes.

Setting the Allow users to enroll corporate-owned user devices option to yes generates an enrollment token and a QR code for your Intune tenant. You can use either or to enroll your devices, depending on the Android OS and version of the device.

For step-by-step instructions for enrolling fully managed devices, visit the URL that you see on your screen: