Welcome back. In this lesson, we are going to take a look at the Android Enterprise personally owned work profile enrollment option.

Android Enterprise is a Google initiative to allow the use of Android devices and apps in the corporate workplace. You can use the Android Enterprise Personally Owned Work Profile Enrollment option in Intune to deploy apps and settings to Android Enterprise personally-owned work profile devices in order to keep work information separate from personal information on those personally-owned devices. 

To set up Android Enterprise personally-owned work profile management, you need to first connect your Intune tenant to your Android Enterprise account. The URL on your screen provides step-by-step instructions for doing so:

Once you’ve connected your Intune tenant and your Android Enterprise account, you need to define your Android Enterprise work profile enrollment settings. When configuring your Android Enterprise work profile enrollment settings, you have two actions available: block and allow.

The Block setting ensures that all Android devices that support Android Enterprise personally-owned work profiles are enrolled as Android device administrator devices. 

The Allow setting is the default setting. It ensures all devices that support Android Enterprise personally-owned work profiles are enrolled as personally-owned work profile devices. If there are Android devices in the environment that do not support personally-owned work profiles, they are enrolled as Android device administrator devices.

When using Intune, you can use Enrollment Restrictions to define how devices that support work profiles should be managed. You can create enrollment restrictions that define what devices can enroll into management with Intune, including the number of devices, operating systems, and even OS versions. You can create different restrictions for different user groups, and you can set the priority order for the different restrictions that you define, so they are applied in the order you wish. 

Once you’ve connected your Intune tenant to your Android Enterprise account, and you’ve configured your Android Enterprise work profile enrollment settings, you can tell your users how to enroll their devices so they can get access to work or school email, apps, and other corporate data. 

It’s important to note that users must be using their primary user accounts to enroll. They cannot enroll using a secondary user account. I should also mention that if you are using a Device Enrollment Manager account to enroll personally-owned work profile devices, there's a limit of 10 devices that can be enrolled per account.