Android Enrollment in Intune Explained: Every Mode, When to Use It

Three Android devices. One is your own phone, with your photos and group chats. One is a phone the company bought for work. And one is a scanner in a warehouse that doesn’t belong to anyone. Intune can manage all three, but it treats each one differently. Microsoft’s enrollment guide checks four things to decide how.

What you need first

1. MDM authority set to Intune.
2. Licenses. Each user needs at least an Intune Plan 1 license. Some Microsoft plans include it and licensing changes, so check the Intune licensing page on Microsoft Learn. Dedicated devices with no user can use a device-only license, but those devices don’t get app protection or Conditional Access.
3. Permissions. The Policy and Profile Manager role covers most enrollment work. Connecting managed Google Play needs Intune Administrator, and the Entra account you link must have a mailbox.
4. Managed Google Play. Before any Android Enterprise device enrolls, connect Intune to managed Google Play, once per tenant. Microsoft recommends signing in with a Microsoft Entra account rather than Gmail. Intune then adds the Intune app, Authenticator, Company Portal and Managed Home Screen for you. If you ever disconnect it, Android Enterprise management stops for the whole tenant.
5. User and device groups ready, so new devices land in the right place.

The map: four questions

Android at work runs on Android Enterprise, Google’s management framework, and Intune builds its main options on top of it.

1. Does the device have Google services? No (many VR headsets) → AOSP.
2. Who owns it? Personal → personally owned work profile. Company → a corporate mode.
3. Does it have a user? No (kiosk, scanner) → dedicated.
4. Company phone with one user: is personal use allowed? Work only → fully managed. Work plus personal → corporate-owned work profile.

Short name	Mode
BYOD	Bring your own device: personally owned work profile
COBO	Corporate-owned, business-only: fully managed
COPE	Corporate-owned, personally enabled: corporate-owned work profile
COSU	Corporate-owned, single-use: dedicated
AOSP	Android Open Source Project: devices without Google services
DA	Device administrator: the old way

Personal phones: the work profile

Android splits the phone in two. Work apps live in their own space with a small briefcase badge; personal apps stay where they are, and Intune doesn’t manage them.

• IT can see: device model, manufacturer, serial number, IMEI, Android version, the last four digits of the phone number, and the apps it manages in the work profile.
• IT can’t see: photos, messages, call and browsing history, contacts, passwords or location.
• When you leave: IT retires the device, which removes only the work profile.

If even that feels like too much, app protection policies without enrollment are a lighter option.

Web enrollment and the big shift

Google’s newer Android Management API already ran Intune’s company devices, and in June 2026 personal work profiles started moving to it too. With it comes web-based enrollment: the user opens a link such as aka.ms/enrollmyandroid (or gets sent there from Teams or Outlook), signs in with their work account in the browser, accepts, and Android creates the work profile. No app to install first, and it’s the default for new tenants.

After that, the Microsoft Intune app is the main app on the device, and Company Portal is still there to browse work apps. The older flow, installing Company Portal first, is being phased out. Turning on web enrollment applies to the whole tenant and can’t be turned off.

Company phones

The company owns the hardware, so IT gets more control. These devices start from a factory reset and are set up out of the box. Both modes need Android 10 or later.

• Fully managed (COBO): work only, one user. IT manages the whole device: which apps can be installed, whether the user can remove them, even whether the phone can be reset. IT can see every app on it, and its location if it’s lost.
• Corporate-owned work profile (COPE): a company phone the user may also use personally. It gets a work profile, so the personal side stays private, but IT still controls some device-wide settings like screen lock, Bluetooth and roaming. Microsoft points to COPE as one way to stop people enrolling their own phones.

Dedicated devices

Devices that don’t belong to a person: a warehouse scanner, a check-in tablet, a menu screen. They have no user, and IT locks them to one app, or a few apps on Managed Home Screen. For devices shared across shifts there’s dedicated with Microsoft Entra shared device mode: a worker signs in at the start of the shift and out at the end, and supported apps follow. Dedicated devices need Android 8 or later and start from a factory reset.

Before a company device enrolls

• Factory reset it, and unenroll it from any other MDM first.
• Create an enrollment profile for the mode and have the device group ready. Once a profile is in use, don’t rename it, because that can stop future enrollments.
• For fully managed and COPE there’s also a staging token: IT or a vendor does the setup ahead of time and the user only signs in to the Intune app.
• A device enrollment manager account can enroll personal work profiles, but not company devices.
• The app depends on the mode: the Intune app runs dedicated, fully managed and COPE devices and browser-enrolled work profiles; Company Portal is for work profiles set up through the app; AOSP devices get the Intune app and Authenticator.

Getting company devices enrolled

Each option starts at the first setup screen and uses a token from the enrollment profile:

• QR code, Microsoft’s recommendation for most cases: tap the welcome screen several times, then scan the code from Intune.
• NFC: touch the device to an NFC tag or to another device holding the enrollment details.
• afw#setup: type it at the Google sign-in screen instead of an email, then scan the code or type the token.
• Zero-touch: devices from an authorized reseller are assigned to you before they ship and enroll themselves on first boot. Samsung’s equivalent is Knox Mobile Enrollment.

From Android 11, COPE phones can’t use NFC or afw#setup; use QR, zero-touch or Knox.

No Google, and the old way

AOSP management is for devices without Google services, like Meta Quest or RealWear headsets. It comes as userless (shared) or user-associated (one person); either way you enroll by QR code, one device at a time, and Microsoft’s apps, including Authenticator, install during setup. Only devices on Microsoft’s supported list can use it.

Device administrator is the old way. Google deprecated it years ago, and since the end of 2024 Intune no longer supports it on devices with Google services. Move remaining DA phones to a work profile with a compliance policy that walks users through it, or to app protection only. Teams-certified Android devices are the exception and stay on DA for now. Block device administrator in your enrollment platform restrictions so nothing falls back to it, and set the per-user device limit while you’re there.

Recap

Your own phone gets a work profile, now set up from the browser. The company phone is fully managed, or COPE if personal use is allowed. The warehouse scanner is a dedicated device. And with no Google at all, there’s AOSP. Intune supports Android 10 and later for devices with a user, and Android 8 and later for userless ones.

Which Android device in your fleet doesn’t fit neatly into any of these boxes? Tell me in the comments.