Difference between Work Profile and Work Managed Devices in MDM world

Work Managed vs Work Profile devices

In my previous article, I'd mentioned about the different modes which MDM involves along with the difference between Enterprise Wipe, Device wipe and Enterprise Reset. During Recent change in strategy from Google, company is trying to focus more on the Work Managed mode and will have moved their focus out from Legacy i.e Device Admin mode. The Android 10 i.e Android Q and above version will be predominantly Android Enterprise mode supported.
Let me try to explain, the difference between these two primary modes Work Managed and Work Profile.

What are Work Managed Device :

 They are also referred as Android Work Managed or Device Owner  or Android for Work (AFW) . Device enrolled under this mode, gives entire control of the device to the MDM or to say - your IT Department. There are different method with which your company may enrol the device. The VMware WorkspaceOne UEM (earlier famously known as AirWatch) does have below different method of enrolment available.

• Using AirWatch Relay to perform an NFC bump 
• Using a unique identifier or token code
• Scanning a QR code
• Using Zero Touch enrollment
• Other specific to Rugged devices like Barcode enrollment for Zebra device via StageNow app

Primarily, the device would be owned by company i.e Corporate Owned or Corporate Dedicated.
So these devices and the data will be owned by the company after enrolled in Work Managed mode. Since the device is owned by the company that you work for , once you leave the company, Admin department can wipe the device which would Factory Reset the device. Factory resetting means getting all the data deleted from the device and device again become a fresh out of box as a new device. When it comes to un-enrolment, unenrolling the Work Managed Device Factory Resets it so device can be assigned to another user.

What are Work Profile Devices:

 Device Enrolled in Work Profile

It is also referred as Profile Owner. This method is mainly used on BYOD (Bring Your Own Device) devices where the company allows you to use your own device at work but along with your personal info your companies data can reside in parallel. This method would only work on Android devices which are Lollipop 5.0 and above. In words of Google, a Work Profile separates work apps and data on an Android device from personal apps and data. By default, work profile notifications and icons for apps installed in a work profile are marked with a work badge (briefcase icon) so you can
distinguish them from personal apps. Refer the pic on the right, the Google Chrome has to icons, One with work badge and another at the homescreen without work badge. The work badge is the managed app by your company and company has all the rights to track its usage (ofcourse , if they want to) and personal one i.e without badge stays safe to use for your personal use. Work profiles allow an IT department of your company to securely manage a work environment without restricting users from using their device for personal apps and data.
So, once your device is enrolled in Work Profile , if you leave the organisation, your IT department will un-enroll the device which will wipe i.e. delete the data owned by company without touching any of your personal data. Thus, in case of Work Profile enrolled device, unlike Work Managed,  the Device does not get Factory Reset (for obvious reasons), thus you can continue to use your device and not bothered by companies applied restriction profiles to your phone.

There is a one more category to the list which is called Dedicated Device.
These devices are basically owned by the company and are used for specific purpose. Devices like Kiosk, Ticket Printers device, Entry Exit managing devices. These devices do not need to have a person to operate as they will be standalone and will be in Lock Down mode, where only one app/screen will be shown to the device user. As the usage is within the single app or limited set of apps, the users are restricted to use any other option or change any settings on the device. From Airwatch, they have an application called as AirWatch Launcher which does perform these operations i.e keep the device user bound to one or few specific apps and not letting the customer edit or personalise the settings. 

For now, you try to remember these acronyms and I will add some more details about other mode like COPE in my future post. BYOD stands for Bring Your Own Device; CYOD stands for Choose Your Own Device; COPE stands for Company Owned/Personally Enabled; and COBO stands for Company Owned/Business Only.

You can refer to this page for understanding what is Device Wipe and Enterprise Wipe
Interested in knowing, how to manage Airwatch WorkspaceOne console via Mobile and How to uninstall WorkspaceOne Intelligent Hub