Skip to content

Most visited

Recently visited


Developer Guide

Android enterprise provides organizations with a secure, flexible, and unified Android mobility platform—combining devices, applications, and management. Android apps are compatible with Android enterprise by default. However, there are additional features you can use to make your app work best on managed Android devices:


  1. You’ve created an Android app.
  2. You’re ready to modify your app so that it works best with Android in the enterprise.
  3. Minimum version: Android 5.0 Lollipop recommended version: Android 6.0 Marshmallow and later.

Note: Android's enterprise features function natively on most Android 5.0 devices; however, Android 6.0 and later offers additional features, especially with regard to COSU.

Manage Profiles

You can manage a user’s business data and applications through a work profile. A work profile is a managed corporate profile associated with the primary user account on an Android device. A work profile securely isolates work apps and data from personal apps and data. This work profile is in a separate container from the personal profile, which your user controls. These separate profiles allow organizations to manage the business data they care about, but leave everything else on a user’s device under the user’s control. For a deep dive into best practices, see the Set up Managed Profiles guide. For an overview of those best practices, see below.

Key features of a managed profile

Managed profile benefits on Android 5.0+

Considerations for managed profiles

Prevent intents from failing between profiles

It’s difficult to know which intents can cross between profiles, and which ones are blocked. The only way to know for sure is by testing. Before your app starts an activity, you should verify that the request is resolved by calling Intent.resolveActivity().

Note: For detailed testing instructions, see Prevent Failed Intents.

Share files across profiles

Some developers use URIs to mark file paths in Android. However, because there are separate profiles in Android enterprise, we recommend:

Content URIs
  • The content URIs contain the authority, path, and ID for a specific file. You can generate this using FileProvider subclass. Learn more
  • Share and grant permissions to access the content URI using an Intent. Permissions can only be passed across the profile boundary using Intents. If you grant another app access rights to your file using Context.grantUriPermission(), it only is granted for that app in the same profile.
Don't use:
File URI
  • Contains the absolute path of the file on the device’s storage.
  • A file path URI that’s valid on one profile isn’t valid on the other.
  • If you attach a file URI to an intent, a handler is unable to access the file in another profile.

Next steps: Once your app supports managed profiles, test it in a work profile. See Test your App with Android in the enterprise.

Implementing Managed Configurations

Managed configurations are a set of instructions that IT administrators can use to manage their users’ mobile devices in a specific way. These instructions are universal and work across any EMM, allowing administrators to remotely configure applications on their users’ phones.

If you’re developing apps for business or government, you may need to satisfy your industry’s specific set of requirements. Using managed configurations, the IT administrator can remotely specify settings and enforce policies for their users’ Android apps; for example:

Best practices for implementing managed configurations

The Set up Managed Configurations guide is the key source for information on how to build and deploy managed configurations. After you’ve reviewed this documentation, see recommendations below for additional guidance.

When first launching the app

As soon as you launch an application, you can see if managed configurations are already set for this app in onStart() or onResume(). Additionally, you can find out if your application is managed or unmanaged. For example, if getApplicationRestrictions() returns:

Listen for changes to managed configurations

IT administrators can change managed configurations and what policies they want to enforce on their users at any time. Because of this, we recommend you ensure that your app can accept new restrictions for your managed configuration as follows:

COSU Devices

Corporate-owned, single-use devices (COSU) are kiosk devices used for a single purpose, such as digital signage displays, ticket printing kiosks, or checkout registers.

When an Android device is configured as a COSU device, the user sees an application locked to the screen with no Home or Recent Apps buttons to escape the app. COSU can also be configured to show a set of applications, such as a library kiosk with an app for the library catalog and a web browser.

For instructions, see Set up Single-Purpose Devices.

Set up Single Sign-on with Chrome Custom Tabs

Enterprise users often have multiple apps on their device, and they prefer to sign in once to access all of their work applications. Typically, users sign in through a WebView; however, there are a couple reasons why this isn’t ideal:

  1. Users often need to sign in multiple times with the same credentials. The WebView solution often isn’t a true Single Sign-On (SSO) experience.
  2. There can be security risks, including malicious applications inspecting cookies or injecting JavaScript® to access a user’s credentials. Even trusted developers are at risk if they rely on potentially malicious third-party SDKs.

A solution to both problems is to authenticate users using browser Custom Tabs, instead of WebView. This ensures that authentication:


Custom Tabs are supported back to API level 15 (Android 4.0.3). To use Custom Tabs you need a supported browser, such as Chrome. Chrome 45 and later implement this feature as Chrome Custom Tabs.

How do I implement SSO with Custom Tabs?

Google has open sourced an OAuth client library that uses Custom Tabs, contributing it to the OpenID Connect working group of the OpenID Foundation. To set up Custom Tabs for SSO with the AppAuth library, see the documentation and sample code on GitHub, or try the codelab.

Test your App with Android in the enterprise

Once you’ve developed your app, you’ll want to test it in a work profile—both as a profile owner and device owner. See the instructions below.

Use TestDPC to test your Android app

TestDPC is a tool you can use to test your Android app in a variety of enterprise environments. You can configure it as a profile owner or a device owner to launch management APIs on your device, using one of these methods:

For more information on how to configure TestDPC, see the instructions below and the TestDPC User Guide.

REQUIRED: Your test Android device needs to run Android 5.0 or later and be able to natively support Android enterprise.

Provision a profile owner

To test your app in a work profile, you need to first provision a profile owner on the TestDPC app:

  1. Launch the TestDPC app and click Set up profile.
  2. When prompted, click Set up, ensuring the TestDPC’s logo is highlighted on the screen.
  3. If your device isn’t encrypted, you need to encrypt your device. Follow the briefcase notification after reboot to continue provisioning.
    Once you’ve provisioned the profile owner correctly, badged applications appear at the end of your app tray. Install your app on the device and test to see how it runs in the work profile.
  4. Install your app on the device and test to see how it runs in the work profile.

Caution: When running your app with Instant Run in Android Studio, attempting to open your app with a work profile or secondary profile will crash your app. To use your app with the work profile, we recommend you create a new run configuration that includes the --user user_id flag, specifying the work profile user ID. You can find the user ID by executing adb shell pm list users from command line. For more information, see the Instant Run documentation.

Provision a device owner

Testing your app as a device owner requires more steps than testing as a profile owner. You first need to provision the device owner on your test device using the NfcProvisioning sample app. For complete instructions to provision TestDPC in device owner mode using the NfcProvisioning app, see the TestDPC User Guide.

  1. Download the NfcProvisioning app sample files to your development environment.
  2. Unpack the project, open your shell, and cd to the project directory.
  3. Add a file to the directory with the name and the following content:
  4. While in the project directory, enter these commands to build the NfcProvisioning APK:
    ./gradlew init
    ./gradlew build
    The NfcProvisioning APK you need is now located in ./Application/build/outputs/apk.
  5. Install the APK on your programmer device, which you can use to provision other devices.
  6. Create a text file called nfcprovisioning.txt and include the following information:
    # note: checksum must be URL-safe

    Note: If you’re developing for Android 5.0 Lollipop, see the instructions in the TestDPC User Guide.

  7. Push that text file to your programmer device by entering:
    adb push <path-to-nfcprovisioning.txt> /sdcard/
  8. Ensure that the programmer device is connected to Wi-Fi on either an unsecured or WPA2 secured network.

    The NFC Provisioning app will automatically pass those Wi-Fi credentials onto the target device.

  9. Open the NFC Provisioning app and ensure is auto-populated.
  10. Bump the devices to transfer the data.
  11. Follow the onscreen instructions to set up your target device.
  12. Once you’ve completed provisioning the device owner, you can test your app on that device. You should specifically test how managed configurations, URIs, and intents work on that device.

End-to-end testing

After you’ve finished testing your app in the environments above, you’ll likely want to test your app in an end-to-end production environment. This process includes the steps a customer needs to take to deploy your app in their organization, including:

You need to access an EMM console to complete the end-to-end testing. The easiest way to get one is to request a testing console from your EMM. Once you have access, complete these tasks:

  1. Create a test version of your application with a new ApplicationId.
  2. Claim a managed Google domain and bind it to your EMM. If you already have a testing domain that’s bound to an EMM, you may need to unbind it to test it with your preferred EMM. Please consult your EMM for the specific unbinding steps.
  3. Publish your application to the private channel for their managed Google domain.
  4. Use the EMM console and EMM application to:
    1. Set up work devices.
    2. Distribute your application.
    3. Set managed configuration.
    4. Set device policies.

This process will differ based on your EMM. Please consult your EMM’s documentation for further details. Congrats! You’ve completed these steps and verified that your app works well with Android in the enterprise.

Learn about Android DevHub.

This site uses cookies to store your preferences for site-specific language and display options.

Get the latest Android developer news and tips that will help you find success on Google Play.

* Required Fields


Follow Google Developers on WeChat

Browse this site in ?

You requested a page in , but your language preference for this site is .

Would you like to change your language preference and browse this site in ? If you want to change your language preference later, use the language menu at the bottom of each page.

This class requires API level or higher

This doc is hidden because your selected API level for the documentation is . You can change the documentation API level with the selector above the left navigation.

For more information about specifying the API level your app requires, read Supporting Different Platform Versions.

Take a short survey?
Help us improve the Android developer experience. (Dec 2017 Android Platform & Tools Survey)