Android Management API and MDM

Question

I was going through the new Android Management API.

Now, Google has their own app called Android Device Policy which acts as an MDM app but MDM apps don't require a factory reset but why do we have to factory reset the device when enrolling with AFW using Android Management API.

Can't the Android Device Policy be manually installed and set as the device administrator?

Answer 1

The Android Management API currently only supports the Device Owner mode, which has to be set during device setup after factory reset.

The Device Administrator mode, which doesn't require factory reset, is not supported by the Android Management API (at least not for now). You could manually set Android Device Policy as a device administrator but you wouldn't be able to use the API to manage the device.

Device Owner was introduced in Android 5.0, it gives much more capabilities than Device Administrator but requires factory reset as a security measure to prevent someone from taking full control of an existing device and its data.

Answer 2

Currently Android Management API only supports "Fully Managed Mode" & "Dedicated Device". Google has merged the work profile in these in such a way that it doesn't look from UI that is has two modes in it. So, for these two mode works only for Factory reset or First time boot only.

Answer 3

May 2019 update

Now Android Management Api and Android Device Policy (the Android app that acts as DPC) supports both Work Profile and Device Owner modes. There are also more enroll methods, one of the most easy is using QRs.

To manage the devices, create/assign policies, etc. you can interact with the API just with Google API Explorer but it's better to use an EMM console of sort. I'm working on a very simple interface, I think I'll publish it on Github when ready.

I've tested only with a Samsung A5 2017 with Android 8.0.0 and an Android 9.0 device...not an extensive tests suite!