Android Work Managed Device mode gives Workspace ONE UEM control of the entire device. Using a factory reset device helps ensure that devices are not set up for personal use.

There are several ways to enroll Work Managed devices:

  • Using AirWatch Relay to perform an NFC bump
  • Using a unique identifier or token code
  • Scanning a QR code
  • Using Zero Touch enrollment

Your business requirements determine which enrollment methods you want to use. You cannot enroll devices until you have completed Android EMM Registration.

If the Android devices you are using are on a closed network, unable to communicate with Google Play, or are running Android 5.0 or earlier versions, then you can enroll using Work Managed Device enrollment for AOSP/Closed Network support. Public app management through managed Google Play will not be available.

Enrolling with AirWatch Relay

AirWatch Relay is an application that passes information from parent devices to all child devices being enrolled into Workspace ONE UEM with Android.

Note: AirWatch Relay is not supported in Android 10.

This process is done through an NFC bump and provisions child devices to:

  • Copy the parent device Wi-Fi network and region settings including the device date, time, and location.
  • Download the latest production version of Workspace ONE Intelligent Hub for Android.
  • Silently set the Workspace ONE Intelligent Hub as device administrator.
  • Automatically enroll into Workspace ONE UEM.

AirWatch Relay allows you to bulk enroll all child devices before deploying them to end users and eliminates end users from having to enroll their own devices. All child devices must be in factory reset mode and have NFC enabled by default to be enrolled as Work Managed Device for Android.

The NFC bump process depends on the Android OS. Devices running Android 6.0+ perform one bump to connect and enroll child devices in one step. Devices running Android OS versions between v5.0 and v6.0 perform two NFC bumps. The first bump is to connect the child device to Wi-Fi network and region settings including the device date, time, and location and download the Workspace ONE Intelligent Hub. The second NFC bump is to enroll all child devices before deploying them to end users.

Enrolling with Workspace ONE Intelligent Hub Identifier

The Workspace ONE Intelligent Hub Identifier enrollment method is a simplified approach to enrolling Work Managed devices for Android 6.0+ devices. Enter a simple identifier, or hash value, on a factory reset device. After the identifier is entered, the enrollment is automated pushing down the Workspace ONE Intelligent Hub. The user only has to enter server details, user name, and password.

With the identifier, you can also enroll on behalf of the end user by doing Single-User Device Staging. This method is useful for administrators who set up multiple devices for an entire team or single members of a team. Such a method saves the end users the time and effort of enrolling their own devices.

For more information on Single-User Device Staging, see Stage a Single-User Device in the Mobile Device Management (MDM) documentation.

Enrolling with QR Code

QR code provisioning is an easy way to enroll a fleet of devices that do not support NFC and the NFC bump. The QR code contains a payload of key-value pairs with all the information that is needed for the device to be enrolled. Create the QR code before starting enrollment. You can use any online QR Code generator, such as Web Toolkit Online, to create your unique QR code. The QR code includes the Server URL and Group ID information. You can also include the user name and password or the user has to enter their credentials.

Here is the format of the text to paste into the generator:

"": false,"": "Your_SSID","": "Password",
{"serverurl": "Server URL",
"gid": "Group ID",

Enrolling with Zero Touch Portal

Zero Touch enrollment allows for Android 9.0+ devices to be configured with Workspace ONE UEM as the enterprise mobility management provider out the box.

When the device is connected to the Internet during the device setup, the Workspace ONE Intelligent Hub is automatically downloaded and enrollment details are automatically passed to enroll the device with no user interaction. You manage zero-touch enrollment for your organization from an online portal in your web browser. We call this the zero-touch enrollment portal

Zero Touch enrollment is supported by a limited number of mobile carriers and OEMs. Customers work with their carrier to ensure that zero touch provisioning is supported. Learn more about supported carriers and devices on the Google website.

For additional information on zero-touch enrollment, see the Android Support Article.

Note: Zero Touch enrollment is only supported on Android 8.0 (Oreo) devices.

Enrolling Devices Using Workspace ONE Access

Workspace ONE Access provides multi-factor authentication, conditional access and single sign-on to SaaS, web and native mobile apps. You can use Workspace ONE Access to authenticate devices instead of Workspace ONE Intelligent Hub. When you have enabled Workspace ONE Access as the authentication method, you can use auto enrollment methods such as NFC, QR code, Zero-Touch, and Samsung Knox Mobile Enrollment.

check-circle-line exclamation-circle-line close-line
Scroll to top icon