3 ms·
You don't need a factory reset to enrol in MDM, you can create a managed "work" profile and leave the unmanaged user profile alone.
by caf 5y ago
You don't need a factory reset to enrol in MDM, you can create a managed "work" profile and leave the unmanaged user profile alone.
- GekkePrutser 5y agoThat is correct, you can enroll into BYOD / regular work profile mode without reset. But for COPE mode and COBO mode you must factory reset to enroll.. because they are triggered in the startup Wizard by tapping 5 times on the background and then scanning the QR code (or by entering the token at the Google setup screen). These are fully managed modes. And those modes are the only ones that allow you to push certificates to the system store. Normal BYOD work profile mode doesn't allow you to do that anymore. They only go into the user store where apps are free to ignore them - since Android 7. This mode is only meant for user owned phones and thus Google wants to limit what you as an admin can do. And manually you can't add them anymore either. So that's why I mentioned the factory reset there.. It really is needed if you want to add root CAs to the system store. (I managed 60.000 phones, 40k of which Android until a couple months ago :)
- caf 5y agoThat makes perfect sense though, because presumably the system store would affect all profiles. Sure the app can ignore the user CA store, but it can ignore the system one too and just bring its own CA roots. You certainly still get the "Your organisation may monitor network traffic in your work profile" warning on Android 12 when there's a CA added to the work profile.