Android enrollment generates more support tickets than almost anything else in a mobile deployment. Not because the process is technically complicated – it isn’t – but because the app requirements, the order of operations, and what users actually see during enrollment vary by ownership model in ways that aren’t obvious from the documentation.
This article covers what actually happens during Android enrollment for the two most common scenarios: Work Profile enrollment on a personal device, and Fully Managed enrollment on a corporate device. What apps are required, in what order, and what the user sees at each step.
The App Question
The first question almost every user asks is some variation of “do I need to install something?” The answer depends on the ownership model, but the confusion usually comes from the fact that several apps are involved – Microsoft Authenticator, the Microsoft Intune app, Intune Company Portal, and Google’s hidden Android Device Policy – and they serve different purposes that aren’t obvious from their names. The cast changed in June 2026 when Microsoft moved personally owned work profile management to Google’s Android Management API, so a mental model of Android enrollment that is even a year old is now wrong in exactly the ways that generate tickets.
Microsoft Authenticator handles authentication. It’s the app that satisfies MFA requirements, stores work account credentials, and in some configurations handles passwordless sign-in. For most Microsoft 365 users, Authenticator is already installed and configured before Intune is part of the picture. If it isn’t, it needs to be installed and set up with the work account before enrollment begins – not during, not after.
The Microsoft Intune app is now the user-facing management app on personally owned work profile devices. Since June 2026, Intune manages these devices through Google’s Android Management API, and enrollment no longer starts in an app at all – it starts in the browser. During web enrollment the platform installs the working set into the work profile automatically: the Microsoft Intune app for device management and support, Company Portal for app protection duty, and Android Device Policy, Google’s policy agent, installed hidden where users never see it. Company Portal is no longer the enrollment agent for new BYOD enrollments. Authenticator still handles the authentication step, and web enrollment installs it automatically to provide single sign-on.
These apps are not interchangeable and they’re not redundant. Authenticator handles identity. The Intune app handles management. Android Device Policy enforces policy silently. Company Portal handles app protection. The practical upside is that users no longer install any of them by hand – the enrollment flow places each one where it belongs.
Work Profile Enrollment – Personal Device
Work Profile enrollment on a personal Android device is now web based. The user opens Chrome or Edge, signs in to the enrollment page with their work account, and follows the prompts. No app installation is required to begin. Android creates a separate, encrypted work profile container alongside the personal profile – this is a platform-level operation – and the required apps install into it automatically: the Microsoft Intune app, Company Portal, Authenticator, and the hidden Android Device Policy agent. Two caveats keep the old flow alive for now. Devices carrying a Company Portal build older than 2604 are routed to the legacy app-based flow, and fleets enrolled before the change keep running the old Company Portal implementation until migrated. That migration is a one-way configuration policy with no rollback, and Microsoft is auto-migrating remaining devices during calendar year 2026, so the legacy flow is ending on someone’s schedule – preferably yours.
What users see during this process still confuses almost everyone. First, several work apps appear that the user never installed – the Intune app, Company Portal, Authenticator – and users frequently think something has gone wrong. All of them are real and all of them belong there. Second, the work profile apps appear in a separate section of the app drawer with a small briefcase badge on each icon. Personal apps and work apps are visually separated. Users who weren’t briefed on this almost always ask why their apps have badges and why some apps appear twice.
Authenticator also needs to be present in the work profile for authentication to function correctly within work apps. Android’s work profile isolation means that an Authenticator installation in the personal profile isn’t accessible to apps running in the work profile. Web enrollment installs Authenticator in the work profile automatically – understanding why prevents confusion when users notice a second Authenticator alongside the one in their personal profile.
Two Authenticator icons, work apps that installed themselves, badged apps – this is all expected behavior during Work Profile enrollment. Users who aren’t briefed on it will call the help desk. Users who are briefed on it won’t.
Fully Managed Enrollment – Corporate Device
Fully Managed enrollment happens during device setup, before the user logs in for the first time. The device needs to be factory reset or new out of the box. There’s no user-initiated enrollment flow for Fully Managed – the provisioning method determines how the device enters management.
QR code provisioning is the most common method in practice. During initial device setup, when Android reaches the “Welcome” screen, the user taps the screen six times in the same spot – this triggers the QR code enrollment flow. The device prompts to scan a QR code that you generate from the Intune portal. The QR code contains the enrollment token and configuration, the device downloads Android Device Policy, Google’s management agent, during setup, and enrollment completes automatically before the user ever creates a local account. The user then signs in with their work account and the device is fully managed from first login.
Zero-touch enrollment – configured through the device manufacturer or reseller – is the cleaner corporate option when available. The device is pre-configured with your enrollment token before it leaves the warehouse. The user powers it on and enrollment happens automatically during setup with no QR code scan required. Zero-touch requires setup through the Zero Touch portal with a participating reseller, which adds lead time but removes user steps entirely.
NFC bump enrollment and token-based enrollment exist as alternatives but are less commonly used in practice. NFC requires a provisioner device running an NFC provisioning app, which adds operational complexity. Token enrollment uses a string entered during setup, which is prone to user error.
What users see on a Fully Managed device is different from Work Profile. There’s no personal profile separation – the entire device is managed. Apps appear normally without work profile badges. Managed Google Play serves as the app catalog, with the Microsoft Intune app present for support and compliance visibility. Users don’t see the dual-profile experience that Work Profile creates, which makes the experience cleaner but also means there’s no separation between work and personal use – because the device is corporate-owned and not designed for personal use.
Intune Deployment Guide · Phase 9: Mobile and BYOD
‹ Previous: [9.3] Android Enterprise Models
Next: [9.3.2] Work Profile vs Fully Managed: Making the Right Call ›
