The choice between Work Profile and Fully Managed isn’t primarily a technical decision – it’s a device ownership decision that has technical consequences. Getting the ownership question right first makes the technical configuration straightforward. Getting it wrong produces a model that technically works but creates ongoing friction for users, IT, or both.
The core question is simple: who owns the device? If the employee owns it, Work Profile. If the organization owns it, Fully Managed – or one of the corporate ownership variants. That’s the decision. Everything else follows from it.
Work Profile
Work Profile creates a cryptographically isolated container on a personally owned device. The organization manages what’s inside the container – apps, data, configuration. The organization has no visibility into or authority over what’s outside it. This boundary is enforced at the platform level by Android, not by Intune policy. It’s not a soft restriction that clever users can work around – it’s a hardware-backed separation.
What Work Profile gives you: managed apps in a controlled container, data protection policies within those apps, the ability to remotely wipe the work profile without touching personal data, and compliance evaluation for Conditional Access. What it doesn’t give you: device-level security enforcement, control over the personal profile, visibility into personal app usage, or the ability to restrict hardware features like the camera at the device level rather than within managed apps.
Work Profile is appropriate when the device is personal, when privacy expectations are high, when the organization is comfortable with a data-protection model rather than a device-control model, and when the user population would resist or push back against full device management on their personal phone. In practice, this is the right model for the majority of knowledge worker BYOD scenarios.
Work Profile is not a compromise – it’s a deliberate boundary. The organization gets meaningful data protection. The user gets meaningful privacy. That’s the design intent, not a limitation.
Fully Managed
Fully Managed enrolls the entire device under organizational authority. There’s no personal profile, no personal space, no separation. The organization controls the OS, the apps, the hardware restrictions, and the security posture of the device end to end. This is the model for corporate-issued devices where security posture must be enforceable rather than advisory.
What Fully Managed gives you: device-level security policy enforcement, hardware control – camera, Bluetooth, USB, NFC – app allow/block lists, kiosk configuration options, and deep configuration depth that Work Profile doesn’t provide. What it requires: the device to be corporate-owned, provisioned through an Intune-supported method before first user login, and clear communication to users that this is a work device not intended for personal use.
The failure mode for Fully Managed is applying it to devices that users treat as personal – either because the organization issued the device and the user uses it personally anyway, or because the organization chose Fully Managed for personal devices to get “more control.” Neither ends well. Users install personal apps, personal data accumulates on a device the organization can wipe without user consent, and expectations around privacy become a problem that HR eventually has to resolve.
Corporate-Owned Work Profile (COPE)
Corporate-Owned Work Profile – COPE – is the middle ground Android provides for organizations that issue corporate devices but want to allow limited personal use. The organization owns and controls the device at the OS level, but a personal profile is available for the user alongside the managed work profile.
COPE gives IT more device-level control than personal Work Profile – because the device is corporate-owned, Intune can enforce device-level policies that aren’t available on personally owned devices. But it also creates the complexity of managing both a work profile and a personal profile on a single device, and it creates the same expectations problem as Fully Managed if users aren’t clear about what the organization can and can’t see in the personal profile.
COPE is the right model when you issue corporate devices and genuinely want to allow limited personal use. It’s the wrong model when you’re trying to get device-level control on a device the user considers personal.
The Decision in Practice
For most environments the decision tree is straightforward. Personal device, knowledge worker, data protection is the goal: Work Profile. Corporate device, user-assigned, full device control needed: Fully Managed. Corporate device, user-assigned, limited personal use acceptable: COPE. Corporate device, not user-assigned, single purpose: Dedicated.
Where it gets complicated is mixed fleets – some employees on personal devices, some on corporate-issued devices, some on shared devices. Each group needs a different model and potentially different Conditional Access policies. Trying to apply one model to all of them produces either under-enforcement on corporate devices or over-reach on personal ones. Map the device population to the ownership models before you configure anything, and configure each model separately.
Intune Deployment Guide · Phase 9: Mobile and BYOD
‹ Previous: [9.3.1] Android Enrollment in Practice: Authenticator, Company Portal, and What Users Actually See
Next: [9.3.3] Dedicated Devices: Kiosk, Shared, and Single-Purpose Android ›
