Employing Managed Profiles
A managed profile or work profile is an Android with some additional special properties around management and visual aesthetic.
DevicePolicyManager APIs
Android 5.x or newer offers a greatly improved DevicePolicyManager with dozens of new APIs to support both corporate-owned and bring your own device (BYOD) administration use cases. Examples include app restrictions, silent installation of certificates, and cross-profile sharing intent access control. You may use the sample Device Policy Client (DPC) app, , as a starting point. See for additional details.
Purpose
The primary goal of a managed profile is to create a segregated and secure space for managed (for example, corporate) data to reside. The administrator of the profile has full control over scope, ingress, and egress of data as well as its lifetime. These policies offer great powers and therefore fall upon the managed profile instead of the device administrator.
- Creation - Managed profiles can be created by any application in the primary user. The user is notified of managed profile behaviors and policy enforcement before creation.
- Management - Management is performed by applications that programmatically invoke APIs in the class to restrict use. Such applications are referred to as profile owners and are defined at initial profile setup. Policies unique to managed profile involve app restrictions, updatability, and intent behaviors.
- Visual treatment - Applications, notifications, and widgets from the managed profile are always badged and typically made available inline with user interface (UI) elements from the primary user.
Data Segregation
Applications
Applications are scoped with their own segregated data when the same app exists in the primary user and managed profile. Generally, applications cannot communicate directly with one another across the profile-user boundary and act independently of one another.
Accounts
Accounts in the managed profile are distinctly unique from the primary user. There is no way to access credentials across the profile-user boundary. Only apps in their respective context are able to access their respective accounts.
Intents
The administrator controls whether intents are resolved in/out of managed profile or not. Applications from the managed profile are default scoped to stay within the managed profile exception of the Device Policy API.
Settings
Enforcement of settings is generally scoped to the managed profile with a few exceptions. Specifically, lockscreen and encryption settings are still scoped to the device and shared between the primary user and managed profile. Otherwise, a profile owner does not have any device administrator privileges outside the managed profile.
Managed profiles are implemented as a new kind of secondary user, such that:
uid = 100000 * userid + appid
They have separate app data like regular users:
/data/user/
The UserId is calculated for all system requests using Binder.getCallingUid(), and all system state and responses are separated by userId. You may consider instead using Binder.getCallingUserHandle rather than getCallingUid to avoid confusion between uid and userId.
The AccountManagerService maintains a separate list of accounts for each user.
The main differences between a managed profile and a regular secondary user are as follows:
- The managed profile is associated with its parent user and started alongside the primary user at boot time.
- Notifications for managed profiles are enabled by ActivityManagerService allowing the managed profile to share the activity stack with the primary user.
- Some other system services shared are: IME, A11Y services, Wi-Fi, and NFC.
- New Launcher APIs allow launchers to display badged apps and whitelisted widgets from the managed profile alongside apps in the primary profile without switching users.
Device administration
Android device administration includes two new types of device administrators for enterprises:
- Profile owner—Designed for bring your own device (BYOD) environments
- Device Owner—Designed for corp-liable environments
The majority of the new device administrator APIs that have been added for Android 5.0 are available only to profile or device owners. Traditional device administrators remain but are applicable to the simpler consumer-only case (e.g. find my device).
Profile owners
A Device Policy Client (DPC) app typically functions as the profile owner. The DPC app is typically provided by an enterprise mobility management (EMM) partner, such as Google Apps Device Policy.
The profile owner app creates a managed profile on the device by sending the ACTION_PROVISION_MANAGED_PROFILE intent. This profile is distinguished by the appearance of badged instances of apps, as well as personal instances. That badge, or Android device administration icon, identifies which apps are work apps.
The EMM has control only over the managed profile (not personal space) with some exceptions, such as enforcing the lock screen.
Device owners
The device owner can be set only in an unprovisioned device:
- Can be provisioned only at initial device setup
- Enforced disclosure always displayed in quick-settings
Device owners can conduct some tasks profile owners cannot, and here are a few examples:
- Wipe device data
- Disable Wi-Fi/ BT
- Control
setGlobalSetting setLockTaskPackages(the ability to whitelist packages that can pin themselves to the foreground)- Set
DISALLOW_MOUNT_PHYSICAL_MEDIA(FALSEby default. WhenTRUE, physical media, both portable and adoptable, cannot be mounted.)