Pick a work profile when the phone is personally owned or used for both work and personal life, fully managed when the company owns it and it is for work only, and a dedicated device when it does one job such as a kiosk. The mode decides how much your company can see and control.
The four modes in plain terms
Google's Android Enterprise documentation describes these modes.
- Work profile on a personal device. A separate work space on an employee's own phone. The organisation manages apps, data and settings inside that space and has no access to the personal side.
- Work profile on a company owned device. One device for both work and personal use. The organisation manages the work profile and can also set some device wide rules, such as Wi-Fi settings or blocking USB file transfer. The personal profile stays private.
- Fully managed. A company owned device used only for work. The full range of Android management policy is available, including device level policies a work profile cannot use.
- Dedicated device. A fully managed device set up for one purpose, usually locked to one app or a small set. Think factory floor scanners, signage and kiosks.
How to choose
Start with two questions. Who owns the device? What is it used for?
| Situation | Usual fit |
|---|---|
| Staff use their own phone for email and chat | Work profile on a personal device |
| You buy phones and staff may use them personally | Work profile on a company owned device |
| You buy phones for work only, including on call phones | Fully managed |
| One app, many users, no personal use | Dedicated |
What each mode protects
A work profile keeps company apps and data in a container. Copying from a work app into a personal app can be blocked, and when the person leaves, you remove the profile without touching their photos. Fully managed gives you stronger tools: enforce encryption and screen lock, restrict installs, control updates and wipe the entire device.
The trade is trust and cost. Staff accept a work profile more easily because the personal side is private. Fully managed is simpler to defend but feels invasive on a device someone also uses at home, which is why the company owned work profile mode exists.
Common mistakes
- Using fully managed on personal phones. People refuse, or hide the device.
- Using a work profile and then expecting device wide control. Some policies simply do not apply to a personal phone.
- Leaving kiosks as ordinary devices. A dedicated lock down stops a customer or visitor from leaving the app.
- Forgetting minimum versions. The docs list minimum Android versions per mode, so check them against your oldest phones.
Rollout notes
Pilot with ten people. Write what the profile can see in one page of plain language. Decide what happens at offboarding before you enrol anyone. For a lost phone, a work profile wipe removes only company data, which is often the faster approval for a security team to make.
Safeguard's Android app, available through Google Play or as an APK, runs happily inside a work profile like any other app, but device management itself is a job for your management service.
Quick check
Can my company see my personal apps in a work profile?
Under the work profile model on a personal device, the documentation says the organisation has no access to the personal side. Ask your IT team for their own written policy as well.
Which mode suits an on call phone?
If the company buys it and it is used only for work, fully managed. If people also use it personally, a work profile on a company owned device.
Sources
Last reviewed: 19 October 2026.
