Hi, I'm Bright from Sophos Support
and today I'll be covering how to enroll your Android devices
into Sophos Mobile using Android Enterprise.
Sophos mobile offers two Android Enterprise management modes.
The first is Android Enterprise Full Device management.
This gives you full control of the device using the settings
and policies that Google grants access to.
This is commonly used for devices that a company purchases to distribute to their users.
The second is Android Enterprise Work Profile management.
This allows you to manage a dedicated workspace on a user's device.
This is commonly used for a bring your own device (BYOB) setup as
you can control the restrictions within the workspace on the phone.
Please note, this does not allow the administrator to control the entire phone.
You must have a Sophos Mobile Standard or Advanced license.
You will also need to enter Enterprise account to be set up within Sophos Mobile.
Under the Google setup section,
you can find steps to do this in the article linked In the video description.
To set up the device, go to your mobile dashboard.
Under the Android policy section,
create a new Android Enterprise device policy.
Name the policy and edit a configuration as needed.
For our full list of the configurations, please see our documentation in the description.
In our example, we'll use what's created by default.
Click save, then head to the task bundle section.
Select Android.
Click Create a task bundle.
Add in an Enroll task.
Select Full Device, then click next.
Select the policy you created and click finish.
Name the task bundle.
Then hit save.
Now that the task bundle has set up, head to the devices page, then click add
add device wizard.
In the first section assign a user to the device.
For our Android Enterprise enrollments, our user must be assigned.
The next page allows us to edit the details
of the device such as the display name within the mobile dashboard.
Next select Enroll device with task bundle.
Then select the task bundle for the device you created.
Finally, you are given the QR code which will be used on your Android device.
Moving over to the device you wish to enroll,
you first need to ensure it's been factory reset and is at the initial setup screen.
Except the user license agreement.
Skip the copy data screen.
On the Choose a network screen, connect to a wireless network.
At the Google account screen enter afw# sophos in the email address field.
This will prompt us to set up the phone under Sophos Mobile management.
Select install.
The SMC app will download.
Select install once again.
This screen advises that Sophos will become the device owner for device management.
This page indicates what can be monitored when a device is managed.
Select accept and continue.
The battery optimization screen informs you that the SMC app will
need to be running the background at all times.
Select stay protected and allow SMC app to run in the background.
In the mobile control app, scan the QR code that was generated earlier.
After a minute or so, the enrollment will complete.
If you see any messages indicating that the device is not compliant,
tap on the banner to see what needs to be changed.
As we use the default configuration, a screen lock must be set.
Select FIX IT to address the problem.
Once the screen lock has been applied, the device will be fully compliant.
Your device is now enrolled into Sophos Mobile as a fully managed Android Enterprise device.
Now let's look at a device for enrollment using the Work Profile management mode.
To set up Work Profile enrollment, return to your mobile dashboard.
Under Android policies, create a new Android Enterprise work profile policy.
After creating that policy, name the policy and edit the configuration.
For our full list of the configurations please see our documentation in the description.
Again in our example we'll use what's created by default.
Click Save and then head onto the task model section and select Android.
Click Create and add an enroll attach to the bundle.
Select Work profile and then click next.
Select the policy you created and click Finish.
Name the task bundle and then hit Save.
Now that the task bundle is set up, head on to the devices page then click Add
Add device wizard>
In this first section, assign a user to the device.
For Android Enterprise enrollment, a user must be assigned to the device.
Select enroll device with task bundle and select a task bundle for the device that was created
and finally, we're giving a QR code that can be scanned with the Android device.
Let's switch over to the device you wish to enroll.
First download and install the Sophos Mobile control app from the Google Play Store .
Open the app and accept any necessary permissions.
Scan the QR code generated earlier.
You'll be prompted that you're enrolling the device into a work profile so select next.
Once Once the initial sync completes, additional permissions may need to be enabled on the device.
This process may take about a minute depending on the network.
You'll be prompted to confirm the device lock code. This is done so that the pin
can be reset from the SMC Portal if it is ever forgotten, or if the device gets locked out.
You can now uninstall the Sophos Mobile control app
from the personal area as it's no longer required.
The work area is shown on the bottom tab of the app drawer.
Lastly, open the SMC app from within the work area to ensure any necessary permissions are granted.
And that covers the steps for enrolling a mobile
device in Android Enterprise Work profile management mode.
I hope you found this video useful.
Let us know if this resolved your issue by giving us a thumbs up on Techvids.
Check out the documentation for this video in the video description.
For further assistance, view and post questions on community.sophos.com
and go to techvids.sophos.com
for more great videos like this one.
Thanks for watching.