Device owner & fully managed
Company-owned phones and tablets that arrive ready to work, stay on approved apps and settings, and can be locked or wiped the moment one goes missing.
At a glance
What it is
Company-owned Android phones and tablets set up as fully managed devices, with custom device-owner apps where standard EMM agents fall short.
How to start
Tell us what you need in your own words. You talk to the developers who would build it and get a written, line-item estimate.
Get a project estimateEvery managed Android device has an app in charge of its management. When that app is the device owner, set during first setup on a new or factory-reset device, the organisation controls the whole device. Android calls this a fully managed device.
That control is what field, delivery, warehouse and ward teams need: work apps install and update without prompts, Wi-Fi and VPN are configured before the device reaches the user, staff cannot switch off the passcode or install unknown apps, and a lost device can be locked, put into lost mode (Android 11 or later) or factory reset from the console.
The device-owner app is usually Google's Android Device Policy, driven through an EMM. Some fleets need their own custom DPC instead, for example devices without Google Play, or controls no EMM exposes. We build both routes and help you choose between them.
Comparison
| Fully managed | Company-owned with work profile | Personally owned with work profile | |
|---|---|---|---|
| Who owns the device | The organisation | The organisation | The employee |
| Personal use | Not intended | Allowed, on a separate personal side | The phone is personal; only work apps are managed |
| What the organisation controls | The whole device: apps, settings, updates and restrictions | The work profile fully, plus some device-wide rules such as passcode and updates | The work profile only |
| What the console does not see | The content of messages, photos and files. Network and security activity logs exist on these devices, but we switch them on only for a stated purpose disclosed to staff | Personal apps, their data and usage | Personal apps, their data, usage and location |
| Wipe | Factory reset of the whole device | Factory reset, or removal of the work profile to release the device for personal use | Removes the work profile only |
| Lost mode with location | Available on Android 11 or later | Available on Android 13 or later | Not available |
| Typical users | Delivery partners, warehouse staff, nurses, technicians | Managers and sales staff given a company phone | Office staff reading work email and chats on their own phone |
What is included
Platform: Company devices
Platform: Android app
Platform: Android app
Platform: Admin dashboard
How it works
The same path works for one replacement phone or a batch of five hundred.
A device owner can only be set during the first setup screens of a new or factory-reset device, never on a phone already in use.
Zero-touch, a QR code or Knox Mobile Enrollment tells the device which management app to install; the afw#setup code does the same for Google's Android Device Policy.
The management app becomes device owner and applies the policy for that role, such as delivery partner or ward nurse.
Work apps, Wi-Fi, VPN and certificates install silently, and the home screen shows only what the role needs.
The device is assigned to a person in the console, who signs in to the work apps and starts using it.
App updates, policy changes and system updates inside the agreed window reach every device automatically.
A lost device is locked or put into lost mode; a returned one is wiped and provisioned again for the next person.
Platforms
Company-owned Android phones, tablets and rugged devices; the device-owner or companion app; and the web console.
Android phones, tablets and rugged handhelds with Google Play services, managed through Android Enterprise: company-owned devices as fully managed, dedicated (kiosk) or work-profile devices, and personal phones through a work profile only.
Apps for Android phones and tablets, tested on budget and mid-range devices and published on Google Play or privately.
Back-office panels for operations, support and finance teams: orders, users, content, reports and permissions.
Browser-based applications with logins, roles and workflows, such as customer portals, SaaS products and internal tools.
Technology
Android's device-owner APIs set what is possible; Kotlin keeps a custom DPC small and reliable; push messaging and a queue deliver commands to devices that are often offline.
Device management
Built-in Android APIs that let one trusted app control a company device: kiosk lock, silent app updates and restrictions, even without Google Play.
Used for
Device management
A Google cloud API for device-management products: your console sets the rules, and a Google app on each Android device applies them.
Used for
Mobile
Apps built specifically for Android, with full access to the phone's hardware, background location and company-managed devices.
Used for
Cloud & DevOps
Ready-made building blocks for mobile apps, such as push notifications, phone OTP login and crash reports, so you launch sooner.
Used for
Backend
A structured way to build back ends on Node.js, so large business systems stay organised, testable and easy to hand over.
Used for
Data
A reliable database for the records your business runs on: orders, payments, bookings and stock, kept accurate and easy to report on.
Used for
Data
Keeps frequently used data in fast memory, so apps stay quick on busy days and live features like order tracking feel instant.
Used for
Web
Builds interactive screens in the browser, such as dashboards, admin panels and portals, that respond instantly as your team works.
Used for
Plain-English glossary
Privacy & security
Personal phones get a work profile instead. We never turn a staff member's own phone into a fully managed device.
Lost mode reports location only while it is switched on. Any other location feature is built only with a visible notice, a stated purpose and a lawful basis under the DPDP Act, 2023.
In custom DPC builds, every command is signed by the server and checked on the device, and every console action is recorded with who did it and why.
Site managers can lock a device; only named IT staff can wipe one, and a wipe asks for a reason and a second confirmation.
Product preview
Sample screens: names, prices and figures are examples, not client data.
Work
Device management & kiosk solutions
An illustrative kiosk product for retail chains: locked Android tablets for catalogues and price checks, a staff launcher, and a console to enrol, update and monitor every device.
Runs on
Built with
Industries
Cost drivers
Configuring your EMM is mostly set-up and testing; a custom DPC is an Android app with its own security design, testing and approval steps.
Every model and version is tested for provisioning, restrictions and updates, and older versions support fewer controls.
Each role, such as delivery partner, supervisor or nurse, needs its own policy, app set and testing.
A staff-facing app for device information, lost-device reports and troubleshooting is a small but separate build.
HRMS joiner-leaver sync, asset registers and ticketing tools each add API work.
Moving devices from legacy device-admin management or another EMM means a reset and re-provisioning plan for each site.
Estimates are written from your scope, with the effort and assumptions behind each line item.
How pricing worksProcess
For each role we list the apps, settings and restrictions needed, and what staff must still be able to do on the device.
You getRole-by-role policy sheet
Your current EMM, a new EMM, or a custom DPC, decided on your device models and requirements.
You getArchitecture note
Policies, companion app, custom DPC if needed, and console integrations, released fortnightly for testing.
You getTest devices ready for sign-off
One hub, ward or team uses the devices for two to four weeks, and we relax restrictions that get in the way of work.
You getPilot findings and final policies
Devices are provisioned in batches, staff get a one-page guide, and your IT team is trained on the console.
You getRunbook and trained admins
Services
The disciplines a project like this draws on.
Native Android apps in Kotlin and Jetpack Compose, designed for entry-level phones, patchy networks and the background limits of popular Android brands.
Back-office dashboards built around your team's daily tasks: order queues, approvals, catalogue management, payouts, reports and audit logs.
Secure, documented REST and GraphQL APIs, plus integrations that connect your apps to payment, logistics, GST, messaging and business systems.
Software shaped around how your business runs, from approvals and inventory to billing and reports, replacing spreadsheets and disconnected tools.
FAQ
No. Android lets an app become device owner only during first setup on a new or factory-reset device. That protects staff: nobody can silently take full control of a phone already in use. For devices already in the field, we plan a reset and re-provisioning per site, with data backed up first. If a reset is not possible, a work profile can be added without one, with less control.
Mainly when devices lack Google Play, such as some POS terminals and industrial devices, when you need controls no EMM exposes, or when your own product must ship its management agent. A custom DPC is more work to build and maintain, and on devices with Google Play it must be verified by Android Enterprise before it can be used during enterprise set-up. For most company fleets, a licensed EMM is simpler.
Yes. Device admin is Android's older management model, and Google has deprecated it for enterprise use. Several of its policies, such as camera, password-expiry, password-quality and lock-screen feature controls, were deprecated in Android 9 and no longer work for device admin apps that target Android 10 or later. It cannot give you the control or security of a fully managed device or work profile. Moving means re-enrolling devices under Android Enterprise, which for company devices involves a factory reset.
Only in narrow, disclosed cases. Lost mode on company-owned devices reports location while a device is marked lost. Location for field work, such as delivery tracking, belongs in the work app itself, with a visible notice, a clear purpose and a lawful basis under India's DPDP Act, 2023, and usually only during working hours. We do not build hidden tracking.
With HRMS sync, the leaver's devices are flagged in the console on their last day. The device can be locked straight away, then collected, wiped and provisioned for the next person; with zero-touch it re-enrols by itself after the reset. A company-owned device with a work profile can instead be released for personal use by removing the work profile.
On a fully managed device, only if the policy allows the relevant apps, and many organisations allow the dialler and one messaging app. If personal use matters, a company-owned device with a work profile is a better fit: staff get a private personal side, while work apps and data stay managed and separate.
Related
Next step
Tell us the roles, the device models and how devices are managed today. We will recommend a route and send a line-item estimate.
