MDM development for Android™ devices: consoles, policy engines and device agents

Usually not. Google's permissible-usage policy restricts the Android Management API to commercial EMM developers, device makers and a few similar providers, and it excludes solutions developed and used exclusively for first-party, in-house purposes. Since November 2025, every project also needs Android Enterprise approval before it can enrol devices. A company managing only its own fleet normally licenses an existing EMM and adds custom pieces, or, for specialised needs, uses a custom device-owner app. If your case is borderline, we help you ask Google before any build starts.

Since November 2025, enrolling devices through the Android Management API needs registration with and approval from Android Enterprise, and Google asks for a full business justification. Approved projects start with a quota of up to 500 devices, which is enough for development, testing and a pilot. Managing more devices needs a further application to Android Enterprise, so we prepare that request well before your first large customer is due to go live.

Yes. Android's DevicePolicyManager APIs are public, and a device-owner app can manage a fully managed or dedicated device directly. Two things have changed: Google no longer accepts new custom DPCs into the Google Play EMM API, so a new DPC cannot use managed Google Play and installs apps from your own server instead, and on devices with Google Play a DPC must be verified by Android Enterprise, or Google Play Protect blocks it during enterprise set-up. We build both into the plan.

Yes, through a work profile. On a personally owned phone the MDM manages only the work profile: work apps, their data and a few profile settings. It cannot see personal apps, messages, photos or location, and a wipe removes only the work profile. Company-owned devices can be fully managed, or given a work profile when some personal use is allowed.

Through the Android Management API: lock, passcode reset, reboot (fully managed devices on Android 7.0 or later), clear app data (Android 9 or later), lost mode (company-owned devices: fully managed on Android 11 or later, with a work profile on Android 13 or later), eSIM changes (Android 15 or later) and wipe. A wipe is a factory reset on a company-owned device and removes only the work profile on a personal one. Each command is valid for ten minutes unless the console sets a longer period, and runs if the device connects within it, so the console tracks it as pending and retries when needed.

Your console's data, such as policies, device records and audit logs, lives in your own cloud account, usually in an Indian region. With the Android Management API, Google also processes policy and device status data as part of the service, under its own terms. We document which data sits where, which helps with DPDP Act notices and with the security questionnaires enterprise customers send.

A focused AMAPI console for one type of customer, with sign-up, two or three policy templates, enrolment, inventory and core commands, typically takes ten to fourteen weeks including device testing. Multi-tenant billing, a custom DPC or many integrations extend that. Android Enterprise approval is needed before the API can enrol devices, so we start that application first; its timing can affect when device testing begins and when you reach production.