Forum Discussion
[Community tips] What to consider when choosing an enterprise mobility management solution?
For the Fully Managed use case, which is exclusively what I deal with, I look for the following capabilities beyond the lowest common denominator Android Enterprise functions:
- Direct APK installation, not requiring installation through Managed Google Play. This is core because the version control and installation scheduling offered by Managed Play is not sufficient for line-of-business / mission critical device operations. Version control offered with direct APK installation is still superior to Managed Play and I won't be using Managed Play for mission critical business apps until that is addressed.
- Direct file distribution. This is critical for distribution of configuration files which many mission critical business apps still require. Managed Configurations are "neat" but without better version control of the app installation process its effectively a no go.
- "Offline" Managed Config support. The ability for the EMM to read the app config schema and provide configurations of the mobile app without having to go through Managed Play.
- Native Remote Control. Absolutely critical in supporting line-of-business device environments. Remote Control is leveraged not only for remotely observing issues on devices but also for making manual configuration changes in test scenarios, extracting configuration files for inspection or mass deployment, remotely enabling logging on devices, and remotely retrieving logs.
- Advanced Scripting. Sending isolated actions to individual devices is paramount in troubleshooting scenarios. Also being able to combine scripting actions with payload delivery like apps and files.
- Inheritance centric device folder structure / grouping. I do not like EMMs that are user group centric as my use case is shared fleets of devices that don't logically associate to a user group. Physical location and configuration need centricity applied via an inheritance driven folder structure is preferred.
- Support for Zebra MX. And I'm not talking about OEMConfig...
- Custom DPC. You basically can't do any of the above without one.
- Advanced lockdown mode customization and configurability
So effectively any AMAPI aligned Android Enterprise only EMMs without a custom DPC are off the table for me. And yes I understand I am swimming against the current but the Fully Managed use case has otherwise been ignored by Android Enterprise given that it is the most niche of all of the other management use cases. I may sound contrarian in my stance but it is a nightmare trying to optimally manage mission critical devices in an AMAPI aligned EMM that doesn't leverage a Custom DPC or otherwise extend the management capabilities beyond the bare minimum published requirements of Android Enterprise.
Some really interesting points here, specifically around Fully Managed mattdermody - thanks for sharing.
Out of interest would you recommend these points to think about in all Fully Managed use cases ie. for all industries or number of devices?
In advance to what mattdermody wrote and maybe will answer later on your question 🙂 i want to bring one thing up here:
It's always a shame that EMM apps on a fully mangaged device don't get full access (and with that also not being able to grant such access to defined apps and so on) but with each Android version also getting more and more limited as same as apps on a consumer device which is often a pain for managing mobile devices. (again: not talking about BYOD and partially COPE)
Completely agree! Device Owner DPCs should have read/write access to other apps scoped storage. It's a fully managed device, owned by a company and not a personal individual so we should not have such a consumer protection feature in place. Similarly agents should be able to grant dangerous permissions silently without manual interaction from the end user. I don't understand manual user granting of run time permissions on shared fleets of devices. If you're arguing that the end user should know about the permission before using the app (they shouldn't) then what about the other 20 users that may us the same device that didn't grant the permission? And please don't get any ideas of having run time permissions prompted every time a new user picks up a shared device.
If we are talking about shared fleets of line-of-business, mission critical, dedicated devices, that are corporate owned assets that are used exclusively in business operations and not personally enabled (warehouses, retail stores, gas stations, QSR, factories, etc), then yes.
