[PRODUCT UPDATE] Zero-touch enhancement: New admin controls
Hello everyone, We're thrilled to announce significant enhancements to the zero-touch customer portal, designed to provide greater control over customer data. The portal's role-based access control has been updated to include three new user roles, ‘Manager’, ‘Assigner’, ‘Viewer’, for greater control of the data and capabilities each portal user has access to. Read this Help Center guide to learn about these new roles and how to add users to these new roles. Migration Timeline: This is now available. We know many of you are excited to have this new capability, thank you to those of you who provided feedback and input. It would be fantastic to hear your thoughts, are you planning on using these new roles in your organisation or any additional questions, below. Thank so much. *Timeline updated 24 June, 2025[Product Update] Introducing Device Trust from Android Enterprise
In today's world, our smartphones and tablets have become essential tools for getting work done, wherever we are. This "mobile-first" reality means that keeping company data secure on these devices is more critical than ever. Traditional security methods, like just having a firewall around the office network, aren't enough anymore. That's why Android Enterprise supports a Zero Trust security model. Think of it like this: instead of automatically trusting everyone inside the network, Zero Trust assumes nothing and verifies everything before granting access to sensitive information. With 63% of organizations worldwide having partially or fully implemented a Zero Touch strategy, and 96% of organizations favoring this approach, Zero Trust has become the standard for security across organizations. Android is making it easier than ever to bring this Zero Trust framework to your mobile workforce with Device Trust from Android Enterprise.* What exactly is Device Trust from Android Enterprise? Simply put, Device Trust from Android Enterprise helps organizations verify the security status of Android phones and tablets before allowing access to work apps and data. It works across all device ownership models (company-owned or BYOD), and at any level of device management (enrolled to an EMM or completely unmanaged), acting as a constant security validation for all Android devices used for work. How does it work? Device Trust from Android Enterprise uses a comprehensive set of over 20 different trust signals to assess a device's security posture. These signals look at things like: The security patch level The security status of the network the device is connected to Whether the OS version is up to date By bundling all these checks together, Device Trust from Android Enterprise provides a reliable way to understand how trustworthy a device is. This makes it simpler for your IT team to manage mobile security while providing a smooth experience for your employees. Plus, it's designed to protect both user and company privacy. What does this mean? 1. Security you can trust: Protect your data with intelligent and adaptable device security. Device Trust from Android Enterprise works effectively whether company owned and managed by an EMM, employee personal devices are managed by an EMM, using an Android Work Profile, or are unmanaged but utilize a partner security app. Device Trust from Android Enterprise allows businesses to secure the full management spectrum of Android devices used for work. Align with the latest industry standards and best practices around Zero Trust and mobile security, including including ISO/IEC 27001, 27002, 27005, to stay ahead of evolving threats. Ensure ongoing protection with continuous, real-time evaluation and validation of device health at multiple access points. 2. Flexible solutions for diverse use cases: Embrace a security approach that adapts to the diverse ways your employees work. Get direct access to reliable trust signals, empowering you to make informed access decisions and react swiftly to potential risks. Unify and simplify your security management by integrating Android mobile devices into your existing mobile threat defense (MTD), endpoint detection response (EDR), identity provider (IdP), and security information and event management (SIEM) workflows. Leverage our rich ecosystem of security partners, whose solutions integrate seamlessly with Device Trust from Android Enterprise, to create layered protection across different access needs and tailor security to specific use cases. 3. An uninterrupted employee experience: Empower your team to work effectively without unnecessary security hurdles. Enable instant productivity without needing to formally enroll the device - ideal for flexible and casual work arrangements that don’t require full EMM management. Deploy a security solution built with user privacy in mind, utilizing vetted partners and secure data interfaces. Maintain seamless access with continuous, behind-the-scenes security checks that won't disrupt workflows or require constant user interaction. Who can benefit from Device Trust? Built to be flexible, Device Trust from Android Enterprise benefits businesses of all sizes. For Large Enterprises: Strengthen your Zero Trust approach with continuous validation of device security, that accommodates varied access requirements, including full-time staff, contractors, and those in casual work scenarios. By seamlessly integrating with your existing security ecosystem (MTD / EDR, IdP, SIEM), you gain comprehensive visibility and can enforce consistent security policies across your diverse fleet of managed and unmanaged Android devices, enhancing your overall security posture at scale. For Small to Medium Businesses (SMBs): Achieve robust, enterprise-grade security without the typical complexity or extensive IT resources. You don't need a full EMM solution to benefit from Device Trust from Android Enterprise. This allows you to cost-effectively protect sensitive business data on employee devices and enable secure remote work, even on personal devices. In a world where mobile devices are our primary work hubs, Device Trust from Android Enterprise offers a robust and reliable way to unify security tools on mobile, and fortify your defenses. Ready to learn more? For a more detailed overview, explore our Keyword blog. Don't miss our upcoming digital episode, ‘Android Talks Device Trust,’ where we'll take a deep dive into Device Trust from Android Enterprise and our partner solutions. Register here. Let’s keep the conversation going, we’d love to hear your initial thoughts in the comments below. 👇 How does your organization currently approach securing mobile devices, and where do you see Device Trust potentially fitting in?[Product Update]: Android Enterprise Feature Drop
Today’s AI-driven, mobile-first world demands a modern platform to power productivity and collaboration, while keeping security at its core to help mitigate new potential threats. Android is continually evolving to meet new business needs. As organizations increasingly rely on mobile solutions, the demand for robust security, seamless collaboration, and efficient management have never been higher. We’ve already released many powerful updates this year, with more on the way. Here’s a look at the latest advancements designed to power modern employee experiences and strengthen your digital defenses: Resilient security and integrated defense Built-in security businesses can trust. Advanced Protection1: Safeguard teams from targeted cyberattacks with multi-layered defense against online attacks, harmful apps, and data risks. Turn on Google’s most powerful security features with a single tap for continuous protection. APN Overrides via AMAPI: Precisely manage and secure cellular connectivity by defining and enforcing custom network and APN rules on managed devices, ensuring devices only connect to authorized networks. Identity Check2: Employees can now protect access to sensitive data outside of trusted locations by enabling required biometric authentication to access sensitive resources outside of trusted locations to defend against account takeovers. Corporate badges in Google Wallet3: Employees can add their corporate ID badge to their Google Wallet for secure, one-tap access to NFC-enabled work buildings. Modern experiences built for today’s teams Equip your workforce with new productivity and digital wellbeing tools for more efficiency and a better employee experience. Material 3 Expressive: Elevate the employee experience across managed and unmanaged devices and apps with customizable UI, smoother movements and better feedback. Teams will be able to access the new UI later this year. Notification Auto-Grouping: Minimize distractions and digital fatigue. Notification Auto-Grouping tackles digital clutter by consolidating multiple notifications from one app into a single, cohesive display. Desktop Windowing: Discover desktop-like multitasking on Android tablets. Teams can open and resize multiple app windows side-by-side, empowering employees to multitask efficiently and collaborate without constant screen-switching. TaskBar Overflow: Access and organize apps more easily on Android tablets. An expandable panel makes it easy to sort through all open apps, even when the main taskbar is full. Teams can also pin critical apps for instant access, saving time and keeping things organized. Custom Keyboard Shortcuts4: Accelerate workflows and improve efficiency on Android tablets with an attached keyboard. Teams can create personalized shortcuts for frequently used apps to tailor their work experience. Gemini in Google Docs5: Unlock AI-powered productivity as you work from your phone. Gemini is built right into Google Docs, so employees can instantly summarize documents, refine content or create a new draft, without switching apps. PDF in Chrome on Android: Revamp workflows with in-browser viewing of linked PDFs, which now open directly within a new Chrome tab. Scalable control with simplified provisioning and governance Optimize IT operations with streamlined deployment and centralized management across your Android fleet. Efficient device setup6: Streamline device onboarding and boost productivity from day one. An improved setup workflow for managed Android devices enables IT teams to deploy fleets with fewer screens and reduced issues, freeing up resources and giving quicker access to corporate resources to employees. Device EID access for eSIM Management7: Enable eSIM provisioning at scale. Help streamline provisioning and management by pulling EID values from your managed fleet, including BYOD, to enable seamless provisioning of eSIMs on enrolled devices. 5G Slicing via AMAPI8: Solve network congestion with new AMAPI support for 5G slicing. IT teams can route enterprise app traffic through designated network slices, guaranteeing reliable performance for essential workflows on Android devices. Support for Android App Bundle (AAB) files for private apps: Simplify internal app distribution and management. AAB file support for private apps on Google Play helps IT rapidly deploy, update, and manage proprietary tools, streamlining delivery, and optimizing app size. Zero-touch Customer Portal improvements: Customize permissions and gain more transparency across enrolled devices. Detailed Zero-touch audit logs record account activity, for better user support, abuse prevention and compliance. Plus, new capabilities for administrators to define and assign access levels for admin roles are coming soon. Dive into the Community Android is constantly evolving with exciting new features and our community is a great resource for staying informed, discussing what’s next, and sharing best practices to best leverage these updates. In case you missed them, explore some of our recent articles and discussions: Introducing Device Trust from Android Enterprise Zero-touch Enhancement: Audit Logs Android App Bundle Support in Managed Google Play Signup and Device Enrollment: New features and upcoming plans For a deeper dive into the how-to’s, check out our Help Center article. In the meantime, share your thoughts - what features are you most excited about? Do any of these new features solve any existing pain points? Let us know what you’d like to see next in the comments below![Product Update] Dynamic duo: improved dual-SIM support in Android zero-touch
Note: this article has been updated on 03.04.2024 to reflect improvements to the process of provisioning dual-SIM devices via zero-touch. Please see the below steps for best practice. As individual tools, both zero-touch enrollment and dual-SIM devices offer a wealth of business benefits. But until recently, the two IMEI numbers - one for each SIM card - in a dual-SIM device meant integrating dual-SIM with zero-touch was unreliable and dependent on SIM configuration. The good news: we’ve enhanced dual-SIM support in zero-touch, improving the reliability of dual-SIM enrollment, and simplifying management. What does this mean? This improved integration addresses the known issues some users have previously experienced when provisioning dual-SIM devices with zero-touch. It means dual-SIM devices don’t need to be registered as two separate devices to be reliably managed. It also minimises the risk of devices being missed during provisioning and getting stuck in a reset loop, or randomly undergoing factory reset. There is no action required to activate this fix, and you’ll only be visibly impacted if you’ve experienced the issues above. Otherwise, we’d recommend you continue to follow the steps below as best practice. Here's how it works: Lead with the lowest IMEI: For zero-touch to recognise and configure dual-SIM devices, the device initially needs to be registered with the numerically lowest IMEI. For example, if the two IMEI numbers are 000000000000001 and 000000000000002, you would register the first. Zero-touch to go: Upon boot up zero-touch will detect the device and provision it, applying your preconfigured settings and apps. Cue smooth sailing. Tips for a smooth two-step Be aware: If your device is preinstalled with a version of Google Play Services prior to 24.07.12, after setup zero-touch will detect the device, register its serial number, and prompt a factory reset. The next time you set up your device, it will be provisioned through zero-touch. Communicate with your reseller: Make sure they understand the importance of registering with the lowest IMEI for dual-SIM devices. Test, test, test: When integrating dual-SIM devices with zero-touch, begin with a test batch to identify and troubleshoot any hiccups. You may also wish to check this documentation for any known issues. Documentation is key: Clearly document the specific steps for dual-SIM zero-touch deployment so users know what to expect when setting up. For more details including prerequisites, configurations and a getting started guide, check out this zero-touch enrollment for IT admins article. [To add, to find out how to view the second IMEI number in the Zero-touch portal, take a look here.] Now, it's your turn to share your thoughts. Do you currently use a dual-SIM device? If so, how do you use it? Was it provisioned through zero-touch? *Updated 23/4/25 - to add a link to the Help Center article on how to find the second IMEI number[PRODUCT UPDATE] Zero-touch enhancement: Audit logs
Hey everyone, We're pleased to announce a significant enhancement to the zero-touch customer portal, designed to provide greater transparency over your data. Comprehensive audit logs, offering a detailed and accessible record of all actions affecting your customer data will soon be available in the customer portal. Key Improvements: Comprehensive Logging: Captures actions taken from all possible sources eg: zero-touch customer and reseller portal, customer and reseller API. Tracks all data related to a zero-touch customer, including: Users Devices Resellers Configurations Terms of Service CSV Files Zero-touch customer accounts Easy Access and Analysis: Access audit logs through a user-friendly interface within the portal. Download logs in CSV format for further analysis and reporting. Benefits: Accessibility and Analysis: Ensures easy access and analysis of logs. Enhanced Security: Provides a detailed record of all activities impacting customer data, enabling better monitoring. Streamlined Troubleshooting: Quickly identify and resolve data-related issues with detailed activity logs. Increased Transparency: Offers greater visibility into how your customer data is being accessed and managed. Important Note: The audit logs are only available via the zero-touch customer portal. There is no change to the zero-touch reseller portal, Reseller API, and Customer API. Migration Timeline: This feature will be enabled during the next few weeks. Only logs after March 2025 are available in the zero-touch customer portal. If you require older audit logs, please contact your reseller who can raise a support ticket. We hope you find this enhancement useful. To learn more, please refer to this Help Center guide. It would be fantastic to hear your feedback or any questions below. Thanks so much.[Product Update] Android App Bundle support in Managed Google Play
Hey everyone, For those of you using private apps, I’m pleased to let you know that the Managed Google Play iframe now supports Android App Bundle uploads - enabling larger app sizes and the full benefits of app bundles. With this update, you can now create new private apps using app bundles (with Google generated signing key) and can migrate existing apps to the app bundle by enrolling in Play App signing. For full details on how this works please visit this Help Center article with information on migration of an existing APK to an app bundle. You can also find more information about using app bundles in this FAQ. We know many of you have requested this feature before and so we hope you find it useful. It would be great to hear your feedback. Thanks so much, LizzieMWC 2025 : photos and new features
Hey everyone, To many, this is just a regular week at the start of March, but not if you are in Barcelona for MWC 2025 (Mobile World Congress)! MWC is arguably the largest mobile technology events of the year and Team Android has been there meeting so many great people from across the ecosystem. We’ve also announced some cool new features, which I wanted to also highlight to you here in the community. These include Gemini Live video & screen-sharing and AI-powered scam detection for calls and text messages on Android-designed to protect your teams and business from complex fraud and damaging scams. If you are keen to hear more on these or have any questions, please do let us know below. If you weren’t able to make it to MWC this year, I also thought you might like to see a few photos to get you into the spirit of the event… If you have attended this year (I know a few of you mentioned you were going), it would be great to hear more about your experience and what your highlights were. Feel free to also share your photos. Looking forward to hearing from you. Lizzie (To take you back to MWC 2024 - he’s a jasonbayton's community recap)[Product Update] Signup and Device Enrollment: New Features and upcoming plans
Hello everyone, As we kickstart a new year, we are pleased to update you on enhancements we’ve made in the areas of signup and device enrollment and give you an advanced look at some features we’ll be adding in the near future. Background We’ve heard from many customers that they prefer being able to administer Android management capabilities (e.g signing up for Android Enterprise, logging into the Managed Play store, etc.) using their corporate email address rather than a gmail address. This provides increased security, along with better administrative capabilities including self-service fixes for lost account credentials and changing access when team members change. We’ve also heard that for knowledge worker devices, customers prefer being able to log in to their devices with their work email, and being able to have the convenience of shared experiences across their phone and desktop. (More details can be found in this Android Enterprise blog post) To improve the experience for both IT admins and end users, we’ve been working on changes in signup and enrollment that emphasize the use of work email accounts, and minimize Managed Google Play accounts except for dedicated devices that don't have logged in users. Here is an update on our recent announcements as well as our plans for the next few quarters: 1) Improved signup Flow (Launched and rolled out to all EMMs) In Q2 2024, we announced a new signup flow that encourages all new customer IT admins to sign up with their corporate email rather than a gmail account. We also made it possible to bind multiple EMM instances to a customer’s domain to allow for using multiple EMMs simultaneously in testing and in production. As of July 2024, all of our EMM partners have adopted this new flow so new customer signups should use managed Google Domains by default. 2) New Android Enterprise enrollment flow In early Q3 2024 for EMM partners with solutions based on Android Management API, we added the ability to enable “Authenticate using Google” which allows managed Google Accounts with work email addresses to be enrolled for end users. In addition, we added a new enrollment method, which is the ability to trigger enrollment by adding managed Google accounts directly from the Settings>Accounts section in Android OS. Enabling “Authenticate using Google” requires our EMM partners to make some changes to allow userless dedicated devices to enroll without being prompted to add a work account, but all AMAPI partners should be working to adopt these changes and all EMMs will be enabled by Q1 2025. For EMM Partners that build custom solutions based on Play EMM API, similar new enrollment capabilities will be available to begin development starting in Q1 2025. 3) Upgrade Managed Google Play Enterprises to Managed Google Domains (Q1 2025) Next, following up on our new signup flow from earlier in the year, we are making it possible for ALL organizations to upgrade their Managed Google Play accounts enterprises, and have their binding moved to their managed Google domain. This will involve switching out the gmail addresses used by IT admins for currently bound enterprises and replacing them with work email addresses associated with a managed Google domain. 4) Upgrading users to Managed Google accounts (later 2025) Finally, later in 2025, we’re going to be offering the capability to upgrade end user Managed Google Play accounts installed on devices to managed Google accounts corresponding to user email addresses. Stay tuned for more details in the coming quarters. We extend our thanks to the AE community for your continued support and collaboration. As we continue to enhance the signup and device enrollment experience, we encourage you to stay tuned for more updates and exciting developments in the coming quarters. Plus, feel free to let us know below if you are interested in hearing more about any of the above. The Android Enterprise TeamStronger management of company-owned devices with Android 15 for business
15th October, 2024 For company-owned devices, Android 15 empowers you with advanced management capabilities to help you take control, optimize your fleet of devices, and safeguard your business – on your terms. Explore new tools to navigate the modern workplace with Android 15. Streamline eSIM management for managed devices Android 15 streamlines adding, removing and provisioning eSIMs on both company-owned devices and managed BYOD devices. Simple eSIM management* on managed devices makes it easier to onboard and offboard employees. This means IT admins can spend less time setting up eSIM devices, and more time on impactful work. *For all devices, eSIM management is conducted via the EMM. Additionally, for BYOD devices, the device’s owner is responsible for using and activating the eSIM, and the user can delete the eSIM at any point. Secure personal profiles and private spaces on COPE devices Extend your existing personal app policies to the private space on company-owned devices. IT admins have better control over the device’s security posture with a limited set of privacy preserving security restrictions* for selected apps outside the Work Profile on company-owned devices. An additional set of privacy safe security configurations for core apps will be made available at a later date. *AMAPI managed devices will have the ability from Android 15 onward. Managed configurations apply only to company-owned, personally enabled (COPE) devices. Enforce the default apps for personal profile on company-owned devices IT admins can now enforce the default dialer, messaging app, and browser* in the personal profile when setting up company-owned devices to add an extra layer of security without compromising user experience. * Available only on company-owned, personally enabled (COPE) devices. IT admins can only make an app the default if it’s already in the user’s personal profile. To ensure OEM defaults for dialer and browser are set, this feature should be configured prior to set up. Enable seamless searching for your teams with Circle to Search Forget juggling multiple apps. With new admin controls for Circle to Search* on both fully managed devices and within the Work Profile, IT can confidently empower employees to search directly from their work apps. They can simply circle, scribble, or tap content for more information. *Circle to Search requires internet connection and compatible apps and surfaces. Results may vary depending on visual matches. For Android Enterprise managed devices, the feature is available on fully managed devices and devices with Android Work Profile. For company-owned, personally enabled (COPE) devices, Circle to Search is subject to the IT admin’s ability to turn off screen capture, which will disable the feature. For employee-owned devices with an Android Work Profile, Circle to Search within the personal profile remains unaffected by IT admin policies. Available on Pixel P8, P8 Pro, P6 series, P7 series, Pixel Fold, Pixel Tablet, Samsung S24 series, S23 series (incl. FE), S22 series, S21 series, Z Flip 3/4/5, Tab S9 series, Tab S8 series. Extend battery life with screen brightness and timeout controls Android 15 introduces screen brightness and timeout period controls* for company-owned devices. IT admins can adjust settings to optimize device efficiency for frontline staff, extending battery life to help them power through a shift without any device downtime. *Available on company-owned, personally enabled (COPE) devices, fully managed devices, and dedicated devices. Read Enhanced employee and device protection with Android 15 for business next. Learn more in our Help Center FAQ. Register for the community to access and download these images and an Android 15 slide deck. How helpful will these new features be to your business? We’d love to hear your thoughts and feedback below!Enhanced employee and device protection with Android 15 for business
15th October, 2024 Flexibility and productivity go hand-in-hand in the era of modern work. But so can security risks. Designed for the modern workplace, Android 15 introduces new ways to protect company devices and shield sensitive data - for both employees and companies - wherever the working day leads. Here’s how Android 15 can strengthen digital defenses. Secure stolen devices with Android theft protection Too often the cost of theft extends beyond hardware. That’s why Android theft protection* focuses on locking down your device should it fall into the wrong hands, helping minimize the impact of stolen devices. Theft Detection Lock offers automatic protection the moment a device is stolen. It uses machine learning to detect any motion associated with theft, like snatching or driving away, and quickly locks the device to protect device data. Offline Device Lock is enabled once a device is stolen. If a stolen device is disconnected for a set period of time, the device screen automatically locks to prevent unauthorized access, even when off-grid. Remote Lock empowers employees to act quickly once their devices are gone. As an extra, immediate precaution when a device is lost or stolen, employees can lock the missing device at android.com/lock using just their phone number. *Theft Detection Lock, Offline Device Lock, and Remote Lock requires Android 10+ and an internet connection. Android Go devices are not supported. Support may vary based on your device model. The user must be using the phone while it is unlocked. All theft protection features will be available in October. Offer employees a private space within their personal profile Personally enabled devices balance convenience and usability, with enhanced controls to protect business data. Now, employees are able to create a private space* for personal profile data - a folder locked with a separate password or biometrics - to store apps containing sensitive information, like banking or healthcare. Employees can work with peace of mind, knowing that personal apps and activities are hidden and secure when working on the go or when sharing the screen with co-workers. *Private space on COPE devices are subject to the same security requirements as the personal profile. Admins will be able to block the user from having a Private Space and remove an existing Private Space in COPE. Review security logs easily with the latest NIAP logging requirements Android 15 is enhancing device security with new logging capabilities that meet the latest NIAP regulations. Administrative changes are logged and stored in the SecurityLog - and data backup events are migrated from Logcat to the SecurityLog for easier upload and streamlined management. Now IT teams can more easily identify and address potential security threats. Read Stronger management of company-owned devices with Android 15 next. Learn more about what’s new in our Help Center FAQ. Register for the community to access and download these images and an Android 15 slide deck. Enjoyed this introduction? Feel free to drop a kudos and join the discussion below - we’d love to know how these new features might impact your business strategy.
