The **fully managed device** solution set is intended for company-owned devices.
Fully managed features give IT admins management of an extended range of device
settings and extra policy controls not available in the [work profile
on personally-owned device](https://developers.google.com/android/work/requirements/work-profile).

## Feature list

|---|---|---|---|
| required | optional | advanced | not supported |

<br />

|---|---|---|---|
| ### **1. Device provisioning** ||||
| [1.2. DPC identifier device provisioning](https://developers.google.com/android/work/requirements.md.txt#1.2.-dpc-identifier-device-provisioning_1) | Android 6.0+ |   | IT admins can provision a fully managed device using a DPC identifier ("afw#"). |
| [1.3. NFC device provisioning](https://developers.google.com/android/work/requirements.md.txt#1.3.-nfc-device-provisioning_1) | Android 6.0+ |   | IT admins can "bump" new or factory-reset devices with the EMMs NFC provisioning app to provision a device. |
| [1.4. QR code device provisioning](https://developers.google.com/android/work/requirements.md.txt#1.4.-qr-code-device-provisioning_1) | Android 7.0+ |   | IT admins can use new or factory-reset device to scan a QR code generated by the EMM's console to provision the device. |
| [1.5. Zero-touch enrollment](https://developers.google.com/android/work/requirements.md.txt#1.5.-zero-touch-enrollment_1) | N/A |   | This requirement has been replaced by requirement 1.6. |
| 1.6. Zero-touch provisioning | Android 8.0+ (Pixel: Android 7.1+) |   | IT admins can automate much of the device enrollment process by deploying DPC registration details through zero-touch enrollment. |
| 1.8. Google Account device provisioning | N/A |   | This requirement is removed and replaced by requirement 3.23. |
| [1.9. Direct zero-touch configuration](https://developers.google.com/android/work/requirements.md.txt#1.9.-direct-zero-touch-configuration_1) | Android 7.0+ |   | IT admins can use the EMM's console to set up zero-touch devices using the zero-touch iframe. |
| ### **2. Device security** ||||
| [2.1. Device security challenge](https://developers.google.com/android/work/requirements.md.txt#2.1.-device-security-challenge_1) | Android 5.0+ |   | IT admins can set and enforce a device security challenge (such as PIN/pattern/password) of a certain type and complexity on managed devices. |
| [2.3. Advanced passcode management](https://developers.google.com/android/work/requirements.md.txt#2.3.-advanced-passcode-management_1) | Android 5.0+ |   | IT admins can set up advanced password settings on devices. |
| 2.4. Smart Lock management | Android 6.0+ |   | IT admins can manage what trust agents in Android's Smart Lock feature are permitted to unlock devices. |
| [2.5. Wipe and lock](https://developers.google.com/android/work/requirements.md.txt#2.5.-wipe-and-lock_1) | Android 5.0+ |   | IT admins can use the EMM's console to remotely lock and wipe work data from a managed device. |
| [2.6. Compliance enforcement](https://developers.google.com/android/work/requirements.md.txt#2.6.-compliance-enforcement_1) | Android 5.0+ |   | The EMM restricts access to work data and apps on devices that aren't in compliance with security policies. |
| [2.7. Default security policies](https://developers.google.com/android/work/requirements.md.txt#2.7.-default-security-policies_1) | Android 5.0+ |   | EMMs must enforce the specified security policies on devices by default, without requiring IT admins to set up or customize any settings in the EMM's console. |
| [2.9. Play Integrity support](https://developers.google.com/android/work/requirements.md.txt#2.9.-safetynet-support_1) | N/A |   | The EMM uses the Play Integrity API to ensure devices are valid Android devices. |
| [2.10. Verify Apps enforcement](https://developers.google.com/android/work/requirements.md.txt#2.10.-verify-apps-enforcement_1) | Android 5.0+ |   | IT admins can turn on Verify Apps on devices. |
| [2.11. Direct Boot support](https://developers.google.com/android/work/requirements.md.txt#2.11.-direct-boot-support_1) | Android 7.0+ |   | Direct Boot support ensures that the EMM's DPC is active and able to enforce policy, even if an Android 7.0+ device has not been unlocked. |
| [2.12. Hardware security management](https://developers.google.com/android/work/requirements.md.txt#2.12.-hardware-security-management_1) | Android 5.1+ |   | IT admins can lock down hardware elements of a device to ensure data-loss prevention. |
| 2.13. Enterprise security logging | Android 7.0+ |   | IT admins can gather usage data from devices that can be parsed and programmatically evaluated for malicious or risky behavior. |
| ### **3. Account and app management** ||||
| [3.1. Enterprise binding](https://developers.google.com/android/work/requirements.md.txt#3.1.-managed-google-play-accounts-enterprise-enrollment_1) | N/A |   | IT admins can bind the EMM to their organization, allowing the EMM to use managed Google Play to distribute apps to devices. |
| [3.2. Managed Google Play Account provisioning](https://developers.google.com/android/work/requirements.md.txt#3.2.-managed-google-play-account-provisioning_1) | Android 5.0+ |   | The EMM can silently provision enterprise user accounts, called managed Google Play Accounts. |
| [3.5. Silent app distribution](https://developers.google.com/android/work/requirements.md.txt#3.5.-silent-app-distribution_1) | N/A |   | IT admins can silently distribute work apps to devices without any user interaction. |
| [3.6. Managed configuration management](https://developers.google.com/android/work/requirements.md.txt#3.6.-managed-configuration-management_1) | Android 5.0+ |   | IT admins can view and silently set managed configurations for any app that supports managed configurations. |
| 3.7. App catalog management | N/A |   | IT admins can import a list of the apps approved for their enterprise from managed Google Play (play.google.com/work). |
| [3.8. Programmatic app approval](https://developers.google.com/android/work/requirements.md.txt#3.8.-programmatic-app-approval_1) | N/A |   | The EMM's console uses the managed Google Play iframe to support Google Play's app discovery and approval capabilities |
| [3.9. Basic store layout management](https://developers.google.com/android/work/requirements.md.txt#3.9.-basic-store-layout-management_1) | N/A |   | The managed Google Play Store app can be used on devices to install and update work apps. |
| 3.10. Advanced store layout configuration | N/A |   | IT admins can customize the store layout seen in the managed Google Play Store app on devices. |
| 3.11. App license management | N/A |   | This feature is deprecated. |
| [3.12. Google-hosted private app management](https://developers.google.com/android/work/requirements.md.txt#3.12.-google-hosted-private-app-management_1) | N/A |   | IT admins can update Google-hosted private apps through the EMM console instead of through the Google Play Console. |
| 3.13. Self-hosted private app management | N/A |   | This feature is deprecated. |
| 3.14. EMM pull notifications | N/A |   | This requirement is not applicable to the Android Management API. |
| [3.15. API usage requirements](https://developers.google.com/android/work/requirements.md.txt#3.15.-api-usage-requirements_1) | N/A |   | The EMM implements Google's APIs at scale, avoiding traffic patterns that could negatively impact enterprises' ability to manage apps in production environments. |
| [3.16. Advanced managed configuration management](https://developers.google.com/android/work/requirements.md.txt#3.16.-advanced-managed-configuration-management_1) | Android 5.0+ |   | The EMM supports managed configurations with up to four levels of nested settings and can retrieve and display any feedback sent from a Play app. |
| [3.17. Web app management](https://developers.google.com/android/work/requirements.md.txt#3.17.-web-app-management_1) | N/A |   | IT admins can create and distribute web apps in the EMM console. |
| [3.18. Managed Google Play Account lifecycle management](https://developers.google.com/android/work/requirements.md.txt#3.18.-managed-google-play-account-lifecycle-management_1) | Android 5.0+ |   | The EMM can create, update, and delete managed Google Play Accounts on behalf of IT admins. |
| [3.19. Application track management](https://developers.google.com/android/work/requirements.md.txt#3.19.-application-track-management_1) | Android 5.0+ |   | IT Admins can configure a set of development tracks for particular applications. |
| [3.20. Advanced application update management](https://developers.google.com/android/work/requirements.md.txt#3.20.-advanced-application-update-management_1) | Android 5.0+ |   | IT Admins can allow apps to be updated immediately or postpone them from being updated for 90 days. |
| [3.21. Provisioning methods management](https://developers.google.com/android/work/requirements.md.txt#3.21.-provisioning-methods-management_1) | N/A |   | The EMM can generate provisioning configurations and present these to the IT admin in a form ready for distribution to end users (such as QR code, zero-touch configuration, Play Store URL). |
| [3.22. Upgrade Enterprise binding](https://developers.google.com/android/work/requirements.md.txt#3.22.-upgrade-enterprise-binding_1) | N/A |   | IT admins can upgrade the enterprise binding type to a managed Google domain enterprise, allowing the organization to access Google Account services and features on enrolled devices. |
| [3.23. Managed Google Account provisioning](https://developers.google.com/android/work/requirements.md.txt#3.23.-managed-google-account-provisioning_1) | N/A |   | The EMM can provision devices with managed Google Accounts to identify users, control apps, and manage access to Google services. |
| [3.24. Managed Google Play Account upgrade](https://developers.google.com/android/work/requirements.md.txt#3.24.-managed-google-play-account-upgrade_1) | N/A |   | IT admins can upgrade the user account type to a managed Google Account, allowing the device to access Google Account services and features on enrolled devices. |
| [3.25. App roles](https://developers.google.com/android/work/requirements.md.txt#3.25.-app-roles_1) | Android 11.0+ |   | The EMM supports granting special privileges, specified by the available role types, to an app chosen by the IT admin. |
| [3.26. Device data transfer and restore](https://developers.google.com/android/work/requirements.md.txt#3.26.-device-data-transfer-and-restore_1) | Android 8.0+ |   | IT admins can enable device data transfer and restore for fully managed devices that have Managed Google Accounts installed, and have the Google Restore app on the device. |
| ### **4. Device management** ||||
| [4.1. Runtime permission policy management](https://developers.google.com/android/work/requirements.md.txt#4.1.-runtime-permission-policy-management_1) | Android 6.0+ |   | IT admins can silently set a default response to runtime permission requests made by work apps. |
| [4.2. Runtime permission grant state management](https://developers.google.com/android/work/requirements.md.txt#4.2.-runtime-permission-grant-state-management_1) | Android 6.0+ |   | After setting a default runtime permission policy, IT admins can silently set responses for specific permissions from any work app built on API 23 or higher. |
| [4.3. Wi-Fi configuration management](https://developers.google.com/android/work/requirements.md.txt#4.3.-wi-fi-configuration-management_1) | Android 6.0+ |   | IT admins can silently provision enterprise Wi-Fi configurations on managed devices. |
| [4.4. Wi-Fi security management](https://developers.google.com/android/work/requirements.md.txt#4.4.-wi-fi-security-management_1) | Android 6.0+ |   | IT admins can provision enterprise Wi-Fi configurations on managed devices. |
| [4.5. Advanced Wi-Fi management](https://developers.google.com/android/work/requirements.md.txt#4.5.-advanced-wi-fi-management_1) | Android 6.0+ |   | IT admins can lock down Wi-Fi configurations on managed devices, to prevent users from creating new configurations or modifying corporate configurations. |
| [4.6. Account management](https://developers.google.com/android/work/requirements.md.txt#4.6.-account-management_1) | Android 5.0+ |   | IT admins can ensure that unauthorized corporate accounts can't interact with corporate data for services such as SaaS storage and productivity apps, or email. |
| [4.7. Workspace account management](https://developers.google.com/android/work/requirements.md.txt#4.7.-workspace-account-management_1) | Android 5.0+ |   | This feature is deprecated. See [3.23.](https://developers.google.com/android/work/requirements.md.txt#3.23.-managed-google-account-provisioning_1) for replacement requirements. |
| [4.8. Certificate management](https://developers.google.com/android/work/requirements.md.txt#4.8.-certificate-management_1) | Android 5.0+ |   | Allows IT admins to deploy identity certificates and certificate authorities to devices to allow access to corporate resources. |
| [4.9. Advanced certificate management](https://developers.google.com/android/work/requirements.md.txt#4.9.-advanced-certificate-management_1) | Android 7.0+ |   | Allows IT admins to silently select the certificates that specific managed apps should use |
| [4.10. Delegated certificate management](https://developers.google.com/android/work/requirements.md.txt#4.10.-delegated-certificate-management_1) | Android 6.0+ |   | IT admins can distribute a third-party certificate management app to devices and grant that app privileged access to install certificates into the managed keystore. |
| [4.11. Advanced VPN management](https://developers.google.com/android/work/requirements.md.txt#4.11.-advanced-vpn-management_1) | Android 7.0+ |   | Allows IT admins to specify an Always On VPN to ensure that data from specified managed apps will go through a set-up VPN. |
| [4.13. Advanced IME management](https://developers.google.com/android/work/requirements.md.txt#4.13.-advanced-ime-management_1) | Android 5.0+ |   | IT admins can manage what input methods (IMEs) are allowed on devices. |
| [4.14. Accessibility services management](https://developers.google.com/android/work/requirements.md.txt#4.14.-accessibility-services-management_1) | Android 5.0+ |   | IT admins can manage what accessibility services are allowed on devices. |
| [4.16. Advanced Location Sharing management](https://developers.google.com/android/work/requirements.md.txt#4.16.-advanced-location-sharing-management_1) | Android 5.0+ |   | IT admins can enforce a given Location Sharing setting on a managed device. |
| [4.17. Factory reset protection management](https://developers.google.com/android/work/requirements.md.txt#4.17.-factory-reset-protection-management_1) | Android 5.1+ |   | Allows IT admins to protect company-owned devices from theft by ensuring unauthorized individuals can't factory reset devices. |
| [4.18. Advanced app control](https://developers.google.com/android/work/requirements.md.txt#4.18.-advanced-app-control_1) | Android 5.0+ |   | IT admins can prevent the user from uninstalling or otherwise modifying managed apps through Settings. |
| [4.19. Screen capture management](https://developers.google.com/android/work/requirements.md.txt#4.19.-screen-capture-management_1) | Android 5.0+ |   | IT admins can block users from taking screenshots when using managed apps. |
| [4.20. Disable cameras](https://developers.google.com/android/work/requirements.md.txt#4.20.-disable-cameras_1) | Android 5.0+ |   | IT admins can turn off use of device cameras by managed apps. |
| 4.22. Advanced network statistics collection | Android 6.0+ |   | IT admins can query network usage statistics for an entire managed device. |
| [4.23. Reboot device](https://developers.google.com/android/work/requirements.md.txt#4.23.-reboot-device_1) | Android 7.0+ |   | IT admins can remotely restart managed devices. |
| [4.24. System radio management](https://developers.google.com/android/work/requirements.md.txt#4.24.-system-radio-management_1) | Android 7.0+ |   | Enables IT admins granular management of system network radios and associated usage policies. |
| [4.25. System audio management](https://developers.google.com/android/work/requirements.md.txt#4.25.-system-audio-management_1) | Android 5.0+ |   | IT admins can silently manage device audio features. |
| [4.26. System clock management](https://developers.google.com/android/work/requirements.md.txt#4.26.-system-clock-management_1) | Android 5.0+ |   | IT admins can manage device clock and time zone settings, and prevent modifying automatic device settings.. |
| [4.28. Delegated scope management](https://developers.google.com/android/work/requirements.md.txt#4.28.-delegated-scope-management_1) | Android 8.0+ |   | IT admins are able to delegate extra privileges to individual packages. |
| [4.30. Credential manager policy](https://developers.google.com/android/work/requirements.md.txt#4.30.-credential-manager-policy_1) | Android 15.0+ |   | IT admins can manage which credential manager applications are allowed or blocked using the credential provider policy default or the credential provider policy. |
| [4.31. Basic eSIM management](https://developers.google.com/android/work/requirements.md.txt#4.31.-basic-esim-management_1) | Android 15.0+ |   | Allows IT admins to provision a device with an eSIM profile and manage its lifecycle on the device. |
| ### **5. Device usability** ||||
| [5.1. Managed provisioning customization](https://developers.google.com/android/work/requirements.md.txt#5.1.-managed-provisioning-customization_1) | Android 7.0+ |   | IT admins can modify the default managed provisioning flow UX to include enterprise-specific features. |
| 5.3. Advanced enterprise customization | Android 7.0+ |   | IT admins can customize managed devices with corporate branding. |
| [5.4. Lock screen messages](https://developers.google.com/android/work/requirements.md.txt#5.4.-lock-screen-messages_1) | Android 7.0+ |   | IT admins can set a custom message that's displayed on the device lock screen, and does not require device unlock to be viewed. |
| [5.5. Policy transparency management](https://developers.google.com/android/work/requirements.md.txt#5.5.-policy-transparency-management_1) | Android 7.0+ |   | IT admins can customize the help text provided to users when they attempt to modify managed settings on their device, or deploy an EMM-supplied generic support message. |
| [5.8. System update policy](https://developers.google.com/android/work/requirements.md.txt#5.8.-system-update-policy_1) | Android 6.0+ |   | IT admins can set up and apply over-the-air (OTA) system updates for devices. |
| [5.10. Persistent preferred activity management](https://developers.google.com/android/work/requirements.md.txt#5.10.-persistent-preferred-activity-management_1) | Android 5.0+ |   | Allows IT admins to set an app as the default intent handler for intents that match a certain intent filter. |
| [5.12. Advanced keyguard feature management](https://developers.google.com/android/work/requirements.md.txt#5.12.-advanced-keyguard-feature-management_1) | Android 5.0+ |   | IT admins can control advanced device keyguard (lock screen) features. |
| 5.13. Remote debugging | Android 7.0+ |   | IT admins can retrieve debugging resources from devices without requiring extra steps. |
| [5.14. MAC address retrieval](https://developers.google.com/android/work/requirements.md.txt#5.14.-mac-address-retrieval_1) | Android 7.0+ |   | EMMs can silently fetch a device's MAC address, to be used to identify devices in other parts of the enterprise infrastructure. |
| ### **6. Device admin deprecation** ||||
| ### **7. API usage** ||||
| [7.1. Standard policy controller for new bindings](https://developers.google.com/android/work/requirements.md.txt#7.1.-standard-policy-controller-for-new-bindings_1) | Android 5.0+ |   | By default devices must be managed using Android Device Policy for any new bindings. EMMs may provide the option to manage devices using a custom DPC in a settings area under a heading 'Advanced' or similar terminology. New customers must not be exposed to an arbitrary choice between technology stacks during any onboarding or setup workflows. |
| [7.2. Standard policy controller for new devices](https://developers.google.com/android/work/requirements.md.txt#7.2.-standard-policy-controller-for-new-devices_1) | Android 5.0+ |   | By default devices must be managed using Android Device Policy for all new device enrollments, for both existing and new bindings. EMMs may provide the option to manage devices using a custom DPC in a settings area under a heading 'Advanced' or similar terminology. |