Technical · Course T2Lesson 2 of 5
Choosing an enrollment method
7 min read- Compare QR, Zero Touch, KME, and manual enrollment on ownership, scale, and touch required
- Recommend the right method for a given customer scenario
- Explain which methods survive a factory reset
Four enrollment paths cover every Android scenario. Choosing well is a two-question framework: who owns the device, and how many are there.
The comparison
| Method | Ownership | Scale | Touch required | Pre-provisioning |
|---|---|---|---|---|
| QR code | Corporate / BYOD | Small–medium | Scan at setup | None |
| Zero Touch (ZTE) | Corporate | Large | None | Google portal |
| Knox Mobile Enrollment | Corporate (Samsung) | Large | None | Samsung portal |
| Manual (Play Store app) | BYOD | Small | Install app + code | None |
How to decide
Corporate-owned and lots of them → zero-touch programs. Devices bought through authorized resellers get pre-registered to the customer's account and enroll themselves on first boot. Mixed-vendor fleet → Google Zero Touch (Android 8.0+). Samsung fleet → KME, which also reaches Samsung devices older than 8.0 and adds Knox-specific controls. The two programs coexist happily in one tenant.
The property that matters to customers: zero-touch devices are locked to the MDM. A user can factory reset the device and it re-enrolls on the next boot, because the assignment lives with Google/Samsung, not on the device.
Corporate-owned, a pilot or a store's worth → QR code. No portal registration, no reseller dependency — generate a code from a policy and scan it at the setup screen. The trade: someone touches every device, and it only works from a factory-reset state. Fine at 30 devices, painful at 300, wrong at 3,000.
Employee-owned → manual Work Profile enrollment. The user installs the WeGuard app from Google Play and enters an activation code. Corporate data lands in an isolated work profile; personal data stays untouched and no reset is needed. Know the honest limits: management covers the work profile, not the whole device, and the user can remove the profile whenever they choose. That's a feature for BYOD — not a gap.
Scenario practice
| Customer says | You recommend |
|---|---|
| "500 mixed-brand delivery handhelds, new purchase" | Zero Touch via an authorized reseller |
| "All-Samsung retail fleet, some older devices" | Knox Mobile Enrollment |
| "40 tablets for one warehouse, already bought" | QR code enrollment |
| "Sales team's personal phones need email + apps" | Work Profile manual enrollment |
One fleet often uses several methods — ZTE for the new purchase, QR for the odd batch bought retail, Work Profile for the office staff. Methods combine; policies stay consistent.