When you equip your workforce with mobile devices, you have to decide exactly how those devices will be used. For organisations using Android terminals, this choice usually comes down to two main MDM (Mobile Device Management) modes: locking the device down completely for work only, or creating a secure work container while allowing personal use.

Understanding these options is crucial. The right MDM management mode keeps your corporate data safe, while the wrong choice can lead to frustrated employees or unnecessary hardware costs.

Understanding the Corporate-Owned, Business Only (COBO) model

A Fully Managed approach, also known as Corporate-Owned, Business Only (COBO), gives IT administrators total control over the device. It is dedicated exclusively to work. Using an MDM, administrators can silently install approved business apps, block dangerous websites, disable hardware features like the camera or USB file transfer, and enforce strict password policies.

This method is perfect for regulated industries like finance or healthcare. Because users cannot install their own applications, the risk of data leaks is virtually zero. The device acts as a locked-down, dedicated business tool, keeping the corporate network completely safe from consumer apps.

The rise of Work Profile on Company-Owned (WPCO) devices

However, issuing strictly locked-down devices to corporate employees often leads to “device fatigue,” where staff must carry one phone for work and another for personal use. To solve this, Google introduced the Work Profile on Company-Owned (WPCO) enrollment method for Android 11 and above, refining an older concept known as COPE (Corporate-Owned, Personally-Enabled).

An Android WPCO configuration allows the company to retain ownership of the mobile devices while securely separating work and personal data at the OS level. Business applications, corporate emails, and internal documents are encrypted inside a dedicated, visually distinct container. The IT team manages this specific container and can enforce security policies or wipe it remotely.

Howeverthe IT department has zero visibility into the personal side of the device. They cannot monitor personal browsing history, read personal text messages, or see which consumer apps the employee has downloaded. This architecture provides the employer with hardware-level controls, such as enforcing network settings or factory reset protection, while legally and technically safeguarding the employee’s privacy on their off-hours.

Choosing the right Mobile Device Management strategy for your organisation

Selecting between these two models depends on your users. IT leaders should evaluate three main points:

• Data isolation and compliance requirements: Fully Managed mode allows IT to enforce global device restrictions. WPCO restricts IT control to the work container and some global device settings, which is highly secure but may not meet the extreme compliance rules of certain environments.
• Employee privacy expectations: WPCO is ideal for executives or sales teams who want the convenience of a single phone. It guarantees their privacy while maintaining corporate security.
• Targeted attack surfaces: Fully Managed devices offer the highest security since personal apps are blocked entirely. WPCO relies on Android’s secure container to prevent personal apps (and potential malware) from accessing work data, which is safe but slightly broader in risk than a fully locked-down device.

Executing your mobile strategy

Once the appropriate deployment mode has been defined, the next step is to implement and manage these configurations efficiently across the fleet. A dedicated Android MDM software allows IT teams to create policies based on device type, user needs, or business requirements, and apply them consistently across multiple devices.

Cloud-based platforms like TinyMDM provide a dedicated Android Enterprise MDM solution for managing both fully managed and WPCO devices from a single console. As a 100% Android MDM solution, TinyMDM allows administrators to apply strict COBO policies to devices such as warehouse tablets, while using WPCO configurations for corporate smartphones where employees also need personal use.