Android 11 marks our seventh release with enterprise features, going back to 2014 when we introduced the work profile to secure and separate work data on a personal device. Now we’re coming full circle with new work profile improvements that make Android even more private and productive for employees. We’ve also included some key security updates in this release to further protect both work and personal data. 

Making employee privacy job #1 

Android champions employee privacy with the work profile, and in Android 11 we’re bringing the same work profile privacy protections from personally-owned devices to company-owned devices as well. Privacy is an expectation for employees and IT decision makers alike: a new Omdia research survey of 700 IT decision makers found that 80 percent of respondents believed personal data should be kept private from IT on a company-owned device. 

To better support company-owned devices, the work profile now offers device controls like asset management tools and personal usage policies that give IT the ability to keep devices compliant with corporate policy without compromising employee privacy. And regardless of who owns the device, industry-leading data separation and security controls help ensure work data is secure in the work profile. To learn more, read our new work profile security paper.

To give employees more information about their location privacy, we’ve added a new notification whenever their IT admin grants location access to work apps. We’ve also enhanced our agreements with device manufacturers to help ensure all work profile privacy protections are reliably enforced. 

Making it easy to get work done

The work profile makes the separation of work and personal data visible and usable for employees, while enabling easy switching between profiles. This helps people focus on their work and avoid accidental data leaks, all on a single device. 

We’re taking that even further in Android 11 by expanding work and personal separation to more places throughout Android. Employees will now see separate tabs for work and personal when they share files, open content or go into their settings menu.

Separating work from personal makes it possible to do things such as pausing the work profile so employees can disconnect at the end of the day. In Android 11 we’ve made this easier by removing unwanted distractions when the work profile is paused and enabling employees to automatically pause work apps according to their own schedule.

Finally, for those times when it’s helpful to view work and personal data at the same time, we’ve built a new secure mechanism for merged experiences, allowing trusted apps to connect between work and personal profiles. Both employees and IT must approve the way an app will handle security and user privacy before allowing an app to connect. 

For instance, Google Calendar will soon allow people to see personal events in their work calendar, helping to better schedule around commitments across their day.  Personal calendar events will remain privately stored on device in the personal profile, invisible to both colleagues and IT. 

We'll be working with additional developers in the coming months to make more connected experiences available to users.

Making it simple to be secure and in control

Android security continually gets stronger as recently demonstrated by Pixel smartphones completing Common Criteria certification on Android 10 by leveraging Android Enterprise management APIs. In Android 11, we're investing even more in security and management features that provide organizations with more protection for their data. 

Last year, we launched Google Play system updates to directly patch OS system components using the same infrastructure we use to update apps. In Android 11, we’re now adding nine more privacy and security components to the original 12 that can be updated via Google Play system updates, allowing us to quickly address even more critical areas without waiting for full operating system updates. 

Other enterprise improvements include: 

• More IT controls for always-on VPN configurations.  

• The ability to pre-grant certificate access for work apps, so specific individual apps can access credentials without user interaction.

• Device attestation using individual certificates, on devices with a dedicated secure element.

• Continued investment in addressing regulatory certification requirements such as Common Criteria - Mobile Device Fundamentals, and FIPS 140-2. 

 These are just some of the improvements in Android 11 that organizations can begin utilizing. To learn more, visit our developer page and read about thelatest consumer features.

Android 11 marks our seventh release with enterprise features, going back to 2014 when we introduced the work profile to secure and separate work data on a personal device. Now we’re coming full circle with new work profile improvements that make Android even more private and productive for employees. We’ve also included some key security updates in this release to further protect both work and personal data. 

Making employee privacy job #1 

Android champions employee privacy with the work profile, and in Android 11 we’re bringing the same work profile privacy protections from personally-owned devices to company-owned devices as well. Privacy is an expectation for employees and IT decision makers alike: a new Omdia research survey of 700 IT decision makers found that 80 percent of respondents believed personal data should be kept private from IT on a company-owned device. 

To better support company-owned devices, the work profile now offers device controls like asset management tools and personal usage policies that give IT the ability to keep devices compliant with corporate policy without compromising employee privacy. And regardless of who owns the device, industry-leading data separation and security controls help ensure work data is secure in the work profile. To learn more, read our new work profile security paper.

To give employees more information about their location privacy, we’ve added a new notification whenever their IT admin grants location access to work apps. We’ve also enhanced our agreements with device manufacturers to help ensure all work profile privacy protections are reliably enforced. 

Making it easy to get work done

The work profile makes the separation of work and personal data visible and usable for employees, while enabling easy switching between profiles. This helps people focus on their work and avoid accidental data leaks, all on a single device. 

We’re taking that even further in Android 11 by expanding work and personal separation to more places throughout Android. Employees will now see separate tabs for work and personal when they share files, open content or go into their settings menu.

Separating work from personal makes it possible to do things such as pausing the work profile so employees can disconnect at the end of the day. In Android 11 we’ve made this easier by removing unwanted distractions when the work profile is paused and enabling employees to automatically pause work apps according to their own schedule.

Finally, for those times when it’s helpful to view work and personal data at the same time, we’ve built a new secure mechanism for merged experiences, allowing trusted apps to connect between work and personal profiles. Both employees and IT must approve the way an app will handle security and user privacy before allowing an app to connect. 

For instance, Google Calendar will soon allow people to see personal events in their work calendar, helping to better schedule around commitments across their day.  Personal calendar events will remain privately stored on device in the personal profile, invisible to both colleagues and IT. 

We'll be working with additional developers in the coming months to make more connected experiences available to users.

Making it simple to be secure and in control

Android security continually gets stronger as recently demonstrated by Pixel smartphones completing Common Criteria certification on Android 10 by leveraging Android Enterprise management APIs. In Android 11, we're investing even more in security and management features that provide organizations with more protection for their data. 

Last year, we launched Google Play system updates to directly patch OS system components using the same infrastructure we use to update apps. In Android 11, we’re now adding nine more privacy and security components to the original 12 that can be updated via Google Play system updates, allowing us to quickly address even more critical areas without waiting for full operating system updates. 

Other enterprise improvements include: 

• More IT controls for always-on VPN configurations.  

• The ability to pre-grant certificate access for work apps, so specific individual apps can access credentials without user interaction.

• Device attestation using individual certificates, on devices with a dedicated secure element.

• Continued investment in addressing regulatory certification requirements such as Common Criteria - Mobile Device Fundamentals, and FIPS 140-2. 

 These are just some of the improvements in Android 11 that organizations can begin utilizing. To learn more, visit our developer page and read about thelatest consumer features.

For many Android users, Microsoft Exchange is the backend for their company email. Until recently, many email applications on Android used Device Admin capabilities to enforce the necessary security requirements on users’ devices, whether they were issued by their company or personally owned.

These APIs, which we began deprecating in Android 9 Pie, gave IT control over core security features such as device passcode requirements and remote data wipe. While this gives IT admins controls to promote data protection on the devices when using Exchange email clients, it also adds unnecessary complexity.

We've worked closely with Microsoft to create a new set of APIs that give email developers tools to secure their apps while adhering to the high standards we've set in Android for user privacy.

Google and Microsoft work together for user privacy

IT admins have the option to require a user to follow a specified level of password complexity (options are for high, medium or low) to use their Exchange email app. If they don’t follow the set guidelines, they won’t be able to sync and access their corporate email. If IT needs to restrict or remove access on the device, no personal information, such as photos or downloads, will be removed. 

Combined with other Android technologies like the SafetyNet Attestation API, Android hardware-backed brute force protections and Google Play Protect, IT professionals can feel confident their data is protected by enterprise-grade security while giving their employees greater autonomy over their device. 

Bringing these improvements to more users

Gmail will showcase this new functionality later this month. As Android app developers update apps to meet the official Device Admin deprecation requirements in Android 10 later this year, look for your favorite email client to take advantage of this functionality soon.

For companies whose needs evolve and would benefit from even greater management capabilities, we invite them to learn more at android.com/enterprise.

Employees increasingly demand privacy from the technology they use every day, but employers often see privacy in opposition to enterprise data security. 

Since its debut in Android 5, the work profile has secured company data on personally-owned devices while preserving employee privacy. The separation of work and personal apps means IT gets full control over work apps and data, but has no visibility into personal apps. In Android 11, we’re bringing these privacy protections to company-owned devices as well, while providing IT the additional capabilities needed to manage company assets. 

Employees demand privacy, even on company-owned devices

In a recent survey by ESG research, 71 percent of employees said they expect all personal information to remain private on work devices. This resistance to traditional full device management creates challenges for IT organizations. In fact, employee concern about privacy is the top reason mobile devices remain unmanaged by IT, according to IDC: 

“Many users of corporate-liable devices have privacy concerns about app usage and corporate IT monitoring their activity,” says Phil Hochmuth, program VP, enterprise mobility at IDC. “Due to this concern, more than a third (38 percent) of corporate-owned devices deployed in enterprises go unmanaged.”

Personal data should always stay private

Android is committed to delivering simple, consistent privacy protections to our users. Just as IT shouldn’t put company data at risk to enable mobile productivity, employees shouldn’t be asked to reveal private, personal data to their company. 

That’s why we’ve expanded Android’s commitment to employee privacy in Android 11, by bringing the privacy protections of the work profile to company-owned devices. This means IT can deploy the work profile to help protect employee privacy across their entire fleet, regardless if the device is personally or company-owned.

Always get the right level of management

To make the work profile a great tool for company asset management, we had to bring to it many of the capabilities our customers value in Android’s fully managed devices. These include: 

• Asset management protections, even if devices are lost or stolen

• Personal usage policies such as restricting what apps employees can use, to keep device usage in compliance with corporate policy

• Hardware management, to restrict or prevent configuration of features like Bluetooth, cameras, and removable storage

Extending management beyond the work profile required us to separate the management of data from visibility into that data. For example, IT can block an employee from using social media apps on a company-owned device, but in doing so doesn’t need to know the other apps they use outside of work. Now Android can help preserve employee privacy in the personal profile while enabling IT management of what employees can do with the personal profile.

Whoever owns the device gets to decide how the device can be used. As before, if an employee owns their device IT can only manage core security features, like preventing users from installing apps from unknown sources. But if the company owns the device, IT can now manage how users interact with the whole device. In this way, the work profile adjusts its management capabilities according to who owns the device, while offering the same privacy protections in all scenarios.

Get it first with the Android Management API

We’re pleased to announce that the Android Management API will support these work profile enhancements in July enabling customers and developers to try out these new features on the Android 11 Beta.

Exclusive to the Android Management API, we’re bringing Android 11’s new combination of strong personal privacy protections and robust asset management features to older Android devices, as far back as Android 8. This means customers can deploy a single management solution across most, if not all of their Android fleet, not only for personally- and company-owned devices but across a wide range of Android versions as well. Speak with your enterprise mobility management (EMM) provider to learn how your company can make the most of the work profile.

Prioritizing privacy

Just because people use their phones at work, doesn’t mean they should have to sacrifice their privacy. Since Android 5.0, the work profile has helped ensure personal data remains private from IT even when employees bring their device to work, while giving IT the tools they need to secure corporate data. 

But when given a phone by their company, employees don’t always know what IT can and can’t see. That’s a challenge for employees who want to keep their personal data private; in a recent survey of workers by ESG Research last year, 71% said they expect any personal information to remain private on work devices.

What’s coming in Android 11

In Android 11, enhancements to the work profile mean IT can confidently extend the same privacy protections to a company-owned device that people have come to expect from the work profile on a personally-owned device. 

For IT professionals, new asset management and device-level controls for the work profile can manage and restrict personal use to ensure company assets are compliant with corporate policies. Now in Android 11, IT will have additional control over what the employee can do on the personal side of the device, while not having visibility into how they choose to use the device within those admin-defined restrictions. 

For example, IT can ensure employees can’t install video streaming apps that would consume large amounts of company-subsidized cellular data. On the other hand, IT will not have visibility into which of the permitted applications employees choose to install and use. 

For employees, this means they can get the full privacy protections from the work profile on company-owned devices, restricting IT visibility into their personal apps and data.

All of this is accomplished without compromise to the integrity of company data. The strong boundary between work and personal data established by the work profile’s architecture, combined with Android’s extensive set of management and security features, ensures that IT has full control and visibility over where their work data can go. 

Upgrading user privacy

To enable this functionality as quickly and easily as possible, Android will automatically migrate work profile on fully managed devices to the improved work profile experience when devices upgrade to Android 11. Work profiles on fully managed devices will not be supported for either existing devices that upgrade to, or new activations on, Android 11. Other devices currently configured with work profiles are unaffected by these changes.

If you currently deploy Android Enterprise and have questions about how your Android 10 devices may be affected, please contact your EMM partner for more information.

Want to learn more?

Learn more about this and other new Android 11 features on the Developer Preview 1 site, and download a system image for Pixel 2, 3, 3a, and 4 now.