how to manage personal profile using android management api?

Question

From my last posted question below, Not getting any idea about the workflow of managing an android device from another device using an pre installed android in both devices I am here today with new problem. I used android management api to create enterprise, enrolling a device with device policies(Used the sample provided in here a link . But what I am trying to achieve I am not getting it. I want the app to be able to disable all normal apps and camera when parent app blocks them in childs device from its own device using android management api. But what I am getting is that upon upload of enrollment of the policy using enrollment token I see a separate work profile is being created in android device which is not my requirement in the app. So if anyone out here can help me out in this one be very thankful.

Answer 1

TL DR:

To fully control a device you must enroll it in DEVICE OWNER mode.

---

I'll try to stick only to this question and address your other concerns answering the other.

You can enroll a device mainly in two modes WORK PROFILE and DEVICE OWNER , one is thought for enterprises that want to allow a BYOD model, the other for enterprises that provide company owned terminals and who wants exert full control on them.

From the docs: https://developers.google.com/android/management/provision-device

The work profile provisioning methods create a work profile on a device. A work profile is a self-contained space that separates work apps from personal apps (see employee-owned devices for more information). On devices with work profiles:

• Android Device Policy is installed within the work profile.
• devices.managementMode is set to PROFILE_OWNER.
• Most policies and commands apply to the work profile only.

The fully managed and dedicated device provisioning methods provide enterprises with full management control over a device:

• Android Device Policy is installed on the device's personal (primary) profile.
• devices.managementMode is set to DEVICE_OWNER.
• Policies and commands apply to the entire device.

Your idea probably needs DEVICE_OWNER mode but here there is the big problem, to enable them you must enroll a device that is factory reset!

So you need a much specific process to prepare a device before use, you cannot achieve a so strict control on a device just installing an app and control it from outside permissions or not. It's against the logic of a "personal device".