View
105
Download
1
Category
Preview:
Citation preview
Android for Work is a programto drive Android adoption in the workplace
Secure Android for BYOD and corporate
issued devices
Google Play for Work for app distribution
Standardized management
Leveraging entire Android ecosystem
Management
Integrated with existing management tools. to create a
single console across all devices
Devices
Designing new business specific form factors and enabling AfW
management
Applications
Developer friendly: write once, deploy and manage on any device through Google Play
Networking
Securely connect to your internal systems through VPN
and network applications
Android for Work launched earlier this year with support from a broad set of initial partners
Work ProfilesExtension of Lollipop’s
default encryption, security enforcement and
multi-user support
A dedicated work profile isolates and protects work data - badged work apps
sit right alongside personal apps
Users know IT only manages work data and
can’t erase or view personal content
Android for Work app
For devices that can’t run work profiles natively
Secure mail, calendar, contacts, documents,
browsing and access to approved work apps
Can be completely managed by IT
Work Profile vs Android for Work app
Android Lollipop+*
Native App
Work instance
Personal instance
Android ICS-Kitkat**
Android for Work SDK
Work App
Android for Work App
Native App
* Where OEM has enabled multi-user** Or lollipop where OEM has not enabled multi-user
Work Profile Android for Work appAndroid for Work SDK
Enables apps to run seamlessly in the secure container provided by the Android for Work App.
Supports APIs to access the container such as Contacts/Calendar Providers, Storage Access Framework, Intents, Application configuration and management, KeyStore access, Clipboard, Download and Notification Manager.
Provides Extension APIs to support VPN and File encryption.
Personal user
Work user
Work Managed DeviceFor corporate-liable deployments which
require management of the entire device
Set up from initial boot including NFC-based
provisioning
Deploy only selected apps -- internal or 3rd party --
to managed devices
Built-in productivity tools
A suite of business apps for everyday tasks: email,
contacts and calendar
Supports Exchange and Notes
Edit the most popular documents with Docs, Sheets and Slides apps
Google Play for Work
Allows IT to securely deploy and manage
business apps
Any app in the Play catalog to be deployed to the Work Profile; a subset to the Android for Work
app
Simplifies process of distributing apps and
ensures IT approves every app deployed to workers
IT Admins: Work Storefront - play.google.com/work
● Web-based tool for Company Admin
● Access to entire public Google Play catalog
● Bulk App Purchasing for users
● Admin acceptance of permissions for whitelisted apps
Points of Integration For App Developers
Managed Configuration
Your app can expose its policy and configuration settings, to be read by Enterprise Mobility Managers, and
managed by IT admins.[Details]
Data Segregation
Users of your app can keep data separate between their work and personal
profiles. Check that your app works seamlessly in a work profile.
[Details]
Group Licensing
Your app can be bulk purchased by IT admins and licenses assigned and
reassigned within the company. Opt-in via Play Developer Console.
[Coming Soon]
Identity / Authentication
Use Google sign-in to authenticate. Customers that have integrated to
Google Auth get SSO with your app for free--or leverage standard SAML/OAuth
[Details]
HW
OS
APPS MGT
VERIFIED BOOT
HARDWARE ENABLED KEY STORE
ENCRYPTION
SELINUX + ANDROID
WORK PROFILE PERSONAL
APPLICATIONS
IDENTITYAPPS
PRIVATE / PLAY
OEM EXTENSIONS
AND INNOVATION
EMMs
OEMs
OS
APPS MGT
ENCRYPTION
SECURITY ENHANCEMENTS (SE) for ANDROID
APPLICATIONS
IDENTITYAPPS
PRIVATE / PLAY KNOX WORKSPACE
EMMs
KNOX ANDROID
FRAMEWORK(VPN, SSO, ODE, SDP, Attestation)ENHANCED TIMA
(RKP/Keystore/CCM)TRUSTED BOOT SECURE BOOT
WORK PROFILE PERSONAL
USER EXPERIENCE
:: Personal and work applications shown in a single unified launcher
:: Work apps badged with an orange briefcase
:: A single application binary with two different data sets - one for work and one for personal
:: PIM Suite, Browser, Docs, Sheets, Slides included
● OS based data separation
● Data sharing restricted across profiles
● Separate file store for each profile
Data Sharing Between Apps
Recent task switching
with badging
● Work apps are badged
● Seamless switching between personal apps to work apps
● Work and personal instances of same app run side-by-side with sandboxed data stores
Native Task Switching
● Notifications are badged to separate work from personal
● EMM policy can redact or limit detail displayed
Badged Notifications
● Same look and feel as Android for Work native experience in Lollipop
● All Applications shown in launcher
● Work apps indicated by orange briefcase badge
● Consistent across all Android for Work devices
CONFIDENTIAL
USER EXPERIENCE
● Application management and security framework
● Suitable for BYOD scenarios● Screenlock protected, controlled apps● Management of the profile and
associated apps vs full device● Wipe removes the profile, data and
apps, leaving the rest of the device unaffected
CONFIDENTIAL
Android for Work App
Google Play for Work Store● Android Work will provide a
Managed Google Play Store to build collections of IT-approved apps
Managed Google Account● Eliminates the use of personal
accounts for Play for Work access
● Enables installation of approved apps presented in Work Profile
● Facilitates app management including volume purchases, with no license keys or user intervention
Google Play for Work
1 2 3 4
Register Managed Domain
Create Admin Account Verify Domain OwnershipGenerate EMM API
Token
Google Domain Identity
Registration Process
Step 1: Admin enters basic business contact information
Step 2: Admin enters basic information about the business● Business name● Address● Number of Employees
1Registration of
Domain
Admin verifies Domain ownership
Option 1: Add meta tag to corporate homepage● Google verifies by scanning homepage
Option 2: Add a TXT or CNAME record to domain’s DNS● Google verifies by checking DNS records
Option 3: Add an HTML file to root of company’s website● Google verifies by scanning the company website
3Domain
Verification
● Generated for binding to customers’ EMM provider
● Enables Android for Work management via API’s
● Allows management of ONLY specific Managed Domain devices
4EMM Binding
Token
The IT admin can populate the managed accounts directly into managed domain:
Option 1: Delegate to EMM via Directory API’s
Option 2: Google Active Directory Sync
Authenticate accounts via enterprise SAML- based SSO (recommended) or password sync
Account Management
Searching for NAPPS?
http://openid.net/wg/napps/
not found atnapps.org!
● NAPPS can always work with system browser
● User experience can be improved: eliminate unnecessary app flips and browser pops
● Android for Work partners and product team working closely to define best practices
● Opportunity to leverage capabilities that already exist natively in Android OS
● Stay tuned for more!
“Native” NAPPS
● Multiple methods exist for IdP discovery (aka “tenant discovery”) with NAPPS, such as:
Non-managed: Smart Lock for Passwords
Managed: Android App Restrictions
● With managed profiles or devices, Android “app restrictions” can point to enterprise IdP
● App developer exposes app configuration schema specific to their app in manifest
● Play publishes restrictions for EMMs who set configurations via Android framework
IdP Discovery via App
Restrictions
EMM
App search & install
COMPANY
Mgmt front end / console
Business Customer signup for Android for Work
1. IT admin signs up for Android for Work through google.com/android/work/partners.
2. IT admin verifies domain ownership
3. IT admin enrolls Android for Work account with EMM
6. User installs EMM DPC app from Google Play
5. EMM sets which apps users have available.
8. User is signed in to their corp Google account.
4. Company synchronises user directory with Google auth. Optionally synchronises credentials or integrates SAML federated login to enable SSO.
GOOGLE AUTH
7. User follows setup wizard in EMM DPC app
APIs for mgmt and config
9. User browses for works apps to install in Work Play Store
EMM
APIs for mgmt and config
App catalog and delivery
COMPANY
Mgmt front end / console
App Management Flow
1. IT admin discovers apps through Google Play for Work
2. IT admin approves app and accepts permissions (free apps) in either Google Play for Work or EMM console. Purchases can only be made in Google Play for Work (paid apps).
3. IT admin push installs app or makes it available to users through the Play Store client app via the EMM Console
6. User installs approved apps from Play Store client and accepts permissions.
7. Admin pushes managed configuration to devices via EMM Console
5. User is signed in to their corp Google accounts.
4. Company synchronises user directory with Google auth. Optionally synchronises credentials or integrates SAML federated login to enable SSO.
GOOGLE AUTH
EMMSERVERCOMPANY
EMMCLIENT
YOUR APP
Publish config options
Present admin config UI Push config Push config to profile
Read app’s configoptions
Managed Configuration Flow
Recommended