Part 1 walked through the four management profiles[cite: 2]. Now, let’s talk about how you actually get a phone into one of them[cite: 2]. Android offers five real enrollment paths, and they aren’t one-size-fits-all[cite: 2]. Pick the wrong one for your setup, and you’ll easily turn a quick five-minute unboxing into an entire afternoon of manual tweaking per phone[cite: 2].
Play Store / QR Code Enrollment (BYOD)
This is the simplest setup and the main route built for personal devices[cite: 2]. The employee downloads the Intune Company Portal app straight from the Play Store, signs in, and Android Enterprise builds the work profile automatically[cite: 2]. No pre-configuration or admin handling required — just a policy stating “if this user enrolls, give them a work profile[cite: 2].”
There’s also a QR code option using an AET token (Android Enterprise Token) for company-owned devices[cite: 2]. Instead of searching the Play Store, the user scans a QR code during the initial setup screen to trigger enrollment[cite: 2]. It’s super handy for Fully Managed or COPE devices when you want a low-touch setup without shipping pre-configured hardware[cite: 2].
NFC “Bump” Enrollment
With this method, you tap a pre-configured NFC device against a reset Android phone during setup to push the configuration instantly[cite: 2]. Honestly, it’s mostly legacy tech at this point — almost everyone has shifted to Zero Touch or Knox for corporate fleets — though you still see it in niche setups or older hardware[cite: 2]. Unless you’re already locked into it, skip it; the newer options are far better[cite: 2].
Zero Touch Enrollment
We’ll cover this in depth in Part 3, but here’s the quick version: hardware bought through an authorized reseller gets pre-registered to your org at purchase[cite: 2]. The minute the device boots up, it automatically pulls down your provisioning profile[cite: 2]. No QR codes, no NFC bumps, and zero hands-on IT setup[cite: 2]. This is the method built for scaling — it turns “IT manually sets up every single phone” into “ship the phone straight to the user[cite: 2].”
Knox Mobile Enrollment (KME)
Think of this as Samsung’s answer to Zero Touch, built specifically for Samsung hardware[cite: 2]. If your fleet is heavily Samsung, KME gives you that same hands-off provisioning through Samsung’s Knox platform[cite: 2]. You don’t have to choose just one, either: plenty of teams run Zero Touch for standard Android hardware and save KME for Samsung devices to unlock extra Knox-specific controls[cite: 2].
Matching Method to Profile
| Enrollment Method | Best For |
|---|---|
| Play Store / QR (personal) | BYOD Work Profile[cite: 2] |
| QR with AET token | Corporate-owned, low volume[cite: 2] |
| NFC | Legacy — avoid for new setups[cite: 2] |
| Zero Touch | Corporate-owned, any volume (especially larger fleets)[cite: 2] |
| Knox Mobile Enrollment | Samsung corporate-owned fleets[cite: 2] |
The Practical Takeaway
The most common trap in smaller IT shops is defaulting to QR/token enrollment for corporate phones simply because it’s the first method in the docs — only to realize 40 phones later how much time Zero Touch would have saved[cite: 2]. If you’re buying company hardware in bulk, get Zero Touch (or Knox for Samsung) configured before the boxes land on your desk[cite: 2]. That small bit of upfront setup pays off instantly[cite: 2].
Coming up in Part 3: a deep dive into Zero Touch — breaking down the portal, how reseller sync works, and what your provisioning profile actually handles[cite: 2].
References