Wednesday, 8 April 2015
If you work in an office environment, you probably know a few people—maybe a lot of people—with two smartphones. One is a personal phone full of pictures of the family, games, social networking, and sports stuff, and the other is a company-issued smartphone full of e-mail, appointments, contacts, and documents. With two phones, your IT department has full control over your work data and can remotely wipe it, and they never get to see your personal pictures or other information. It's a workable setup, but the downside is all the duplication—you have two phones, two chargers, and almost no free pocket space. The other alternative is BYOD—Bring Your Own Device—in which the IT department takes over and installs a bunch of company software to your personal phone.
There is a better way, though, and it's called a "dual-persona smartphone"—a way to have separate work and personal data on a single device. Blackberry was the first to have it baked into the OS in BB10, but in terms of OSes that users actually want to use, it's been left up to often-clunky third-party solutions.
With Android 5.0, Google laid the groundwork for dual-persona support right in the OS with "managed profile" APIs, and now there's a more complete solution from the company called "Android for Work."
Work and personal apps, all in a unified interface
There are multiple ways to do a dual-persona smartphone. Android supports multiple users, so one clunky way to get separate work and personal data would be to just make two users: "Personal user" and "Work user." You'd have separate apps, data, icon layouts, wallpapers, media—basically separate everything. You'd have to log in and out of accounts all the time to view notifications and use apps, though. No one really wants that much separation.
Blackberry 10's dual-persona mode—called "BlackBerry Balance"—used a "spaces" interface, which was kind of like a virtual desktop for phones. You could bring up a menu and press either the "work" or "personal" button, and you would then be whisked away to a separate desktop with a new wallpaper and apps. When you were in one space, you wouldn't see notifications from the other space. This seemed like basically the two-user approach, but instead of having to log in and out, you could just switch users.
Android for Work does things a little differently. While it uses Android's multi-user framework to securely separate work and personal profiles, there is no switching users. Everything lives on a single, unified interface. Through Google Apps and the Google Apps Device Policy app, it takes a personal device and adds an additional work profile that your company owns.
You can have two copies of apps on the single home screen—one personal and one for work, with the work apps denoted by a little red badge. Other than the badges, the apps are identical to personal apps most are already familiar with. Gmail still looks just like Gmail; now it simply has a company-owned user account on it.
You can, of course, arrange the Android home screen icons anyway you want. However, Work apps show up last in the app drawer (after all your personal stuff). We've never once wanted sorting options in the app drawer other than "alphabetical," but now we're thinking some people will dislike the "work apps are last" sorting.
Notifications for each account come in and stack in your notification panel just like anything else. Like apps, work notifications are separate from personal ones, again marked with that little red briefcase badge. Overview separates everything too, allowing users to quickly jump between work and personal Gmail if they want.
Android for Work even adds a profile switcher to the share dialog so users can pick which account they want the shared item to go to.
The project is built on technology from a May 2014 acquisition of a company called "Divide," which made one of the best dual-persona enterprise apps for Android and iOS. There are, of course, limits to what an app can do, so Google brought the feature down to the OS level, allowing for a better integration with Android and the Play Store. Android for Work was announced at Google I/O 2014, where Google also said Samsung would be contributing code from Knox, its enterprise mobility solution, to the project. Apparently something happened between now and then because no Samsung-contributed code was used in Android for Work.
Android still doesn't have a ton of ways to lock a device down, which will stop high-security organizations from switching to Android for Work. Google Apps Device Policy is used to lock down the OS, but the list of available policies is pretty limited—it's mostly password requirements, forcing device encryption, and disabling the camera. There's nothing to stop someone from copying text from the work profile and pasting it into their personal Gmail, for instance. So for now, Google is aiming at companies that don't need ultra-high security.
Correction: There actually is a checkbox to lock down copy/paste across profiles! You can disable the "share" functionality, too.
Setup is a Byzantine nightmare
Since Android 5.0 came out four months ago, you may be wondering why we're only now looking at this feature. It's not just the OS that needs to support Android for Work; you need a compatible Enterprise Mobility Management (EMM) solution. There are a number ofcompatible partners, but for our case, we're going all-Google and using Google Apps for Work—the business-focused version of Google's Web apps that works with a custom domain. Making Google Apps (or some other EMM provider) a requirement means that you'll have to pay a monthly fee ($5 per user for Google Apps) to use Android for Work.
.
Getting to the point where Android for work was actually usable was a long process. Google announced that Android was "ready for work" on February 25, it announced the required Google Apps compatibility a week later, and everything actually started working about another week after that.
To get setup, we'll first need to dive into one of the most complicated, confusing, unintuitive interfaces Google has ever birthed: The Google Apps Dashboard. While a lot of the documentation falls back on the old cop-out of "contact your administrator," Google Apps is marketed toward small businesses. Theoretically, a normal person should be able to do this—I am the administrator in this test setup.
The gallery above shows off the setup process. Basically, after adding Android for Work as a "service" to Google Apps, it takes a bunch of Android for Work settings and scatters them across the various dashboard sections. Then it's up to the user to go on a scavenger hunt and discover all the newly added Android for Work setup sections that have been hidden in various nooks and crannies in the dashboard. If you haven't guessed from the size of the gallery, setup is a really awful experience.
Android for Work desperately needs either its own page full of all the settings or a setup wizard. Right now you have to visit three different sections and copy/paste a security code from one section of Google Apps to another just to set up Android for Work. Throughout it all, there is never any on-screen guidance about what you should be doing next. Over and over again, I was left asking "What do I do now?" when trying get through the setup.
To be fair, in a large business this process would be taken care of by IT and, at most, only the sign in steps would be up to the user. Does all "enterprise" software come with some kind of requirement that it be needlessly complicated, though?
Adding an app to your work profile
Out of the box, Android for Work comes with five work apps: Contacts, Device Policy, Downloads, Google Settings, and Play Store. You can add any app you want (or at least, any app your company wants) to your work profile, though. Eventually, adding an app to your work profile is done just like it is on the personal side—you go to the Play Store. You don't use the regular Play Store, however; you go to—brace for one of the worst product names ever—"Google Play for Work."
At first, Google Play for work is blank—it displays zero apps. Apps must first be approved and whitelisted by the administrator through the Google Apps Dashboard, and then they'll be available for work users.
This is yet another process that seems more complicated than it should be. First, administrators have to go to Google Play for Work on a desktop browser (https://play.google.com/work/), find the app, and approve the permissions. Next, they have to go to the Google Apps dashboard to whitelist the app, which includes copying the Google Play URL and pasting it into the Dashboard. Then the users have to go to the Play Store on their phone and proceed as normal.
This makes sense when you consider that this works with a bunch of different EMM providers. Android for Work is in its own little world, and Google Apps is in its own little world. The two services don't talk to each other on their own—it's up to the administrator to be the middle man.
.
The work profile works with every app as long as it is free. Paid apps need to specifically support Android for Work by adding "bulk ordering" support, which allows admins to buy however many copies of the app they need for their organization.
We would love to dig more into how this works, but we couldn't find a single paid app that supports bulk ordering. Other than a single mention in a YouTube video, we couldn't find any developer documents on how to enable an app for bulk ordering, either.
Quitting the company and revoking data—an amicable divorce
If you're in a BYOD situation, leaving the company is often a messy proposition. With no separation of personal and work data, it often means the company nukes your entire phone remotely. The other alternative is to hand your personal phone over to an IT person who can try to surgically remove the work data while not messing up your personal stuff.
Android for Work allows an account to be removed just as easily as it is added. The administrator can remotely wipe an account in the Google Apps Dashboard, the signal is pushed to the phone, and all of the work data is removed. Because Android multi-user framework keeps everything separate, none of the personal data is harmed and all of the work data is wiped.
Dual-persona seems ready for prime time
These are still early days for the program, but Android for Work looks like the slickest dual-persona solution we’ve seen yet (its terrible setup notwithstanding). Since it's built-in at the OS level and leverages Android's multi-user framework, everything worked the way we wanted and expected it to. That makes Android for Work very easy to explain: all of your work data and all of your personal data is kept separate, displayed in a unified interface, and easily un-unified. Everything just works.
The biggest downside to the program right now is the lack of paid apps, which are supported (or at least support is coming very soon), but no one seems to have signed up for inclusion. Hopefully, all developers have to do is check an easy opt-in box and maybe approve some new developer agreement. We think this is something that will be solved fairly quickly once more people get word of Android for Work.
There's more to come from Android for Work as well. At I/O 2014, Google promised bulk deployment of apps, which we haven't seen yet. For now, the program requires Android 5.0 and up, but eventually there issupposed to be an app that brings support to Android 4.0 and up, which would cover over 90 percent of active devices.
The only missing feature we'd like to see is a quiet time for the work notifications. It's easy to turn off a Blackberry in the evening and play some games on your smartphone, but Android for Work offers no such way to "clock out" of the work environment, nor does it offer a "serious mode" that will shut up your Facebook notifications so that you can get some work done.
Other than that, the interface Google went with feels like the perfect blend of separating personal and work data while still making them easy to access. For the user, Android for Work is the kind of slickly integrated experience that can only come from an OS-level feature. For administrators, as long as you can manage the setup process, it's a great way to securely get your apps on the users' device and easily take them off.
Android for Work makes a dual-persona smartphone finally feel like something that isn't a clunky hack. If you're still carrying around one phone for work and one for home, it's time to save some pocket space. Bug your IT department to roll this feature out.
