Outlook for Android and Cross-Profile Switching Experience Improvements in Android Enterprise

[Ross Smith IV]

Security conscious organizations look at ways to ensure corporate data on mobile devices are protected. One method used to protect that data is through device enrollment. Device enrollment enables organizations to deploy compliance policies (PIN strength, jailbreak/root validation, etc.), as well as configuration policies (WiFi, certificates, VPN, etc.). Device enrollment also enables organizations to manage app lifecycle.

In Android 2.2, Google introduced support for device management with the device administrator API. Since that time, organizational needs have changed, as mobile devices continue to contain and access more sensitive data. These needs include separation of work and personal data, kiosk management, app configuration, and app distribution, to name a few. The device administrator API was not designed to handle these scenarios.

With Android 5.0, Google introduced a new management profile with the introduction of managed device (device owner) and work profile (profile owner) modes (what is collectively known as Android Enterprise now). As the functionality in Android Enterprise has continued to evolve, Google announced decreasing support for device administrator. For more information on Microsoft Endpoint Manager’s plans, see:

• Decreasing support for Android device administrator
• Move Android devices from device administrator to work profile management

Android offers Android Enterprise work profile as an enrollment model for personally-owned devices, where IT wants to provide a clear separate boundary between work and personal data. As organizations transition from device administrator to work profile for personally-owned devices, users may experience confusion or frustration that there are now separate app instances for work and personal use.

To address this concern, Android introduced the CrossProfileApps API in Android 9. This API allows an app to recognize when it has a corresponding instance in the work or personal profile. Using this API, an app may expose an in-app user experience to end users, allowing them to switch to the cross-profile instance without having to back out to the app launcher and tap the other app icon’s instance.

Outlook and the CrossProfileApps API

The first Microsoft app to take advantage of the CrossProfileApps API is Outlook for Android. This feature is slowly rolling out this month and requires a minimum build of 4.2039.0 with Android 9 or later. Users can leverage this functionality from within the left-hand navigation menu. When launching Outlook in the personal profile, users will see a work profile switcher button (highlighted by the red square) in the left-hand navigation account switcher section:

Switch to work profile

With Outlook in the work profile, users will see a personal profile switcher button (highlighted by the red square) in the left-hand navigation account switcher section:

Switch to personal profile

When the user taps the work or personal profile switcher button, they will be switched to the relevant instance of Outlook:

Cross-Profile switching experience

We are also releasing a teaching moment to educate users on this functionality, for example:

Work Profile teaching moment

It is important to note that this functionality only works if the user is using the same app in both profiles. Users using Gmail in their personal profile, for example, cannot use the CrossProfileApps API to switch to Outlook in the work profile.

We hope your users will find this improvement useful. If you have any questions, please let us know.

Ross Smith IV
Principal Program Manager
Customer Experience Engineering

[Raj Kumar]

Sir, the major concern now is, how to have or configure 2 different Organisations AE profile.. User who is working from A company and supporting B, both org migrated to Android for Enterprise but user can enroll their device in only one organization.. Users are frustrated that they cannot access both at same device. Anything in roadmap?

[Ross Smith IV]

Hey @Raj Kumar, there's nothing we can do here, unfortunately. This is a platform limitation (for both iOS, Android, and Windows) where a device can only be enrolled in a single tenant at any one time. Moving one organization to leverage App Protection Policies without enrollment would also help in this scenario, but that may not be possible.   

[Jonathan Blackwell]

Other than using the OS profile API, is this really fundamentally different in terms of user experience from just having multiple accounts?

[wroot]

@Jonathan Blackwelli think the key here is that you don't have to go back to home and to non-work app drawer to run Outlook to open your personal account or vice versa and you can switch just inside the Outlook itself. I guess this is similar to switching accounts, but you can't add personal account to work profile (i think) and you can't have a unified Inbox in this case. So it is not exactly like having two accounts in one Outlook profile. This is two Outlook profiles, just switching between them in one UI.

[Ross Smith IV]

@Jonathan Blackwell / @wroot This is different than having multiple accounts within Outlook. Like Oleg mentioned, this simply simplifies the manual steps you may have had to do before (switch back to home, launch app drawer, switch to the profile, launch app -or- switch back to home and choose the personal or work profile app on the home screen). This functionality simply switches between the work and personal profile instances of the app.

You could add a personal account into Outlook in the work profile if the admin hasn't enabled org allowed accounts mode. Hopefully, admins are enabling that to limit what data is stored in the work profile.