Android device management checklist for small business

Print this page and work through it once, then keep the last section for your monthly routine. Each item says what to do and why. Where NounDesk has a feature or a docs page for the step, it is linked.

This checklist assumes company-owned Android phones or tablets. For personal phones, see work profile and BYOD.

1. Before you buy phones

• Buy phones running Android 8 or newer, and prefer recent models. Older versions miss settings and stop getting security updates sooner. See supported devices.
• Ask the seller if they are an authorized zero-touch reseller. Phones bought that way can enroll themselves the first time they are switched on. See zero-touch enrollment.
• Check how long the model will receive security updates. A cheap phone that stops getting patches next year costs more in the end.
• Decide who owns which phone, and write it down. Assigned phones are easier to recover and offboard than a pile of shared ones.
• Create or choose one business Google account for device management. Google does not accept personal Gmail for this. See which Google account do I need?
• Write a one-page phone policy and share it with staff. People accept management more easily when they know what it can and cannot see. Template: a simple company phone policy.

2. Enrollment day

• Try demo mode first if you have never used device management. A sample fleet of ten devices shows every screen before you touch a real phone. See demo mode.
• Connect your Google account to NounDesk once. This links your company to Android Enterprise. See connect Google.
• Create device groups by team, site or role. Groups let one policy follow a set of phones. See groups and employees.
• Save an enrollment profile for each group. A profile fixes group, policy and naming so every phone comes out the same. See enrollment profiles.
• Enroll one phone end to end before the rest. Fix any surprise once instead of on every phone.
• Factory-reset each phone and have Wi-Fi ready. QR enrollment starts at the welcome screen and needs a network. See enrollment.
• Scan the QR code and watch the status reach “Ready”. Live status shows exactly where a phone is stuck. See enrollment troubleshooting.
• Assign each phone to an employee. You need to know who to call when a phone goes quiet. See employees.
• Label the phone physically with a name or asset number. It should match the device name in the dashboard.

3. Security policy

• Start from a template. Standard Business suits most office and sales phones; Field Worker suits technicians; Maximum Security suits phones with sensitive data. See security policies.
• Require a screen lock and set auto-lock. A lost unlocked phone is an open door.
• Block apps from outside Google Play. Most Android malware arrives as a file, not from the store.
• Keep Google Play Protect always on. It scans apps for known harmful behavior.
• Set a system update window. Updates install overnight instead of during a job. See updates.
• Add up to 10 trusted admin accounts for factory reset protection. A stolen, reset phone then stays locked to your company. See factory reset protection.
• Push your office Wi-Fi in the policy. Staff never need the password. See network settings.
• Turn on data protection for phones that hold customer data. Blocking screenshots, printing and USB drives stops the accidental leaks. See data protection.
• Read the publish preview before you publish. It lists what changes and how many devices are affected. See policy versions.

The full security list is in the small business Android security checklist.

4. Apps

• Add every work app as Required. It installs by itself with no Google sign-in by the employee. See app management.
• Mark optional apps as Available. Staff can install them from the managed store if they need them.
• Block apps that cause trouble. Games and personal social apps are the usual list. See how to stop employees installing apps.
• Set a minimum version for apps that must be current. Outdated phones then show in the app compliance view. See app compliance.
• Publish your own company app privately if you have one. Only your devices can see it. See private apps.
• Arrange what staff see in the store. A short, ordered list saves support questions. See managed Google Play.

5. Kiosks and shared tablets

• Use the Kiosk template for single-purpose devices. Check-in tablets, tills and scanners should run one job. See kiosk mode.
• Choose single-app or multi-app, then the Home button behavior. Fewer exits means fewer “the tablet is on YouTube” calls.
• Turn on stay-awake and set brightness. A dark screen on a counter looks broken.
• Lock volume and settings access. Customers and students will find them otherwise.
• Use a web app from a URL if your kiosk is a website. No separate app needed.
• Check kiosk health after rollout. Each kiosk shows whether it is running as set. See kiosk management.

6. Lost or stolen phone

• Agree who staff report a lost phone to, and how fast. The first hour matters most. See employee lost a work phone?
• Turn on lost mode with a message and a phone number. Most lost phones are found by honest people who need a way to return them. See lost-device recovery.
• Check the location only while the phone is in lost mode. NounDesk collects location only then, by design. See lost devices.
• Erase the phone if it is not coming back. Keep factory reset protection ticked so the thief cannot set it up. See remote actions.
• End lost mode when the phone is found. The phone then returns to normal use.

7. Employee leaves

• Collect the phone on the last day. Recovering it later is much harder. See an employee quit and kept the phone.
• Deactivate the employee and choose what happens to their phone. Keep it unassigned, reassign it, retire it or erase it. Nothing happens automatically. See retire and offboard.
• Erase before handing the phone to someone new. The new person starts clean. See how to wipe a company phone.
• Remove their NounDesk access if they had a role. Former staff should not keep admin rights. See team and roles.
• Retire phones you will not use again. Retired phones stop counting toward your bill.

8. Monthly routine (about 15 minutes)

• Open the dashboard and check fleet health. Healthy, Needs attention or Critical tells you where to look. See dashboard.
• Follow up on phones offline for 24 hours or more. Offline phones miss policies and updates. See device status.
• Check patch age in reports. Phones with security updates over 90 days old are at risk. See reports.
• Review Device Trust ratings. At risk and Not trusted phones list the reason and the fix. See Device Trust.
• Clear open alerts. Acknowledge or resolve each one so real problems stand out. See alerts.
• Look through the audit log. Make sure every erase and policy change was expected. See reports and audit log.
• Check who has admin access. Remove anyone who no longer needs it. See invite admins.
• Check the Android versions report. Plan to replace phones that no longer get updates. See supported devices.
• Check unassigned phones. Reassign or retire them so none go missing quietly.

Where to go next

For setup step by step, follow the setup guide. If you are still choosing a tool, read how to choose an Android MDM. NounDesk is $1.50 per device per month with every feature included; see pricing.