Otukan enrols each device through the path that fits who owns it and which platform it runs. Corporate-owned devices enrol at setup with full administrator control. Personally owned devices get a separated work area that protects the user’s privacy. Single-purpose devices enrol into a dedicated mode. On Android, Otukan uses Android Enterprise; on iPhone and iPad, Apple’s device management framework, each with its own steps and powers. Devices bought through supported channels join management at first boot, rollouts run in tested stages, and failed enrolments are flagged and recovered.
Eligibility
Otukan sorts your fleet by ownership and purpose, then maps each group to the enrolment mode its platform provides.
| Device group | Android (Android Enterprise) | iOS and iPadOS (Apple device management) |
|---|---|---|
| Corporate-owned, one user | Fully managed device | Supervised device through Automated Device Enrollment |
| Corporate-owned, personal use allowed | Work profile on a company-owned device | Supervised device, with policy written to allow personal use |
| Personally owned | Work profile | User Enrollment |
| Shared or single-purpose | Dedicated device | Supervised device with Single App Mode or Shared iPad, where applicable |
The rows are not equivalents across columns. Each platform decides what an administrator can see and change in each mode. An Android work profile and Apple User Enrollment both separate work from personal data, for example, but they restrict different settings and expose different inventory. Otukan configures each on its own terms.
Provisioning channels
Otukan enrols corporate-owned devices in bulk, so a device joins management the first time it is switched on.
- Android. Zero-touch enrolment for devices bought through participating resellers, a QR code scanned during setup, or other provisioning methods the device and OS version allow.
- iOS and iPadOS. Automated Device Enrollment, which links devices bought through Apple or participating resellers to your Apple Business Manager or Apple School Manager account.
Devices bought outside these channels can still be added, and Otukan sets out the manual route that each platform provides for them.
Prerequisites
Enrolment runs smoothly when everything is in place before the first device is switched on. Otukan prepares each item with you, per platform, and gives it a named owner.
- Accounts. The organisation’s account with the platform owner: for Android, the Android Enterprise binding through a managed Google account or domain; for Apple devices, Apple Business Manager or Apple School Manager.
- Certificates and tokens. For Apple devices, the push certificate used for management and the token linking Apple Business Manager to Otukan, both with renewal dates and a named owner.
- Permissions. Which administrators can create enrolment profiles, assign devices and approve apps.
- Reset state. Which devices must be reset before enrolment, and how user data is backed up first.
- Network. Wi-Fi or mobile data during setup, and firewall rules that let devices reach the platform services and the management server.
Renewal dates matter. An expired Apple push certificate can stop management communication with enrolled Apple devices until it is renewed, and renewing it under a different Apple account can force devices to re-enrol. Otukan tracks these dates and records which account owns each credential, so renewal is routine.
Rollout
Otukan runs enrolment as a staged rollout with clear assignment rules and a recovery path for every device.
Policy assignment
Each device is placed in a group by enrolment profile, serial number, directory group or location, and the group decides its policy and apps. Otukan tests the rules on a pilot that includes each device model and OS version you run, and confirms on the device, not only in the console, that the expected policy and apps arrived.
The rollout then widens one group or site at a time. Each stage is confirmed before the next begins, so an assignment mistake stays small and is corrected quickly.
Failed-enrolment recovery
Otukan flags devices that start enrolment but do not report back. Typical causes are no network during setup, a device missing from the provisioning channel, an expired certificate or token, or a skipped step. The agreed recovery then runs: who is told, who may reset the device, whether the reset is remote or on site, and a fresh enrolment into the same group. Every failure and recovery is logged, so recurring causes are fixed at the source.
For device settings after enrolment, see mobile device policy management. Moving devices from another management service is covered on MDM migration. The parent overview is mobile device management. Delivering and withdrawing user credentials is covered on identity and access.