A device maker should evaluate management for its own fleet by asking whether it can tell every internal device class apart, protect units that carry unreleased products, and keep one unbroken record for a device that is wiped and reflashed many times. Otukan manages the devices an OEM owns and uses itself: engineering test units, demonstration devices and staff phones. Each class has its own owner, policy and exit, and partners get limited, time-bound access. Android devices are managed through Android Enterprise and staff Apple devices through Apple’s framework. Offering management to the OEM’s customers is a separate service.
Fleet scope
An OEM’s internal fleet is unusual. Many of its devices run software no customer has seen, move between labs, offices and events, and are rebuilt more often than they are used.
Device classes and ownership
| Device class | Who owns it internally | What it runs | Main concern |
|---|---|---|---|
| Engineering test units | Engineering or quality teams | Pre-release and release builds | Tracking units through constant reflashing |
| Demonstration devices | Sales and marketing | Release or pre-announcement builds | Loans, events and returns |
| Staff devices | IT | Released builds, or other makers’ devices | Everyday security and privacy |
All three belong to the company, but they need different rules. A test unit can be locked down and wiped at will. A staff phone that allows personal use needs a separated work area and respect for the employee’s own data.
Enrolment and operating systems
Test units running builds with Google Mobile Services can use the Android Enterprise enrolment paths that depend on them. Builds without those services need a route agreed with engineering, which Otukan confirms on the OEM’s hardware. Staff iPhones and iPads enrol through Apple’s framework as their own class. None of these routes is treated as a copy of another.
Operating model
An internal fleet has more stakeholders than most, and they want different things.
Policy authority
Product security decides how pre-release devices are protected. Engineering decides what test units must be able to do, such as installing unsigned test builds or enabling developer options. IT sets rules for staff devices. Otukan gives each group a console role scoped to its own device class, so a change made for the lab stays inside the lab’s device class.
Integrations
Internal fleets connect to the OEM’s identity directory for staff sign-in and to its asset register for serial numbers and ownership. Otukan exchanges device records with those systems in the direction the OEM chooses, so one register holds the truth about each unit.
Owned versus partner functions
| Function | Owned by the OEM | Performed by partners under a limited role |
|---|---|---|
| Deciding which units exist and who holds them | Yes | – |
| Building and flashing test units | Engineering | ODM engineers, for their assigned devices |
| Certification and compatibility testing | Product security oversight | External test labs, for a set period |
| Shipping units to events and offices | Logistics owner | Logistics firms, with no device access |
Partner access in Otukan names the device groups and the dates. When the engagement ends, the access ends with it.
Lifecycle
The named workflow here is a pre-release test unit: the device class that carries the most risk.
- Provisioning. The unit is registered by serial number and enrolled into the pre-release group, with restrictions set by product security.
- Change. Each reflash with a new build is expected. The unit re-enrols into its previous group, and its record carries the new build alongside the old ones.
- Recovery. A unit that fails to re-enrol, stops checking in or appears on an unapproved network is flagged. Administrators can lock it with a return message or wipe it.
- Offboarding. At the end of a programme, the unit is wiped, released from its enrolment registration and recorded as retired, reassigned or destroyed.
Because every stage is tied to the serial number, product security can answer a simple question at any time: where is each unit that carries an unannounced product, and who holds it? Demonstration and staff devices follow the same four stages with their own rules, such as loan return dates for demonstration units and a user’s own exit process for staff phones.
For management the OEM offers to its customers, see OEM mobile device management. Firmware-level protection for the same devices is covered on device security for device manufacturers. The wider set of scenarios is on use cases.