Otukan lets a device maker offer management to its downstream customers as part of what it sells. Each customer gets its own tenant, with its own administrators, policies and data. The OEM’s staff get a defined, logged view across tenants for support. Devices can be registered for zero-touch enrolment, so they join management at first boot, when the customer switches them on. Licensing, support and customer exit are agreed up front, with a named owner for the life of the devices. This covers OEMs that build Android devices with Google Mobile Services, managed through Android Enterprise, on terms agreed with each OEM.
Commercial roles
Otukan supports both ways an OEM uses device management, and keeps them apart.
| Internal fleet use | Downstream management for customers | |
|---|---|---|
| Who owns the devices | The OEM | The OEM’s customers |
| Who administers them | OEM staff | Customer administrators, with OEM support where agreed |
| Whose data is held | The OEM’s | Each customer’s, with the OEM’s data protection role set by contract and applicable law |
| What is agreed | Use for the OEM’s own operations | The terms on which the OEM offers management to third parties |
| Main focus | Operational control | Clear obligations to each customer |
Internal fleets include test devices, demonstration units and devices issued to staff. Downstream management means the OEM’s customers, such as a retailer or a logistics firm buying rugged handhelds, receive devices that are ready to be managed. Many OEMs do both, and Otukan keeps the two under separate agreements.
For the OEM, downstream management turns a hardware sale into an ongoing service relationship. Customers get devices that are ready for their own policies on day one, and the OEM stays close to how its devices perform in the field. For the customer, it removes a separate procurement and a separate onboarding project.
Mixed fleets
A customer buying the OEM’s Android devices may also run iPhones or iPads. Otukan manages Apple devices through Apple’s own framework, with its own enrolment and policy rules, as a separate scope from anything agreed for the OEM’s Android devices.
Technical boundary
Otukan defines exactly what the OEM can brand, configure and see.
- Branding. Agreed parts of the console, enrolment screens and customer communications carry the OEM’s name.
- Tenants. One tenant per customer, with its own administrators, policies and data, which keeps data requests and exit simple.
- OEM administration scope. What OEM staff may do across tenants, such as creating tenants or viewing device health for support, is set per customer and logged.
- Provisioning. Devices are registered for zero-touch enrolment through the reseller channel, preloaded with apps in the system image by the OEM, or enrolled by the customer after delivery.
- Model coverage. Otukan confirms management behaviour on each model and Android version you ship, since it can vary even within one maker’s range.
- Google services. Devices with Google Mobile Services can use the Android Enterprise features that depend on them, such as managed Google Play and zero-touch enrolment. Devices built on the Android Open Source Project without Google Mobile Services work differently, and Otukan agrees their management approach with the OEM separately.
Firmware-level protection is a separate Otukan product. Where an OEM also wants protection below the operating system, see mobile device security.
Lifecycle
Downstream management lasts as long as the devices do. Otukan agrees an owner for each duty below in every customer arrangement.
| Duty | What is agreed |
|---|---|
| Licensing | Who holds the licence for each device, and whether it moves with the device if resold |
| First-line support | Who customer administrators contact, and for what |
| Escalation | How management service issues pass from the OEM to Otukan |
| Updates | How management behaviour is checked on each model when a new Android release arrives |
| Customer exit | How a customer’s devices are released from zero-touch registration and management, and how its data is exported and deleted |
| End of support | What happens to managed devices when a model reaches end of support |
Customer exit gets particular care, because it is where the OEM’s and the customer’s interests can diverge. A device whose zero-touch configuration still points to the OEM’s tenant re-enrols there after a reset, which would block a customer that wants to move. Otukan tracks registrations per customer and releases devices on the process written into the customer agreement.
The MDM requirements checklist lists the questions Otukan answers in writing for each OEM. The parent overview is mobile device management.