Android App Distribution via Managed Google Play
Managed Google Play — corporate Google Play integrated with Android Enterprise. Unlike public Play Store, apps are visible only to devices connected to corporate EMM (Enterprise Mobility Management). This is the correct way to distribute corporate Android apps: no sideload, no INSTALL_UNKNOWN_APPS, with centralized management and auto-updates.
Architecture: EMM, Work Profile, Managed Google Play
Android Enterprise provides several device management scenarios:
Work Profile (BYOD) — isolated work profile created on employee's personal device. Corporate apps install here and don't access personal data. Managed Google Play shows only corporate apps in work profile.
Fully Managed Device (COBO) — organization fully manages device, no personal profile. All apps go through Managed Google Play.
Dedicated Device (COSU) — device works in kiosk mode. Only one or several predetermined apps.
EMM platforms: Microsoft Intune, Jamf Pro, VMware Workspace ONE, Google Workspace (with built-in basic EMM), Cisco Meraki, Sophos Mobile. Managed Google Play integrates with any via Google Play EMM API.
Publishing App to Managed Google Play
Two paths: public App Store app added to corporate catalog, and private app — visible only to your organization.
For private app: in Play Console select app type as "Private", specify organization via Enterprise ID. App passes simplified check (not full App Review like public apps), but Play Protect still scans APK/AAB.
Private apps update like public ones — via versionCode. EMM system gets new version notification and either auto-installs or offers update depending on policy.
Setup via Google Play EMM API
Organization registers in Android Enterprise via EMM console or directly via play.google.com/work. After registration appears Enterprise ID — unique identifier linking Managed Google Play to EMM.
Devices connect via two ways: Zero-touch enrollment (for devices from authorized resellers — config applied on first boot) and QR code / NFC token for already-purchased devices.
Managed configuration (App Restrictions) — ability to pass config parameters to app via EMM without user input. App reads via RestrictionsManager.getApplicationRestrictions(). Allows pre-setting corporate API server, SSO credentials, or security settings without user involvement.
Typical Issues
App doesn't appear in Managed Google Play after adding to corporate catalog — usually device hasn't synced with EMM. Force sync via EMM command solves issue.
App update doesn't apply on devices — EMM policy may require user confirmation or delay update until Wi-Fi. Check auto-update policy in EMM console.
Work Profile doesn't create on device — device may not support Android Enterprise (rare on modern devices, happens on budget Android Go models).
Managed Google Play setup from scratch — two to five working days.