Reviewed and updated in October 2026.
Users access company data from smartphones, tablets and laptops wherever they work. A UEM solution keeps those devices and their data secure, but Apple, Google and Samsung also provide their own services and tools for deploying, managing and protecting their devices. Here is what each offers and how they differ.
In short: Apple, Google and Samsung each provide free enrollment portals and management frameworks that a UEM builds on. Apple Business with Automated Device Enrollment and supervision covers iPhone, iPad and Mac; Android Enterprise with zero-touch enrollment covers Android devices from all major manufacturers; Samsung Knox adds Knox Mobile Enrollment and extra security policies for Samsung devices. Your UEM uses these frameworks to enroll devices out of the box, separate work from personal data and enforce policies.
Apple offers organizations, both businesses and schools, several tools to deploy and configure iPhone and iPad (and Mac) devices and to keep them secure.
Introduced with iOS 5, supervision gives administrators extended control over company-owned devices. Many restrictions are available only on supervised devices, for example disabling the App Store or limiting which apps may be used. Supervision is not enabled by default and can only be set up when a device is activated, after a reset or on first use: wirelessly through Automated Device Enrollment, or with Apple Configurator on a Mac.
For years, Apple Business Manager was the free web portal that combined the former Device Enrollment Program (DEP) and Volume Purchase Program (VPP). On 14 April 2026, Apple replaced Apple Business Manager, Apple Business Essentials and Apple Business Connect with Apple Business, a free platform that also includes built-in device management. The core functions for enterprises remain:
Introduced with iOS 13, User Enrollment is designed for Bring Your Own Device (BYOD) programs. It gives the organization the management functions it needs while protecting the user's privacy by separating work and personal data and apps. Since iOS 15, users enroll by signing in with a Managed Apple Account (formerly Managed Apple ID) provided by their organization, in the VPN & Device Management section of Settings, without downloading a UEM agent first. According to Apple's notes on what's new for enterprise in iOS 18, the older profile-based User Enrollment is no longer supported.
For the current state of Apple device management, including the move of software updates to declarative device management, read iOS 27 for Enterprise. Where it all started is covered in New iOS 15 Enterprise Features.
Android's challenge for enterprise management has always been fragmentation: many manufacturers and many OS variants make it hard to give all employees a similar experience, enforce the same policies and deploy work apps. A common framework was needed that works regardless of brand.
Android Enterprise is Google's free framework for using Android devices and apps at work. It simplifies the enrollment of personally owned (BYOD) and company-owned devices and creates a dedicated work profile in which work apps and data are stored securely and separately from the rest of the device. Apps, both public and in-house, are distributed through managed Google Play, where administrators decide which apps may be installed in the work profile and whether they are installed manually or silently. Android Enterprise is activated during enrollment with a UEM. Google has deprecated the older Device Admin API in favor of Android Enterprise; what that means for your fleet is covered in Are You Ready for the Future of Android Device Management?
Comparable to Automated Device Enrollment on Apple devices, zero-touch enrollment is a free portal for rolling out company-owned Android devices running Android 8.0 or later. Devices registered in the portal enroll with the assigned UEM the first time they are switched on, with little or no user interaction. Eligible devices must be bought from a zero-touch reseller or Google partner, not from a consumer store. Samsung devices are supported as well; Google advises against configuring zero-touch and Knox Mobile Enrollment on the same device, because the two configurations can get out of sync.
What changes with each Android release is covered in our series on Android for enterprise, most recently Android 17 for Enterprise.
Samsung Knox is a proprietary security framework built on hardware security features of Samsung devices. It gives organizations additional tools to manage and, above all, secure work devices. Knox Suite combines several products for deploying, configuring and securing company devices, among them the following.
Comparable to Automated Device Enrollment or zero-touch, Knox Mobile Enrollment is a free portal for rolling out company-owned Samsung devices. Devices registered in KME enroll with the assigned UEM the first time they are switched on, with little or no user interaction. Devices are added by Samsung-approved resellers in the Knox Deployment Program.
Combined with Android Enterprise, Knox Platform for Enterprise adds policies, restrictions and security features beyond standard Android Enterprise. Its role is comparable to supervision on Apple devices.
Knox Manage is Samsung's own cloud-based EMM. It is designed to make full use of the additional management and security capabilities of Knox devices and is integrated with other Knox cloud services such as KME and Knox E-FOTA. It requires a paid license.
Knox Enterprise Firmware Over-The-Air (E-FOTA) lets organizations control which OS version runs on their Samsung devices and deploy OS and security updates without user interaction. Security patches can be rolled out on schedule, while new OS versions can first be tested, for example for compatibility with in-house apps, and blocked until they are approved. Knox E-FOTA is licensed and can be configured from supported UEM solutions.
Knox Asset Intelligence is a cloud service for selected Samsung devices that provides analytics to improve the management, productivity and lifecycle of work devices: battery health, app usage, Wi-Fi connectivity problems and device location.
Knox Suite also includes Knox Remote Support, Knox Capture and Knox Authentication Manager.
| Apple | Android Enterprise | Samsung Knox | |
|---|---|---|---|
| Out-of-the-box enrollment | Automated Device Enrollment in Apple Business | Zero-touch enrollment | Knox Mobile Enrollment (or zero-touch) |
| Extended control of company devices | Supervision | Fully managed device | Knox Platform for Enterprise |
| BYOD separation | User Enrollment with Managed Apple Account | Work profile | Work profile plus KPE policies |
| App distribution | Apps and Books | Managed Google Play | Managed Google Play |
| OS update control | Declarative device management | UEM update policies | Knox E-FOTA |
These portals assign devices to a management solution and enroll them automatically; the policies themselves come from the UEM. Apple Business now includes built-in device management, but organizations with mixed fleets typically manage Apple, Android and Windows devices from one UEM.
Apple replaced Apple Business Manager, Apple Business Essentials and Apple Business Connect with Apple Business on 14 April 2026. Automated Device Enrollment and Apps and Books continue as part of Apple Business.
Yes. Samsung devices support both zero-touch and Knox Mobile Enrollment. Google recommends configuring only one of the two for a given device.
The closest equivalent is a fully managed device under Android Enterprise. On Samsung devices, Knox Platform for Enterprise adds further policies.
This is a small glimpse of what Apple, Android Enterprise and Samsung Knox make possible. Choosing the right enrollment method and management mode for each device group is the basis for any UEM rollout. If you also manage connectivity, read Demystifying Technology: Embedded SIM (eSIM); for BYOD without device management, see Virtualization Beyond Servers.
ISEC7 offers workshops on Apple Enterprise Mobility Fundamentals, Android Enterprise Fundamentals and Samsung Knox Fundamentals, including integration with major UEM solutions such as BlackBerry UEM, Ivanti EPMM and Omnissa Workspace ONE UEM. Our team also supports endpoint management projects end to end. Contact us with any questions.