A company-owned work profile is a managed work container on a personal device that keeps business apps, data, and policies separate from private use. In IAM and NHI governance, it creates a distinct enterprise control boundary for access, enforcement, logging, and selective wiping without fully managing the employee’s device.
What the company-owned work profile does
A company-owned work profile is a containerised enterprise space on a personally used device. It lets organisations separate business apps, data, and policy enforcement from personal use while preserving a narrower privacy boundary than full device management.
That separation matters because the work profile becomes the enforceable zone for corporate controls, including app distribution, conditional access, logging, and selective wipe. It also reduces the blast radius of corporate actions, since the employer can remove work data without fully taking over the device.
Why the boundary matters for access and data control
The value of a work profile is not just convenience, it is control scope. Instead of treating the entire device as enterprise-owned, IT can apply governance to the work container and leave the personal side outside routine administration. That makes it a practical compromise for BYOD programs that still need enforceable policy boundaries.
In practice, the profile is often used to keep authentication artefacts, managed apps, and business data separated from consumer apps and personal storage. BYOD Policy Template is a useful reference when defining where that boundary starts, what gets enrolled, and when selective wipe is allowed.
How it is used on Android-managed estates
On Android, the work profile is one of the main ways organisations support modern BYOD management without requiring full-device control. The device can remain personally owned while the work side is governed by enterprise policy, app separation, and security posture checks.
That model is usually implemented through Android Enterprise tooling rather than older device-admin approaches. Android Enterprise Security Guide explains how work profiles fit alongside managed configurations, and Mobile Device Security Guide places them in the broader mobile security lifecycle of enrolment, compliance, and selective wipe.
Operational trade-offs and lifecycle implications
A company-owned work profile gives organisations a cleaner way to enforce business requirements, but it also introduces a governance decision: what belongs in the managed container, what stays on the personal side, and how much visibility the organisation actually needs. The answer affects enrolment design, offboarding, audit logging, and incident handling.
This model is strongest when the business needs protected app access and data separation more than it needs total device control. UEM Buyer's Guide is relevant when evaluating whether work profiles, MDM, or a broader endpoint platform is the right operating model for the estate.
Risk and Threat Considerations
Company-owned work profiles reduce exposure, but they do not eliminate it. The main risks are stale corporate data on a personal device, weak separation between work and personal behaviour, and incomplete removal of business access when a user leaves or a device is lost.
Failure mechanism: If the work profile is misconfigured, bypassed, or not selectively wiped at offboarding, business apps, cached tokens, and managed data can remain accessible on a device the organisation no longer controls.
Impact: That can lead to unauthorised access, data exposure, and a persistence path for corporate accounts, especially when mobile authentication material or app sessions remain valid after separation should have ended.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-19 — Access Control for Mobile Devices | Defines mobile-device access control boundaries that include personally owned devices used for work. |
| IA-5 — Authenticator Management | Covers lifecycle handling for tokens and other authenticators used inside the managed work container. | |
| Recommendation — Apply AC-19 to govern enterprise access on personally owned mobile devices. Manage and revoke authenticators used by the work profile under IA-5. | ||
| ISO/IEC 27001:2022 | A.8.1 — User endpoint devices | Addresses security requirements for endpoint devices that host the managed work profile. |
| Recommendation — Define endpoint device controls that cover work-profile-capable personal devices. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Supports standardised mobile configuration, separation, and policy enforcement on managed endpoints. |
| Recommendation — Standardise mobile configuration baselines for work-profile deployment and enforcement. | ||
| NIST CSF 2.0 | PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | Applies because the work profile depends on controlled enterprise access and revocation paths. |
| Recommendation — Issue, audit, and revoke work-profile access credentials under PR.AA-01. | ||
Practitioner Guidance
Governance implication: Treat the work profile as a distinct control boundary, not just a mobile convenience feature. Ownership should be clear for enrolment rules, app approval, selective wipe criteria, and the conditions under which work data may be removed from a personal device.
Practitioner note: The design choice is usually about balance, not absolutism. If an organisation needs stronger enforcement than a container can provide, it should move to a fuller managed-device model rather than trying to make the work profile do every job.
Related resources from NHI Mgmt Group
- What happens when a company-owned Android device is enrolled without the right work profile controls?
- Why does remote work increase identity risk even when the company has VPNs?
- Who is accountable when a company-owned device goes missing after offboarding?
- Who is accountable when a company scopes the wrong SOC 2 criteria for its risk profile?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org