Android management modes: device administrator vs work profile vs fully managed vs dedicated vs AOSP

Verdict: Device administrator is deprecated for GMS devices. Dedicated is the shared or kiosk mode and the only one supporting unattended Remote Help. AOSP is for devices without Google Mobile Services. Use OEMConfig, not custom OMA-URI, on Android Enterprise.

Criterion	Device administrator	Personal work profile	Fully managed	Dedicated	AOSP
Ownership and use	Legacy per-device	BYOD personal	Corporate single-user	Corporate shared or kiosk	Corporate, no GMS
Status	Deprecated for GMS devices	Current	Current	Current	Current (userless or user-associated)
Notable capability	None (migrate off)	Work data isolation	Full corporate control	Unattended Remote Help	Teams Rooms on Android and panels

Rules

Android device administrator management is deprecated and no longer available for devices with Google Mobile Services; migrate to an Android Enterprise method.
Custom OMA-URI profiles do not support Android Enterprise; deliver OEM settings through OEMConfig, which reads a vendor schema from a Google Play app.
Unattended Remote Help access, where the helper connects without the user accepting each time, requires the device enrolled as an Android Enterprise dedicated device.
Android FOTA update management applies to fully managed, dedicated, and corporate-owned work profile (COPE) enrollment types via a device restrictions profile.
AOSP corporate-owned devices without Google Mobile Services enrol as userless (shared) or user-associated (single user).
Teams Rooms on Android, Teams phones and Teams panels enrol through AOSP Device Management and, unlike Teams Rooms on Windows, support OS version minimum and maximum compliance.

Traps

A fully managed device with an assigned primary user is single-user; unattended Remote Help is documented only for dedicated devices.
The Custom profile type supports Android device administrator, iOS/iPadOS, macOS and Windows, not Android Enterprise.