AND-801 Exam Guide: Android Enterprise and Intune Preparation
AND-801 is presented here as an Android enterprise administration exam, but the supplied official research does not include an exam blueprint, delivery specification, scoring model, prerequisites, or current status for this exam code. The available Microsoft material points to the practical knowledge most relevant to preparation: Android Enterprise enrollment choices, application deployment, work profiles, corporate-owned devices, conditional access, certificates, Wi-Fi authentication, and troubleshooting. Use this guide to decide whether your experience matches the subject area, what to study first, and which details must be confirmed with the official exam provider before scheduling.
What should AND-801 candidates verify before scheduling?
Confirm the official exam page before booking because the supplied evidence does not establish AND-801’s current delivery method, duration, question count, languages, price, passing score, prerequisites, or retirement status. Those details can change independently of the technical documentation.
The evidence supplied for this guide is Microsoft product documentation and Microsoft community material rather than an AND-801 exam outline. It supports a preparation focus on Android Enterprise administration in Microsoft Intune, but it does not prove that every topic below is tested or that any topic has a particular weighting.
Before making a scheduling decision, locate the current official AND-801 listing and check five items: the intended audience, measured skills, registration route, testing options, and policy requirements. Save the page or record its revision information so your study plan is based on the same version you use to schedule.
Who is the likely audience?
The subject matter suits administrators who configure Android devices for organizational use, choose between personal and corporate enrollment, publish managed applications, apply security controls, and investigate enrollment or connectivity problems. It is less suitable for a candidate whose experience is limited to writing Android applications or using OneNote on a phone.
Microsoft’s Intune guidance describes administrators evaluating Android Enterprise devices in an Intune environment. Its scenarios include onboarding to Google, application deployment, work profile enrollment, conditional access, the end-user enrollment experience, and work profile passcode resets. These are useful indicators of the operational audience for preparation, not a published AND-801 eligibility rule.
A strong candidate profile includes hands-on familiarity with device ownership decisions and policy effects. You should be able to explain why a personal device receives a work profile, why a kiosk device has no end user, and why a fully managed device is different from both. If those distinctions are unfamiliar, begin with architecture and enrollment rather than memorizing settings.
Match your experience to the exam’s apparent operating context
Use a simple experience check before committing to a study schedule. Can you map a business requirement to an enrollment mode? Can you predict which data remains personal? Can you identify whether a device is user-associated? Can you trace an application or Wi-Fi problem through policy, enrollment, and device behavior? Gaps in these answers identify your first study modules.
Which skills should the study plan measure?
Because no official AND-801 skills outline or domain percentages is supplied, do not treat the following areas as official domains or blueprint weights. Treat them as evidence-led study tracks derived from Microsoft’s Android Enterprise and Intune documentation, then compare them with the current official exam outline before finalizing your plan.
The first track is solution selection: distinguish BYOD work profiles, dedicated devices, and fully managed devices, and connect each choice to ownership, user association, application needs, and administrative control.
The second track is enrollment and Google connectivity: understand the administrative sequence for connecting Managed Google Play and recognize that enrollment design affects the features available later.
The third track is policy and application management: study managed applications, Wi-Fi and VPN profiles, certificates, password controls, copy and paste restrictions, camera and screen-capture controls, and factory-reset behavior as examples of policy outcomes.
The fourth track is identity and access: understand how conditional access and authentication settings fit into a managed Android deployment, including the privacy purpose of an anonymous identity in an outer authentication phase.
The fifth track is support analysis: read symptoms carefully, separate an enrollment issue from a policy limitation, and use official troubleshooting steps rather than assuming that every failure is caused by the device model or operating system.
How do the Android Enterprise enrollment models differ?
Choose the enrollment model from the organization’s ownership and usage requirement, not from the device brand. BYOD uses a work profile that separates company-managed work apps and data from the user’s personal profile; dedicated devices are usually kiosk-oriented and lack an associated end user; fully managed devices support a single user while retaining broad administrator control.
For BYOD, Microsoft states that the work profile is a separate, self-contained company-managed space. Personal apps and data remain in the personal profile, allowing the employee to continue using the device for personal purposes. Study this as a boundary and data-management concept, not merely as a sequence of enrollment screens.
Dedicated devices are generally locked to one app or a set of apps. The administrator can control elements such as the status bar, keyboard layouts, lock screen, and selected settings. These devices are enrolled without a user account and are not associated with an end user, so they are a poor fit for applications requiring user-specific account data such as Outlook or Gmail.
Fully managed devices fit a more user-centric corporate-owned scenario. One user is associated with the device, while the administrator retains full control. This differs from a work profile, where personal and work use coexist on the same device and the personal profile remains outside the managed work space.
A useful practice exercise is to classify four requirements without looking at documentation: an employee’s personal handset, a warehouse scanner running one workflow, a company phone assigned to one employee, and a shared kiosk. Explain both the chosen model and one model you rejected. The explanation matters more than the label.
What mistakes occur when choosing an enrollment model?
The most common conceptual mistake is treating all corporate-owned devices as interchangeable. Dedicated and fully managed enrollment serve different operational patterns. Another mistake is assuming that every application works equally well on a dedicated device; Microsoft specifically cautions that dedicated devices are not intended for personal-use applications or apps with strong user-account requirements.
A third mistake is planning policies before deciding ownership and user association. Microsoft notes that not all features are available across the enrollment methods. Build the device model first, then verify whether the required control is supported for that model. Do not promise a policy outcome merely because a similarly named setting exists elsewhere.
What should you learn about Managed Google Play?
Managed Google Play is part of the Android Enterprise administration workflow in Intune. The documented connection path is Devices, Android, Android Enrollment, and Managed Google Play, followed by accepting the agreement and launching Google to connect. Learn what this connection enables, then verify current interface labels before using them in a production procedure.
The administrative sequence is worth practicing because it tests dependency awareness: establish the Google connection, make applications available, assign or deploy them through Intune, and validate the result on a device using the selected enrollment model. Keep separate notes for configuration prerequisites, application availability, assignment, installation, and verification.
Do not confuse application deployment with general Android app installation. In an enterprise design, the important questions are which apps are approved, which users or devices receive them, whether the enrollment model supports the intended experience, and what happens when a device leaves management.
When troubleshooting a synchronization concern, record the observed state rather than jumping to a reset. For example, distinguish a stale synchronization indicator from an application assignment problem, an enrollment problem, or a device-side installation failure. The official Intune guide includes troubleshooting and FAQ material, so use it as the first reference for the documented scenario.
How should you study policy capabilities and limitations?
Study policy settings by comparing their business effect across work profile, dedicated, and fully managed enrollment. Microsoft’s comparison shows differences for managed email, Wi-Fi, VPN, certificate profiles, factory-reset prevention, camera and screen capture, volume buttons, data sharing, passwords, and applications. The key skill is recognizing a supported outcome rather than recalling an isolated menu.
Create a three-column matrix with the enrollment models across the top and policy capabilities down the side. Mark each capability only after checking the official table. Add a short operational consequence beside each mark, such as whether the control protects only the work space, applies to a kiosk experience, or affects the whole corporate-managed device.
Pay particular attention to destructive actions. The Intune guidance explains that a work-profile device may offer Retire, which removes the work profile and its contents, rather than a full factory reset. This is a practical distinction between removing company data and erasing a device, and it should shape both policy reasoning and support communication.
Also study version-dependent behavior carefully. Microsoft documents that the Android Enterprise work-profile feature is built into Android 5.1 and later versions, while a work-profile passcode reset condition is described for devices running Android 8.0+ when the passcode is managed and the user has allowed the reset. Keep these as exact documented conditions, not broad assumptions about every Android device.
How can policy questions be analyzed?
For every scenario, answer in this order: identify ownership, identify enrollment mode, identify the data or user experience that must be controlled, check whether the capability is available for that mode, and then select the least disruptive administrative action. This sequence prevents a familiar setting from overshadowing the device model and the requested outcome.
What should you know about Wi-Fi identity and certificates?
Android enterprise deployments can combine managed Wi-Fi settings with certificate and authentication choices. Prepare to reason from the authentication phase involved, the identity presented to the network, and the privacy objective. Do not reduce a connection failure to a username-and-password problem before checking the profile and authentication design.
The supplied Microsoft Q&A example concerns Android connecting to an NPS-based RADIUS corporate Wi-Fi service. It explains that an anonymous identity represents the outer identity and can prevent the real username from being exposed when authentication begins. The response points to enabling identity privacy and specifying an anonymous identity name, or leaving that field blank, in the relevant configuration.
Treat the Q&A as troubleshooting context, not as a complete AND-801 configuration standard. Community answers can address a particular symptom and may reference older documentation. For study, extract the reasoning: outer identity is about privacy during the first authentication phase, while successful access still depends on the complete authentication configuration and trusted certificates.
Use a lab worksheet with separate fields for network type, authentication method, outer or anonymous identity, certificate profile, inner authentication, and observed error. This makes it easier to identify whether a failure is caused by a missing field, a certificate trust problem, an incompatible authentication choice, or a policy that never reached the device.
How does troubleshooting fit into preparation?
Effective troubleshooting begins with scope and evidence. Record the enrollment model, device ownership, Android version, affected application or service, assigned profiles, and the first observable failure. Then reproduce the smallest relevant path. This approach is more reliable than changing several policies at once and losing the cause of the original symptom.
For mobile apps on Windows, Microsoft recommends restarting the Windows Subsystem for Android when problems occur, checking the specific app’s settings, and reviewing subsystem settings such as resources, graphics, and screen-reader options. That material is relevant only to the Windows mobile-app scenario; do not mix it indiscriminately with Android Enterprise device-management troubleshooting.
The Windows support page also states that Windows Subsystem for Android and the Amazon Appstore are not available in the Microsoft Store starting March 5, 2025. This is a product-support fact for that Windows scenario, not evidence about Android Enterprise enrollment or the AND-801 exam’s status. Keep platform boundaries explicit in your notes.
For Intune incidents, separate four layers: service onboarding, enrollment, policy assignment, and device behavior. A device can enroll successfully but fail to receive an application; an application can be assigned but fail to install; a Wi-Fi profile can arrive but fail authentication. Each layer requires different evidence and a different next check.
Which troubleshooting habits should you avoid?
Avoid copying a fix from a similar-looking issue without checking platform and enrollment context. Avoid treating a missing option as proof that the product is broken; the option may be unavailable for the selected enrollment method. Avoid changing identity, certificate, and network settings simultaneously. Finally, avoid using unofficial dumps as a substitute for diagnosing real configuration relationships.
What is an efficient study sequence?
Study in dependency order: first device ownership and enrollment models, then Google and application administration, then policy capability differences, then identity and access, and finally troubleshooting scenarios. This sequence reflects how an administrative decision constrains later configuration choices and reduces memorization of disconnected settings.
Start with the official Intune Android Enterprise guide and make a one-page model comparison. Do not highlight every sentence. Capture purpose, user association, personal-data boundary, likely application pattern, and administrative control for each enrollment model.
Next, trace the Managed Google Play connection and application lifecycle. Write the administrative actions in your own words, then annotate what must be true before an application can be deployed. Use the official page to correct your sequence rather than relying on a third-party walkthrough that may show a different interface.
Then build the capability matrix. Include managed email, Wi-Fi, VPN, SCEP, PKCS, trusted certificates, custom profiles, factory-reset controls, camera and screen capture, volume buttons, copy and paste, passwords, and managed applications. Verify each entry against the documented comparison and record the practical consequence.
After that, work through identity and access. Study conditional access as part of a broader managed deployment, then examine the RADIUS example for the difference between outer identity privacy and successful authentication. Keep configuration facts tied to their source and mark any unresolved implementation detail for official documentation review.
Finish with scenario review. For each scenario, state the requirement, enrollment model, relevant policy, expected boundary, evidence to collect, and safest next action. If your answer depends on an undocumented exam assumption, mark it as an assumption rather than converting it into a fact.
A practical four-phase roadmap
Phase one is orientation: confirm the current official AND-801 outline and assess your background. Phase two is architecture: master ownership, user association, work-profile boundaries, kiosk behavior, and fully managed control. Phase three is administration: practice Google connection, application deployment, policy comparison, certificates, Wi-Fi, and access decisions. Phase four is verification: solve scenarios from first principles, revisit weak areas, and confirm scheduling details immediately before booking.
Set a review checkpoint after each phase. You should be able to explain the subject without notes, identify the source for a factual claim, and name the uncertainty that still needs official confirmation. If you cannot explain why a policy applies or does not apply to a particular enrollment model, return to the comparison table rather than starting another practice set.
How should hands-on practice be organized?
Use a controlled lab or documented design exercise to test relationships, not to hunt for real exam questions. The lab should let you compare enrollment models, inspect work-profile separation, connect or review Managed Google Play administration, assign an application, examine policy results, and investigate a deliberate Wi-Fi or certificate failure.
Begin with a design brief. State whether the device is personal or corporate-owned, whether it is user-centric or kiosk-oriented, which applications are needed, and what data must remain separate. Choose the enrollment model before opening the administration console. This forces the same decision order used in real deployments.
For each change, record the expected result and the evidence that would confirm it. Examples include the presence of a work profile, an application assignment state, a received Wi-Fi profile, a certificate status, or the availability of a supported administrative action. Do not record only whether a button was clicked; record the policy effect.
Use failure injection carefully. Remove one dependency at a time, such as an assignment, certificate, or identity value, and predict the symptom before restoring it. The point is to learn diagnostic boundaries. Never use production devices or corporate data for experiments without authorization.
If you cannot run a lab, use a paper simulation. Draw the administrator, Google service, Intune, user, work profile, personal profile, application, certificate, and network as separate components. Walk a request from enrollment to policy delivery and then identify where a failure could occur. This is less powerful than hands-on work but still exposes gaps in system reasoning.
How can you tell whether you are ready?
Readiness should be demonstrated through explanation and diagnosis, not through recognition of memorized answer patterns. You are closer to ready when you can classify an unfamiliar scenario, justify the enrollment model, predict the data boundary, identify a supported control, and propose evidence-based troubleshooting steps without relying on a copied question.
Run a closed-book review using scenarios you write yourself. Include a BYOD work-profile case, a dedicated kiosk case, a fully managed corporate device, a Managed Google Play deployment issue, a work-profile removal request, and an Android RADIUS identity-privacy problem. After answering, use the official sources to check each factual statement.
Keep an error log with four fields: mistaken assumption, correct principle, supporting source, and prevention rule. A prevention rule might say “check enrollment mode before selecting a control” or “separate outer identity privacy from inner authentication.” Review the log at the start of every study session.
Do not use dumps, leaked questions, or memorization services as a measure of readiness. They cannot establish that you understand the product relationships, may contain obsolete or unauthorized material, and do not replace the official exam outline or legitimate practice. Prepare for scenarios and concepts, not for reproducing protected exam content.
What should you do in the final week?
Use the final study period to consolidate decisions rather than expand into unrelated Android topics. Recheck the official AND-801 page, review your enrollment comparison, revisit policy limitations, and solve a small set of original scenarios. Leave unresolved product-version questions clearly labeled so they do not become false certainties.
Review the Intune guide’s documented differences between work profile, dedicated, and fully managed devices. Rehearse the consequences of work-profile retirement, the conditions described for passcode reset, and the Managed Google Play connection path. Confirm every time-sensitive exam detail from the official registration source rather than from a study site.
Prepare a compact reference sheet containing definitions, decision rules, source links, and your error-log corrections. Do not turn it into a list of unexplained settings. If you cannot explain an entry, it is not yet useful revision material.
If your readiness depends on a delivery option, language, accommodation, or scheduling policy that the supplied research does not document, resolve that question with the official provider before paying or selecting a date. The correct next action may be further verification rather than immediate booking.
What are the next actions for an AND-801 candidate?
First, verify the current official AND-801 exam listing because exam-specific facts are absent from the supplied research. Second, compare its published skills with the Android Enterprise study tracks in this guide. Third, assess your enrollment and troubleshooting experience. Fourth, build a roadmap around your weakest dependency, and only then decide whether your preparation and scheduling plan are realistic.
Use Microsoft’s Intune documentation as the technical anchor for Android Enterprise concepts. Use the RADIUS Q&A only for the specific identity-privacy troubleshooting idea it documents, and use the Windows mobile-app page only when studying that separate Windows scenario. Source discipline prevents adjacent platform information from becoming misleading exam advice.
When you finish the first review cycle, write a short explanation of why BYOD, dedicated, and fully managed enrollment are not interchangeable. Add one policy-capability comparison and one troubleshooting flow. Those artifacts will reveal whether you understand the operating model or have merely collected terminology.
Finally, keep the decision boundary clear: official exam requirements come from the current exam provider, while the study sequencing and lab methods here are practical recommendations. Confirm the former, apply the latter selectively, and revise the plan whenever the official outline or product documentation changes.
Conclusion
The supplied evidence supports a focused preparation path around Android Enterprise administration in Intune: choose the right enrollment model, understand Google and application dependencies, compare policy capabilities, reason about identity and certificates, and troubleshoot by layer. It does not verify AND-801’s blueprint, weighting, delivery, or scheduling rules. Confirm those exam-specific details through the official provider, then use the documented product distinctions and scenario-based practice to make your preparation time purposeful.
Related exams
- AND-802 exam — Android Security Essentials
- AND-803 exam — Android Applications UI/UX Design and Monetization Techniques
