Can I use a separate profile for corporate security requirements on KitKat?

Question

I tried adding my corporate Exchange user to my KitKat tablet, so I can sync email and calendar. The security policy page that came up states the admins in my company will be allowed to block my device, remotely erase it, change my password, etc. - if I accept the policy. Proceeding without accepting the policy is impossible (obviously).

Since this is a private device that I intend to use personally as well, my question is: can I create a separate user on the device, create the Exchange account under that user, accept whatever policy is required - but not have it applied to the entire device, only to that specific user profile? Or is a policy applied to one user applicable to the entire device?

Answer 1

No. You can only do what you describe on Samsung devices with their "KNOX" feature. This uses special security hardware to provide separate, isolated environments on your phone, so there's no way that information can leak from the "business" environment to the "personal" environment. It's present on their high-end phones since the Galaxy S3, and you can learn more on the official KNOX website.

A similar feature, but for all Android devices, is said to be coming in Android L, but it's not ready yet.

Normal user profiles on Android don't provide enough isolation for corporate security purposes. It's still possible for the profiles to share information, and for rogue apps with the right permissions to access data from all user profiles. If your device is stolen, it's still necessary to wipe the whole device to prevent an attacker getting access to the private data.