Before users can access apps in an Android for Work profile, IT has to have already encrypted their devices. Then, employees must download the Device Policy Client, which creates the work profile after they confirm their passcode and enter their Google account information. Once it's activated, the work profile forces users to download apps from the Google Play Store instead of from rogue sites, and admins can curate a list of acceptable apps users can install.
On any Android device running Lollipop 5.0 or later or the Android for Work app, or where IT provisions apps through Google Play for Work, admins can use work profiles to take a variety of actions. Those capabilities include creating or deleting data from the work profile, managing access to the corporate mail server, changing an account password, and installing or removing apps.