In this document
This page describes the process for deploying devices to corporate users using NFC or via cloud services (for a complete list of requirements, see Implementing Device Administration).
Caution: If provisioning has already started, affected devices must be factory reset first.
Managed Provisioning is a framework UI flow to ensure users are adequately informed of the implications of setting a device owner or managed profile. It is designed to act as a setup wizard for managed profiles.
Note: The device owner can be set only from an
unprovisioned device. If
ever been set, the device is considered provisioned and the device owner cannot
Devices that enable default encryption offer a considerably simpler and quicker device administration provisioning flow. The managed provisioning component:
- Encrypts the device
- Creates the managed profile
- Disables non-required applications
- Sets the enterprise mobility management (EMM) app as profile owner
In turn, the EMM app:
- Adds user accounts
- Enforces device compliance
- Enables any additional system applications
In this flow, managed provisioning triggers device encryption. The framework
copies the EMM app into the managed profile as part of managed provisioning. The
instance of the EMM app inside of the managed profile gets a callback from the
framework when provisioning is done. The EMM can then add accounts and enforce
policies; it then calls
setProfileEnabled(), which makes the
launcher icons visible.
Profile owner provisioning
Profile owner provisioning assumes the user of the device (and not a company IT department) oversees device management. To enable profile owner provisioning, you must send an intent with appropriate extras. For an example, use the TestDPC application (Download from Google Play or Build from GitHub). Install TestDPC on the device, launch the app from the launcher, then follow the app instructions. Provisioning is complete when badged icons appear in the launcher drawer.
Mobile Device Management (MDM) applications trigger the creation of the managed profile by sending an intent with action: DevicePolicyManager.ACTION_PROVISION_MANAGED_PROFILE . Below is a sample intent that triggers the creation of the managed profile and sets the DeviceAdminSample as the profile owner:
adb shell am start -a android.app.action.PROVISION_MANAGED_PROFILE \ -c android.intent.category.DEFAULT \ -e wifiSsid $(printf '%q' \"WifiSSID\") \ -e deviceAdminPackage "com.google.android.deviceadminsample" \ -e android.app.extra.deviceAdminPackageName $(printf '%q' .DeviceAdminSample\$DeviceAdminSampleReceiver) \ -e android.app.extra.DEFAULT_MANAGED_PROFILE_NAME "My Organisation"
Device owner provisioning
Use one of the following methods to set up device owner (DO) provisioning.
Provisioning via NFC
DO provisioning via NFC is similar to the profile owner method but requires more bootstrapping. To use this method, NFC bump the device during the initial setup step (i.e., first page of the setup wizard). This low-touch flow configures Wi-Fi, installs the DPC, and sets the DPC as device owner.
A typical NFC bundle includes the following:
EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_LOCATION EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM EXTRA_PROVISIONING_WIFI_SSID EXTRA_PROVISIONING_WIFI_SECURITY_TYPE
Devices must have NFC configured to accept the managed provisioning mimetype from the setup experience:
/packages/apps/Nfc/res/values/provisioning.xml <bool name="enable_nfc_provisioning">true</bool> <item>application/com.android.managedprovisioning</item>
Provisioning via Cloud Services
Device owner provisioning via cloud services is another method through which a device can be provisioned in device owner mode during out-of-the-box setup. The device can collect credentials (or tokens) and use them to perform a lookup to a cloud service, which can then be used to initiate the device owner provisioning process.
An enterprise mobility management (EMM) app can help by conducting the following tasks:
- Provision managed profile
- Apply security policies
- Set password complexity
- Lockdowns: disable screenshots, sharing from managed profile, etc.
- Configure enterprise connectivity
- Use WifiEnterpriseConfig to configure corporate Wi-Fi
- Configure VPN on the device
DPM.setApplicationRestrictions()to configure corporate VPN
- Enable corporate app Single Sign-On (SSO)
- Install desired corporate apps
DPM.installKeyPair()to silently install corp client certs
DPM.setApplicationRestrictions()to configure hostnames, cert alias’ of corporate apps
Managed provisioning is just one part of the EMM end-to-end workflow, with the end goal of making corporate data accessible to apps in the managed profile. For testing guidance, see Setting up Device Testing.
Automated provisioning testing
To automate the testing of enterprise provisioning processes, use the Android for Work (AfW) Test Harness. For details, see Testing Device Provisioning.