Implementing Device Management

This section describes how to enable and validate device management features required to prepare devices for managed profiles. It also covers device owner user cases that are essential in a corporate environment.

In addition to AOSP code, a device requires the following components to function with managed profiles.

General requirements

Devices intending to support device management must meet the following general requirements.

Thermal HAL values

Android 7.0 and later includes support for HardwarePropertiesManager API, a device monitoring and health reporting API that enables applications to query the state of device hardware. This API is exposed via android.os.HardwarePropertiesManager and makes calls through HardwarePropertiesManagerService to the hardware thermal HAL (hardware/libhardware/include/hardware/thermal.h). It is a protected API, meaning only device/profile owner Device Policy Controller (DPC) applications and the current VrListenerService can call it.

To support the HardwarePropertiesManager API, the device thermal HAL implementation must be able to report the following values:

Value Reporting Scale Enables
Temperature of [CPU|GPU|Battery|Device Skin] Temperature of component in degrees Celsius Apps can check device temperatures and component throttling/shutdown temperatures
CPU active/total enabled times Time in milliseconds Apps can check CPU usage per core
Fan speed RPM Apps can check fan speed

Implementations should correctly handle reporting values situations when a core (or GPU, battery, fan) goes offline or is plugged/unplugged.

Enabling device management

To enable device management, ensure the following uses-features are declared:

  • (feature is declared if and only if the device has at least 2 GB of memory.)

To confirm these uses-feature values have been declared on a device, run: adb shell pm list features.

Essential apps only

By default, only applications essential for correct operation of the profile are enabled as part of provisioning a managed device. Keep in mind, all example instances of _managed_profile.xml files below are only relevant if is declared. OEMs must ensure the managed profile or device has all required applications by modifying:

 * The following are for Android 9 and higher only

Required and disallowed apps for managed users are applied to secondary users created via DevicePolicyManager#createAndManageUser.

Examples from a Nexus device

Android 8.x and earlier


Android 9 and higher

  <!-- A list of apps to be retained on the managed device -->
  <string-array name="vendor_required_apps_managed_device">
    <item></item> <!--­Google Play -->
    <item></item> <!--­Required by Play -->
    <item></item> <!--­Google or OEM Contacts­-->
    <item></item> <!--­Google Launcher -->
    <item></item> <!--­Google Launcher or OEM Launcher -->
    <item></item> <!--­Google or OEM dialer to enable making phone calls -->

Android 8.x and earlier


Android 9 and higher

    <!-- A list of apps to be retained in the managed profile. This includes any Google experience apps required. -->
    <string-array name="vendor_required_apps_managed_profile">
        <item></item> <!-- Google Play -->
        <item></item> <!-- Required by Play -->
        <item></item> <!-- Google or OEM Contacts -->

Launcher requirements

You must update the Launcher to support badging applications with the icon badge (provided in AOSP to represent the managed applications) and other badge user interface elements such as recents and notifications. If you use launcher3 in AOSP without modifications, then you likely already support this badging feature.

NFC requirements

Devices with NFC must enable NFC during the out-of-the-box experience (i.e., setup wizard) and be configured to accept managed provisioning intents:

<bool name="enable_nfc_provisioning">true</bool>

Setup requirements

Devices that include an out-of-box experience (i.e., setup wizard) should implement device owner provisioning. When the out-of-box experience opens, it should check if another process (such as device owner provisioning) has already finished the user setup and, if so, it should fire a home intent and finish the setup. This intent is caught by the provisioning application, which then hands control to the newly-set device owner.

To meet setup requirements, add the following code to the device setup's main activity:

   protected void onStart() {

        // When returning to a setup wizard activity, check to see if another setup process
        // has intervened and, if so, complete an orderly exit
        boolean completed = Settings.Secure.getInt(getContentResolver(),
                Settings.Secure.USER_SETUP_COMPLETE, 0) != 0;
        if (completed) {
           startActivity(new Intent(Intent.ACTION_MAIN, null)
                        | Intent.FLAG_ACTIVITY_CLEAR_TASK
                        | Intent.FLAG_ACTIVITY_RESET_TASK_IF_NEEDED));