1 page.title=Provisioning for Device Administration 2 @jd:body 3 4 <!-- 5 Copyright 2015 The Android Open Source Project 6 7 Licensed under the Apache License, Version 2.0 (the "License"); 8 you may not use this file except in compliance with the License. 9 You may obtain a copy of the License at 10 11 http://www.apache.org/licenses/LICENSE-2.0 12 13 Unless required by applicable law or agreed to in writing, software 14 distributed under the License is distributed on an "AS IS" BASIS, 15 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 See the License for the specific language governing permissions and 17 limitations under the License. 18 --> 19 <div id="qv-wrapper"> 20 <div id="qv"> 21 <h2>In this document</h2> 22 <ol id="auto-toc"> 23 </ol> 24 </div> 25 </div> 26 27 <p>This page describes the process for deploying devices to corporate users 28 using NFC or with an activation code (for a complete list of requirements, see 29 <a href="{@docRoot}devices/tech/admin/implement.html">Implementing Device 30 Administration</a>).</p> 31 32 <p>To get started, download the 33 <a href="https://github.com/googlesamples/android-NfcProvisioning">NfcProvisioning 34 APK</a> 35 and 36 <a href="https://github.com/googlesamples/android-DeviceOwner">Android-DeviceOwner 37 APK</a>. 38 </p> 39 40 <p class="caution"><strong>Caution:</strong> If provisioning has already 41 started, affected devices must be factory reset first.</p> 42 43 <h2 id=managed_provisioning>Managed provisioning</h2> 44 45 <p>Managed Provisioning is a framework UI flow to ensure users are adequately 46 informed of the implications of setting a device owner or managed profile. It is 47 designed to act as a setup wizard for managed profiles.</p> 48 49 <p class="note"><strong>Note:</strong> The device owner can be set only from an 50 unprovisioned device. If <code>Settings.Secure.USER_SETUP_COMPLETE</code> has 51 ever been set, the device is considered provisioned and the device owner cannot 52 be set.</p> 53 54 <p>Devices that enable default encryption offer a considerably simpler and 55 quicker device administration provisioning flow. The managed provisioning 56 component:</p> 57 58 <ul> 59 <li>Encrypts the device</li> 60 <li>Creates the managed profile</li> 61 <li>Disables non-required applications</li> 62 <li>Sets the enterprise mobility management (EMM) app as profile owner</li> 63 </ul> 64 65 <p>In turn, the EMM app:</p> 66 67 <ul> 68 <li>Adds user accounts</li> 69 <li>Enforces device compliance</li> 70 <li>Enables any additional system applications</li> 71 </ul> 72 73 <p>In this flow, managed provisioning triggers device encryption. The framework 74 copies the EMM app into the managed profile as part of managed provisioning. The 75 instance of the EMM app inside of the managed profile gets a callback from the 76 framework when provisioning is done. The EMM can then add accounts and enforce 77 policies; it then calls <code>setProfileEnabled()</code>, which makes the 78 launcher icons visible.</p> 79 80 <h2 id=profile_owner_provisioning>Profile owner provisioning</h2> 81 82 <p>Profile owner provisioning assumes the user of the device (and not a company 83 IT department) oversees device management. To enable profile owner provisioning, 84 you must send an intent with appropriate extras. For an example, use the TestDPC 85 application 86 (<a href="https://play.google.com/store/apps/details?id=com.afwsamples.testdpc&hl=en">Download 87 from Google Play</a> or <a href="https://github.com/googlesamples/android-testdpc/">Build 88 from GitHub</a>). Install TestDPC on the device, launch the app from the 89 launcher, then follow the app instructions. Provisioning is complete when badged 90 icons appear in the launcher drawer.</p> 91 92 <p>Mobile Device Management (MDM) applications trigger the creation of the 93 managed profile by sending an intent with action: 94 <a href="https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/app/admin/DevicePolicyManager.java">DevicePolicyManager.ACTION_PROVISION_MANAGED_PROFILE</a> 95 . Below is a sample intent that triggers the creation of the managed profile 96 and sets the DeviceAdminSample as the profile owner:</p> 97 98 <pre>adb shell am start -a android.app.action.PROVISION_MANAGED_PROFILE \ 99 -c android.intent.category.DEFAULT \ 100 -e wifiSsid $(printf '%q' \"WifiSSID\") \ 101 -e deviceAdminPackage "com.google.android.deviceadminsample" \ 102 -e android.app.extra.deviceAdminPackageName $(printf '%q' 103 .DeviceAdminSample\$DeviceAdminSampleReceiver) \ 104 -e android.app.extra.DEFAULT_MANAGED_PROFILE_NAME "My Organisation" 105 </pre> 106 107 <h2 id=device_owner_provisioning_via_nfc>Device owner provisioning</h2> 108 <p>Use one of the following methods to set up device owner (DO) 109 provisioning.</p> 110 111 <h3 id=do_provision_nfc>Provisioning via NFC</h3> 112 <p>DO provisioning via NFC is similar to the profile owner method but requires 113 more bootstrapping. To use this method, 114 <a href="http://developer.android.com/guide/topics/connectivity/nfc/nfc.html">NFC 115 bump</a> the device during the initial setup step (i.e., first page of the setup 116 wizard). This low-touch flow configures Wi-Fi, installs the DPC, and sets the 117 DPC as device owner.</p> 118 119 <p>A typical NFC bundle includes the following:</p> 120 121 <pre> 122 EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME 123 EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_LOCATION 124 EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM 125 EXTRA_PROVISIONING_WIFI_SSID 126 EXTRA_PROVISIONING_WIFI_SECURITY_TYPE 127 </pre> 128 129 <p>Devices must have NFC configured to accept the managed provisioning 130 mimetype from the setup experience:</p> 131 132 <pre>/packages/apps/Nfc/res/values/provisioning.xml 133 134 <bool name="enable_nfc_provisioning">true</bool> 135 <item>application/com.android.managedprovisioning</item> 136 </pre> 137 138 <h3 id=do_provision_cs>Provisioning via Cloud Services</h2> 139 <p>Device owner provisioning via cloud services includes the ability to 140 provision a device in device owner mode during out-of-the-box setup. The device 141 can collect credentials (or tokens) and use them to perform a lookup to a cloud 142 service, which can then be used to initiate the device owner provisioning 143 process.</p> 144 145 <h2 id=emm_benefits>EMM benefits</h2> 146 147 <p>An enterprise mobility management (EMM) app can help by conducting the 148 following tasks:</p> 149 150 <ul> 151 <li>Provision managed profile</li> 152 <li>Apply security policies 153 <ul> 154 <li>Set password complexity</li> 155 <li>Lockdowns: disable screenshots, sharing from managed profile, etc.</li> 156 </ul></li> 157 <li>Configure enterprise connectivity 158 <ul> 159 <li>Use WifiEnterpriseConfig to configure corporate Wi-Fi</li> 160 <li>Configure VPN on the device</li> 161 <li>Use <code>DPM.setApplicationRestrictions()</code> to configure corporate 162 VPN</li> 163 </ul></li> 164 <li>Enable corporate app Single Sign-On (SSO) 165 <ul> 166 <li>Install desired corporate apps 167 <li>Use <code>DPM.installKeyPair()</code> to silently install corp client 168 certs</li> 169 <li>Use <code>DPM.setApplicationRestrictions()</code> to configure 170 hostnames, cert alias of corporate apps</li> 171 </ul></li> 172 </ul> 173 174 <p>Managed provisioning is just one part of the EMM end-to-end workflow, with 175 the end goal of making corporate data accessible to apps in the managed 176 profile. For testing guidance, see 177 <a href="{@docRoot}devices/tech/admin/testing-setup.html">Setting up Device 178 Testing</a>.</p> 179 180 <h2 id=automate>Automated provisioning testing</h2> 181 <p>To automate the testing of enterprise provisioning processes, use 182 the Android for Work (AfW) Test Harness. For details, see 183 <a href="{@docRoot}devices/tech/admin/testing-provision.html">Testing Device 184 Provisioning</a>.</p> 185
