This page describes the process for deploying devices to corporate users using NFC or via cloud services (for a complete list of requirements, see Implementing Device Administration).

To get started, download the NfcProvisioning APK and Android-DeviceOwner APK.

Caution: If provisioning has already started, affected devices must be factory reset first.

Managed provisioning

Managed Provisioning is a framework UI flow to ensure users are adequately informed of the implications of setting a device owner or managed profile. It is designed to act as a setup wizard for managed profiles.

Note: The device owner can be set only from an unprovisioned device. If Settings.Secure.USER_SETUP_COMPLETE has ever been set, the device is considered provisioned and the device owner cannot be set.

Devices that enable default encryption offer a considerably simpler and quicker device administration provisioning flow. The managed provisioning component:

• Encrypts the device
• Creates the managed profile
• Disables non-required applications
• Sets the enterprise mobility management (EMM) app as profile owner

In turn, the EMM app:

• Adds user accounts
• Enforces device compliance
• Enables any additional system applications

In this flow, managed provisioning triggers device encryption. The framework copies the EMM app into the managed profile as part of managed provisioning. The instance of the EMM app inside of the managed profile gets a callback from the framework when provisioning is done. The EMM can then add accounts and enforce policies; it then calls setProfileEnabled(), which makes the launcher icons visible.

Profile owner provisioning

Profile owner provisioning assumes the user of the device (and not a company IT department) oversees device management. To enable profile owner provisioning, you must send an intent with appropriate extras. For an example, use the TestDPC application (Download from Google Play or Build from GitHub). Install TestDPC on the device, launch the app from the launcher, then follow the app instructions. Provisioning is complete when badged icons appear in the launcher drawer.

Mobile Device Management (MDM) applications trigger the creation of the managed profile by sending an intent with action: DevicePolicyManager.ACTION_PROVISION_MANAGED_PROFILE . Below is a sample intent that triggers the creation of the managed profile and sets the DeviceAdminSample as the profile owner:

adb shell am start -a android.app.action.PROVISION_MANAGED_PROFILE \
          -c android.intent.category.DEFAULT \
	      -e wifiSsid $(printf '%q' \"WifiSSID\") \
          -e deviceAdminPackage "com.google.android.deviceadminsample" \
	      -e android.app.extra.deviceAdminPackageName $(printf '%q'
                        .DeviceAdminSample\$DeviceAdminSampleReceiver) \
              -e android.app.extra.DEFAULT_MANAGED_PROFILE_NAME "My Organisation"

Device owner provisioning

Use one of the following methods to set up device owner (DO) provisioning.

Provisioning via NFC

DO provisioning via NFC is similar to the profile owner method but requires more bootstrapping. To use this method, NFC bump the device during the initial setup step (i.e., first page of the setup wizard). This low-touch flow configures Wi-Fi, installs the DPC, and sets the DPC as device owner.

A typical NFC bundle includes the following:

                EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME
                EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_LOCATION
                EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM
                EXTRA_PROVISIONING_WIFI_SSID
                EXTRA_PROVISIONING_WIFI_SECURITY_TYPE

Devices must have NFC configured to accept the managed provisioning mimetype from the setup experience:

/packages/apps/Nfc/res/values/provisioning.xml

      <bool name="enable_nfc_provisioning">true</bool>
      <item>application/com.android.managedprovisioning</item>

Provisioning via Cloud Services

Device owner provisioning via cloud services is another method through which a device can be provisioned in device owner mode during out-of-the-box setup. The device can collect credentials (or tokens) and use them to perform a lookup to a cloud service, which can then be used to initiate the device owner provisioning process.

EMM benefits

An enterprise mobility management (EMM) app can help by conducting the following tasks:

• Provision managed profile
• Apply security policies
  • Set password complexity
  • Lockdowns: disable screenshots, sharing from managed profile, etc.
• Configure enterprise connectivity
  • Use WifiEnterpriseConfig to configure corporate Wi-Fi
  • Configure VPN on the device
  • Use DPM.setApplicationRestrictions() to configure corporate VPN
• Enable corporate app Single Sign-On (SSO)
  • Install desired corporate apps
  • Use DPM.installKeyPair() to silently install corp client certs
  • Use DPM.setApplicationRestrictions() to configure hostnames, cert alias’ of corporate apps

Managed provisioning is just one part of the EMM end-to-end workflow, with the end goal of making corporate data accessible to apps in the managed profile. For testing guidance, see Setting up Device Testing.

Automated provisioning testing

To automate the testing of enterprise provisioning processes, use the Android for Work (AfW) Test Harness. For details, see Testing Device Provisioning.