Skip to content
Trustaige Docs

Set up Android device management

Manage your organization's Android phones and tablets with Trustaige through Android Enterprise, from QR codes and work profiles to zero-touch.

  • Scale
  • Needs a Google account
View as Markdown
Devices
On this page

Trustaige manages Android phones and tablets through Android Enterprise, Google’s own management framework, so there’s no device management app of ours to build or sideload. You connect Google once; from then on Trustaige sets the policy each device follows (screen lock, apps, hardware restrictions), keeps an up-to-date record of every device, and can lock, restart, release or reset it.

An Android device is managed in one of two ways:

ModeForWhat Trustaige controls
Fully ManagedCompany-owned devices, set up from factory-freshThe whole device: apps, settings, camera, USB, factory reset
Work ProfileA person’s own deviceOnly a separate work container. Personal apps and data are untouched and out of view
  1. Trustaige to Google: policy and enrollment token
  2. Device to Google: enrolls with the token (QR code, link or zero-touch)
  3. Google to Device: installs Android Device Policy, applies your policy
  4. Trustaige to Google: reads devices and their state
  5. Trustaige to Google: commands: lock, restart, reset
  6. Google to Device: carries the command out
Trustaige never talks to the phone directly. It works through Google's Android Management API.

Before you begin

You needWhy
The Scale planAndroid device management is part of Scale.
A Google account for your organizationConnecting creates an Android Enterprise for your organization at Google, owned by the Google account you sign in with. Use an account your IT team keeps, not one person’s.
A zero-touch reseller (optional)Only for zero-touch enrollment: company-owned devices bought through a reseller enroll themselves at first boot.

Setup happens in the hub under Devices → Providers → Android.

1. Connect Android Enterprise

  1. Open Devices → Providers and choose Android.
  2. Click Connect Android Enterprise. You’ll be asked to confirm it’s you.
  3. Google asks you to sign in and authorize the connection, then to register your organization’s enterprise. Finish both; Google sends you back to the hub.

The page now shows Connected, your enterprise’s name, how many devices Google knows about, and when Trustaige last synced with Google. Trustaige creates the Default policy for you, so devices you enroll next are managed straight away.

2. Enroll devices

You have three ways in. All of them are on the same page.

Fully managed, with a QR code

For a company-owned device that is new or has just been factory reset.

  1. Under Enroll Devices, choose Fully Managed and click Generate QR code.
  2. On the device, at the first Welcome screen of setup, tap the screen six times quickly. The setup wizard opens its own QR reader.
  3. Scan the code from the hub. The device downloads Android Device Policy, applies your policy and appears in Devices → Fleet.

The code works only in the setup wizard; a camera app or QR scanner won’t do anything with it. One code enrolls as many devices as you like while it’s valid. It lasts an hour, and the hub shows a countdown and makes a fresh one when it runs out, as long as the page is open. Copy instructions gives you the steps above to send to whoever is setting the devices up.

For a person’s own phone. There’s no factory reset.

  1. Under Enroll Devices, choose Work Profile and click Generate sign-in link.
  2. Send the link to the device’s owner (Copy link, or Copy instructions for a message that includes it).
  3. They open it on their phone, install Android Device Policy when asked, and accept the work profile.

Android adds a separate set of work apps, and your policy applies only to those. The link lasts an hour, like the QR code, and can be used on several devices in that time. The person can remove the work profile themselves at any time from their phone’s settings.

Many devices at once

Bulk enrollment makes up to 100 enrollment tokens in one go, each with a nickname (device-001, device-002, …, from the Nickname prefix you set) to write on the box. Choose Fully managed or Work profile, click Generate 10 tokens (the button counts what you asked for), then Download CSV. The file’s columns are:

nickname,token_value,enrollment_mode,expires_at,signin_url

signin_url is filled in only for work profiles. Each token is valid for an hour from when you generate it, so make the batch on the day the devices are set up.

nickname,token_value,enrollment_mode,expires_at,signin_url

Zero-touch enrollment

Zero-touch is for company-owned devices you buy through a zero-touch reseller. The reseller registers the devices to your company in Google’s zero-touch portal. When one of them is switched on for the first time, it enrolls in Trustaige by itself: nobody scans a code or signs in. Devices enrolled this way are Fully Managed.

  1. On Devices → Providers → Android, open Zero-touch enrollment and click Generate zero-touch configuration. You’ll be asked to confirm it’s you.
  2. The hub shows two values to copy: DPC and DPC extras (paste this into the portal).
  3. In the Android zero-touch portal, create a configuration. Set its DPC to the hub’s DPC value and paste the hub’s JSON into DPC extras.
  4. In the portal, assign the configuration to your devices. The next time an assigned device is set up from factory-fresh, it enrolls with your default policy.

The DPC is always Google’s Android Device Policy app:

com.google.android.apps.work.clouddpc

The DPC extras look like this. Copy them from the hub as they are; the only part that’s yours is the enrollment token, which the hub fills in:

{
  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
    "com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "<your-android-enrollment-token>"
  },
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver"
}
KeyWhat it is
android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAMETells the device which app manages it: Android Device Policy. The same for every organization.
android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLEValues handed to Android Device Policy during setup.
com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKENYour organization’s zero-touch enrollment token. It enrolls the device into your enterprise as fully managed, under your default policy.

The token is valid for 90 days and enrolls any number of devices until then; the hub shows the date it expires. Before it does, click Generate a fresh token and paste the new DPC extras into the portal’s configuration. Devices that are already enrolled aren’t affected when a token expires.

com.google.android.apps.work.clouddpc
{
  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
    "com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "<your-android-enrollment-token>"
  },
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver"
}

3. Set the policy

The policy is what Android enforces on the device. Every device follows the Default policy unless it’s in a device group with a policy of its own.

Open Default policy from Device groups on the Android page (or from Devices → Policy → Android Enterprise → Scope overrides for Android). Change what you need and click Save default. Trustaige sends it to Google, and devices pick it up from there.

SectionSettings
SecurityBiometric lock, Block untrusted apps
Hardware restrictionsDisable camera, Disable screenshots, Block USB transfer, No user app installs, Disable factory reset (your remote reset still works), No developer settings
AppsApps from Managed Google Play, each Available (the person can install it), Force-installed (installed on enrollment) or Blocked. Browse the Play Store from the panel, or add a package name directly.
App updatesDefault, Wi-Fi only, Always or Never
Support messagesA Short message and Detailed message shown when someone meets a restriction

A new enterprise starts with Biometric lock, Block untrusted apps, Disable factory reset and No developer settings on.

Version history keeps every saved version; Restore sends an earlier one back to Google.

Different settings for some devices

Under Device groups, click New group, name it, and add devices to it. Open the group and click Create override to give it its own policy. A device in a group with a policy follows that policy; otherwise it follows the default. Deleting a group sends its devices back to the default on their next check-in.

For a single device, open it and use Device policy override on its Configuration tab.

4. Set compliance checks

Compliance decides whether a device is trusted. Open Devices → Policy, choose the Android Enterprise tab, and turn on what an Android device must meet:

  • Require screen lock: a PIN, pattern, password or biometric is set.
  • Require a current Android version: the device’s Android version meets the minimum you set.

Click Apply these checks. Until you do, the card says Not applied yet.

Commands

Open a device from Devices → Fleet and go to its Configuration tab. It shows what Google reports live: whether the device meets the policy and why not, its managed apps, security settings (encryption, Play Protect, developer mode), Android version and security patch.

CommandWhat it does
Force Check-InHas the device fetch its policy and report its state now.
Remote Lock, Restart DeviceLock the screen, or reboot the device.
Enable Lost Mode, Disable Lost ModeCompany-owned devices only. Locks the device with a message asking the finder to contact you. Needs Android 13 or newer.
Release to Personal UseCompany-owned devices set up with a work profile only. Removes management and the work profile and leaves the person’s own data, for a device given or sold to them.
Remove Work ProfilePersonal devices. Deletes the work profile and its apps; personal data stays.
Factory ResetCompany-owned devices. Erases everything. You confirm by typing the device’s name.
Wipe Work DataPersonal devices. Removes work apps and data only.

Trustaige reads every device’s state from Google on its own. To fetch it now, click Sync on the Android page.

Disconnect Android Enterprise

Disconnect on the Android page deletes your enterprise at Google. Every enrolled device is released: company-owned devices are factory reset and work profiles are removed from personal ones. Nobody can undo it, and connecting again means enrolling every device again. The hub asks you to type disconnect before it goes ahead.

Troubleshooting

“Connect to Google first to generate enrollment tokens.”

Android Enterprise isn’t connected yet. Connect it from step 1.

“Android Enterprise not connected or token expired.”

Trustaige can no longer act at Google for your organization. Disconnecting and connecting again restores it, but releases every enrolled device, so contact Trustaige support first.

“failed to generate zero-touch configuration”

Trustaige couldn’t create the zero-touch token at Google. Try again in a few minutes; if it keeps failing, contact Trustaige support.

The device ignores the QR code

The code is read only by the setup wizard. Factory reset the device, and on the first Welcome screen tap six times to open the reader. If the code’s countdown has run out, use the fresh one the hub shows.

A zero-touch device sets up as an ordinary phone

The device isn’t assigned to your configuration in the zero-touch portal, or the token in its DPC extras has expired. Check the assignment, generate a fresh token, update the configuration, and factory reset the device.

Sync says “No devices found on Google”

No device has finished enrolling yet. Enrollment is complete once the device has applied your policy; sync again after that.

An app shows “App not approved for enterprise”

The app has to be approved in Managed Google Play before it can be installed. Add it from the Apps section’s Play Store browser.

“Command failed” on Release to Personal Use

Google accepts it only for company-owned devices that were set up with a work profile. For a fully managed device, use Factory Reset instead.

Google’s documentation