# Set up Android device management

> Manage your organization's Android phones and tablets with Trustaige through Android Enterprise, from QR codes and work profiles to zero-touch.

Source: https://docs.trustaige.com/manage/android-devices

Replace these placeholders with your organization's own values:

- `<your-android-enrollment-token>`: Android enrollment token, a secret. From the hub: inside the zero-touch configuration it generates. Treat it as a secret.

Trustaige manages Android phones and tablets through **Android Enterprise**,
Google's own management framework, so there's no device management app of ours
to build or sideload. You connect Google once; from then on Trustaige sets the
policy each device follows (screen lock, apps, hardware restrictions), keeps an
up-to-date record of every device, and can lock, restart, release or reset it.

An Android device is managed in one of two ways:

| Mode | For | What Trustaige controls |
|---|---|---|
| **Fully Managed** | Company-owned devices, set up from factory-fresh | The whole device: apps, settings, camera, USB, factory reset |
| **Work Profile** | A person's own device | Only a separate work container. Personal apps and data are untouched and out of view |

*Trustaige never talks to the phone directly. It works through Google's Android Management API.*

1. Trustaige → Google: policy and enrollment token
2. Device → Google: enrolls with the token (QR code, link or zero-touch)
3. Google → Device: installs Android Device Policy, applies your policy
4. Trustaige → Google: reads devices and their state
5. Trustaige → Google: commands: lock, restart, reset
6. Google → Device: carries the command out

## Before you begin

| You need | Why |
|---|---|
| The **Scale** plan | Android device management is part of Scale. |
| A **Google account** for your organization | Connecting creates an Android Enterprise for your organization at Google, owned by the Google account you sign in with. Use an account your IT team keeps, not one person's. |
| A **zero-touch reseller** (optional) | Only for [zero-touch enrollment](#zero-touch-enrollment): company-owned devices bought through a reseller enroll themselves at first boot. |

Setup happens in the hub under **Devices → Providers → Android**.

## 1. Connect Android Enterprise

1. Open **Devices → Providers** and choose **Android**.
2. Click **Connect Android Enterprise**. You'll be asked to confirm it's you.
3. Google asks you to sign in and authorize the connection, then to register
   your organization's enterprise. Finish both; Google sends you back to the
   hub.

The page now shows **Connected**, your enterprise's name, how many devices
Google knows about, and when Trustaige last synced with Google. Trustaige
creates the **Default policy** for you, so devices you enroll next are managed
straight away.

## 2. Enroll devices

You have three ways in. All of them are on the same page.

### Fully managed, with a QR code

For a company-owned device that is new or has just been factory reset.

1. Under **Enroll Devices**, choose **Fully Managed** and click **Generate QR
   code**.
2. On the device, at the first **Welcome** screen of setup, tap the screen six
   times quickly. The setup wizard opens its own QR reader.
3. Scan the code from the hub. The device downloads Android Device Policy,
   applies your policy and appears in **Devices → Fleet**.

The code works only in the setup wizard; a camera app or QR scanner won't do
anything with it. One code enrolls as many devices as you like while it's
valid. It lasts an hour, and the hub shows a countdown and makes a fresh one
when it runs out, as long as the page is open. **Copy instructions** gives you
the steps above to send to whoever is setting the devices up.

### Work profile, with a sign-in link

For a person's own phone. There's no factory reset.

1. Under **Enroll Devices**, choose **Work Profile** and click **Generate
   sign-in link**.
2. Send the link to the device's owner (**Copy link**, or **Copy
   instructions** for a message that includes it).
3. They open it on their phone, install **Android Device Policy** when asked,
   and accept the work profile.

Android adds a separate set of work apps, and your policy applies only to
those. The link lasts an hour, like the QR code, and can be used on several
devices in that time. The person can remove the work profile themselves at any
time from their phone's settings.

### Many devices at once

**Bulk enrollment** makes up to 100 enrollment tokens in one go, each with a
nickname (`device-001`, `device-002`, …, from the **Nickname prefix** you set)
to write on the box. Choose **Fully managed** or **Work profile**, click
**Generate 10 tokens** (the button counts what you asked for), then **Download
CSV**. The file's columns are:

```txt title="android-enrollment-YYYY-MM-DD.csv"
nickname,token_value,enrollment_mode,expires_at,signin_url
```

`signin_url` is filled in only for work profiles. Each token is valid for an
hour from when you generate it, so make the batch on the day the devices are
set up.

## Zero-touch enrollment

Zero-touch is for company-owned devices you buy through a [zero-touch
reseller](https://www.android.com/enterprise/zero-touch-enrollment/resellers/).
The reseller registers the devices to your company in Google's zero-touch
portal. When one of them is switched on for the first time, it enrolls in
Trustaige by itself: nobody scans a code or signs in. Devices enrolled this way
are **Fully Managed**.

1. On **Devices → Providers → Android**, open **Zero-touch enrollment** and
   click **Generate zero-touch configuration**. You'll be asked to confirm
   it's you.
2. The hub shows two values to copy: **DPC** and **DPC extras (paste this into
   the portal)**.
3. In the [Android zero-touch portal](https://partner.android.com/zerotouch),
   create a configuration. Set its DPC to the hub's **DPC** value and paste
   the hub's JSON into **DPC extras**.
4. In the portal, assign the configuration to your devices. The next time an
   assigned device is set up from factory-fresh, it enrolls with your default
   policy.

The **DPC** is always Google's Android Device Policy app:

```txt title="DPC"
com.google.android.apps.work.clouddpc
```

The **DPC extras** look like this. Copy them from the hub as they are; the
only part that's yours is the enrollment token, which the hub fills in:

```json title="DPC extras" {3}
{
  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
    "com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "<your-android-enrollment-token>"
  },
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver"
}
```

| Key | What it is |
|---|---|
| `android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME` | Tells the device which app manages it: Android Device Policy. The same for every organization. |
| `android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE` | Values handed to Android Device Policy during setup. |
| `com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN` | Your organization's zero-touch enrollment token. It enrolls the device into your enterprise as fully managed, under your default policy. |

The token is valid for **90 days** and enrolls any number of devices until
then; the hub shows the date it expires. Before it does, click **Generate a
fresh token** and paste the new DPC extras into the portal's configuration.
Devices that are already enrolled aren't affected when a token expires.

> **Important:** Treat the DPC extras like a password. Anyone who has them can enroll a device
> into your organization until the token expires. Keep them in the zero-touch
> portal and nowhere else.

## 3. Set the policy

The policy is what Android enforces on the device. Every device follows the
**Default policy** unless it's in a device group with a policy of its own.

Open **Default policy** from **Device groups** on the Android page (or from
**Devices → Policy → Android Enterprise → Scope overrides for Android**). Change
what you need and click **Save default**. Trustaige sends it to Google, and
devices pick it up from there.

| Section | Settings |
|---|---|
| **Security** | **Biometric lock**, **Block untrusted apps** |
| **Hardware restrictions** | **Disable camera**, **Disable screenshots**, **Block USB transfer**, **No user app installs**, **Disable factory reset** (your remote reset still works), **No developer settings** |
| **Apps** | Apps from Managed Google Play, each **Available** (the person can install it), **Force-installed** (installed on enrollment) or **Blocked**. Browse the Play Store from the panel, or add a package name directly. |
| **App updates** | **Default**, **Wi-Fi only**, **Always** or **Never** |
| **Support messages** | A **Short message** and **Detailed message** shown when someone meets a restriction |

A new enterprise starts with **Biometric lock**, **Block untrusted apps**,
**Disable factory reset** and **No developer settings** on.

**Version history** keeps every saved version; **Restore** sends an earlier one
back to Google.

### Different settings for some devices

Under **Device groups**, click **New group**, name it, and add devices to it.
Open the group and click **Create override** to give it its own policy. A
device in a group with a policy follows that policy; otherwise it follows the
default. Deleting a group sends its devices back to the default on their next
check-in.

For a single device, open it and use **Device policy override** on its
**Configuration** tab.

## 4. Set compliance checks

Compliance decides whether a device is trusted. Open **Devices → Policy**,
choose the **Android Enterprise** tab, and turn on what an Android device must
meet:

- **Require screen lock**: a PIN, pattern, password or biometric is set.
- **Require a current Android version**: the device's Android version meets
  the minimum you set.

Click **Apply these checks**. Until you do, the card says **Not applied yet**.

## Commands

Open a device from **Devices → Fleet** and go to its **Configuration** tab.
It shows what Google reports live: whether the device meets the policy and why
not, its managed apps, security settings (encryption, Play Protect, developer
mode), Android version and security patch.

| Command | What it does |
|---|---|
| **Force Check-In** | Has the device fetch its policy and report its state now. |
| **Remote Lock**, **Restart Device** | Lock the screen, or reboot the device. |
| **Enable Lost Mode**, **Disable Lost Mode** | Company-owned devices only. Locks the device with a message asking the finder to contact you. Needs Android 13 or newer. |
| **Release to Personal Use** | Company-owned devices set up with a work profile only. Removes management and the work profile and leaves the person's own data, for a device given or sold to them. |
| **Remove Work Profile** | Personal devices. Deletes the work profile and its apps; personal data stays. |
| **Factory Reset** | Company-owned devices. Erases everything. You confirm by typing the device's name. |
| **Wipe Work Data** | Personal devices. Removes work apps and data only. |

Trustaige reads every device's state from Google on its own. To fetch it now,
click **Sync** on the Android page.

## Disconnect Android Enterprise

**Disconnect** on the Android page deletes your enterprise at Google. Every
enrolled device is released: company-owned devices are factory reset and work
profiles are removed from personal ones. Nobody can undo it, and connecting
again means enrolling every device again. The hub asks you to type
`disconnect` before it goes ahead.

## Troubleshooting

**“Connect to Google first to generate enrollment tokens.”**

Android Enterprise isn't connected yet. Connect it from step 1.

**“Android Enterprise not connected or token expired.”**

Trustaige can no longer act at Google for your organization. Disconnecting and
connecting again restores it, but releases every enrolled device, so contact
Trustaige support first.

**“failed to generate zero-touch configuration”**

Trustaige couldn't create the zero-touch token at Google. Try again in a few
minutes; if it keeps failing, contact Trustaige support.

**The device ignores the QR code**

The code is read only by the setup wizard. Factory reset the device, and on
the first **Welcome** screen tap six times to open the reader. If the code's
countdown has run out, use the fresh one the hub shows.

**A zero-touch device sets up as an ordinary phone**

The device isn't assigned to your configuration in the zero-touch portal, or
the token in its DPC extras has expired. Check the assignment, generate a
fresh token, update the configuration, and factory reset the device.

**Sync says “No devices found on Google”**

No device has finished enrolling yet. Enrollment is complete once the device
has applied your policy; sync again after that.

**An app shows “App not approved for enterprise”**

The app has to be approved in Managed Google Play before it can be installed.
Add it from the **Apps** section's Play Store browser.

**“Command failed” on Release to Personal Use**

Google accepts it only for company-owned devices that were set up with a work
profile. For a fully managed device, use **Factory Reset** instead.

## Google's documentation

- [Zero-touch resellers](https://www.android.com/enterprise/zero-touch-enrollment/resellers/)
- [Android zero-touch portal](https://partner.android.com/zerotouch)
- [Zero-touch configurations](https://developers.google.com/zero-touch/guides/customer/configurations)
- [Provisioning devices with the Android Management API](https://developers.google.com/android/management/provision-device)