Configure support for Android zero-touch enrollment

You can use Android zero-touch enrollment to deploy a large number of Android Enterprise or Android Management devices at one time. When your organization purchases devices that support zero-touch enrollment from an authorized enterprise reseller, the reseller sets up a zero-touch enrollment account and adds the devices to the account. When a user sets up one of these devices for the first time, or resets a device to the factory settings, the device automatically activates with UEM:
  • On Android Enterprise devices, the UEM Client is downloaded automatically and the activation process starts.
  • On Android Management devices, the activation process starts and the last step of the process is to download and activate the UEM Client.
  1. In the management console, on the menu bar, click Settings > External integration > Android and Chrome Management.
  2. In the Android Zero Touch device enrollment section, click Launch zero-touch console.
  3. If this is the first time that you have connected to Android zero-touch with UEM, click Next and sign in to Google using the address associated with your organization's zero-touch account.
  4. If you want to support zero-touch enrollment for Android Enterprise devices:
    1. Create an enrollment configuration.
    2. In the EMM DPC drop-down list, click BlackBerry UEM Client.
    3. In the DPC Extras field, copy and paste the following:
      {
"android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE":{
"URL":"bcp://US.bbsecure.com:443/S22459776",
"CACFPrint":"37c54252ad75ef4ba33003b9ddc945844bd10fc1eb6c39580d9f1ee5dabf5e42",
"stc":"BES10 Onprem",
"Username":""
}
}
    4. Complete the other fields as necessary and save the enrollment configuration.
  5. If you want to support zero-touch enrollment for Android Management devices:
    1. Create an enrollment configuration.
    2. In the EMM DPC drop-down list, click Android Device Policy.
    3. In the DPC Extras field, copy and paste the following:
      {
"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME":"com.google.android.apps.work.
clouddpc/.receivers.CloudDeviceAdminReceiver",

"android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM":
"I5YvS0O5hXY46mb01BlRjq4oJJGs2kuUcHvVkAPEXlg",
}
    4. Complete the other fields as necessary and save the enrollment configuration.
  6. In the zero-touch console, assign the Android Enterprise and Android Management enrollment configurations to devices as required. You can assign only one enrollment configuration to a device.
  • In UEM, verify that the appropriate profiles and IT policies are assigned to users. To use zero-touch enrollment, you must assign an activation profile with any of the following activation types enabled:
    • Work and personal - full control (Android Enterprise)
    • Work space only (Android Enterprise)
    • Work and personal - full control (Android Management)
    • Work space only (Android Management)
  • Distribute the devices to users. When a user sets up a device for the first time (or resets the device to factory settings), the device automatically activates with UEM. If the user restarts the device before the activation completes, cancels the activation, or allows the battery to drain before the activation completes, the device automatically resets to its factory settings and the activation process restarts.