Enroll Android Device Using Zero-Touch

In the Google Zero Touch Enrollment Portal, add enrollment configurations that should be applied on the device as soon as the device is set up from a factory reset state. The device will automatically initiate enrollment into your Workspace ONE UEM environment. Your device reseller must register your devices for your organization in the Zero Touch Enrollment portal.

Zero Touch Enrollment is supported for both Custom DPC and Android Management API enrollment.

Note: Google Zero Touch Enrollment is only supported on Android 9.0 or later devices. For Samsung devices, use Samsung Knox Mobile Enrollment.

Link your Zero-touch account to Workspace ONE UEM

Once you have configured your Zero-touch account and devices in the Zero-touch Portal, you can link your account to the UEM console to manage your zero touch devices within consoles. By linking your the Zero-touch account to the UEM console, you can view devices associated with the Zero-touch account, set a default enrollment configuration, and edit support information through the Workspace ONE UEM Console.

To link a new Zero-touch account in the UEM console:

1. Navigate to Groups & Settings > All Settings > Devices & Users > Android > Android EMM Registration > and select Zero-touch.
2. Before linking the account, specify the parameters for the default zero-touch enrollment configuration. Once you link the zero-touch account, Workspace ONE UEM will set these parameters as the default enrollment configuration for the account.

Note: To change the default configuration, unlink the zero-touch enrollment account and repeat this linking process.

• Enable Specific Organization Group to select a specific Organization Group. When this option is not turned on, the settings apply to all groups.
• Configure DPC Extras which allows you to configure the DPC and provisioning extras used during zero-touch device setup.

See Additional Enrollment Flags.

3. Select Link Zero-touch which lets you link your Zero-touch accounts.

You now view Zero-touch accounts, configuration, devices, and support information. You may also link additional zero-touch enrollment accounts. for Custom DPC

Configure Zero-Touch Enrollment for Custom DPC

To get started in the Zero Touch Portal for devices managed under Custom DPC:

1. Navigate to the Configurations tab and click the +.

2. Enter the following details for enrollment:

   Setting	Description
   Configuration Name	Enter a name for this configuration.
   EMM DPC	Select 'Workspace ONE Intelligent Hub'. This will ensure that the Workspace ONE Intelligent Hub is downloaded as part of factory setup.
   DPC Extras	Enter the enrollment credentials that will be configured in the Workspace ONE Intelligent Hub. You can include the Workspace ONE UEM console Server URL, Group ID, enrollment username, and password. Copy the JSON-formatted text from your EMM console.
   Company Name	Enter your organization name.
   Support E-mail Address	Enter the email that end users should contact if they run into issues.
   Support Phone Number	Enter the phone number that end users should call if they run into issues.
   Custom Message	Enter a custom message to show to end users prior to downloading the Workspace ONE Intelligent Hub.

Here are some different scenarios you can use for zero-touch configurations:

If your end users are provisioning their devices

In this scenarios, exclude the username and password and the user enters them at device setup when prompted.

{  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": 
{ "serverurl": "https://airwatch.console.com", "gid": "groupID"} }

If you are assigning to staging users and know the user credentials

This scenario is recommended if all devices are being staged to a single user or the enrollment username and password is known.

{  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": 
{ "serverurl": "https://airwatch.console.com", "gid":
 "groupID", "un":"username", "pw":"password" } }

3. Select Apply.

4. Assign configurations under the Devices tab by selecting the enrollment configuration that should be applied to the device.

   You will need to work with your carrier/ device reseller to retrieve IMEI and serial numbers for your devices.

Configure Zero-Touch Enrollment for Android Management API

Log into the Google Zero Touch Enrollment Portal and:

1. Navigate to the Configurations tab and click the +.
2. Enter the following details for enrollment:

3. Select Add.
4. Assign configurations under the Devices tab by selecting the enrollment configuration that should be applied to the device.

Considerations for DPC Extras Field

• If the user should specify what organization group they will enroll into, use the Android Management Sign Up Token under Groups & Settings > All Settings > Devices & Users > Android > Android EMM Registration > Configuration.
• To specify what organization group the device should enroll into when manually creating the QR code, use the Enrollment Configuration Wizard to generate a QR code for AMAPI. In the wizard, select the organization group the device should enroll into.
  • Decode the QR code and copy the enrollment token.
  • Copy the template below, replacing {Sign In URL token} with the enrollment token:

{
  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
    "com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "{Sign In URL token}"
  }