The QR code enrollment method can be used to enroll devices in Work Managed mode and Corporate Owned Personally Enabled (COPE) modes. It is supported on all OS versions for both Custom DPC and Android Management API.
Users enroll by scanning a QR code during the Android setup wizard. Devices must be in a factory reset state prior to enrollment. Only devices with Google Mobile Services (GMS) support QR code enrollment since the Android setup wizard is contained in GMS.
You can generate the QR code manually or by using the enrollment configuration wizard in the Workspace ONE UEM Console.
Generate a QR Code Using the Enrollment Configuration Wizard
The Enrollment Configuration Wizard in the Workspace ONE UEM Console allows you to quickly create QR codes for corporate-owned Android device enrollment.
- Navigate to Devices > Lifecycle > Staging > Mobile Staging.
- Select Configure Enrollment to launch the enrollment configuration wizard.
- For Platform, select Android.
- For Management Type, select whether the QR code will be used to enroll devices using Custom DPC or Android Management API.
- For Enrollment, select QR Code.
- Select Configure.
- To automatically connect the device to Wi-Fi prior to enrollment, configure the Wi-Fi tab:
| Setting | Description |
|---|---|
| Configure optional Wi-Fi for the device to connect to prior to enrollment | Choose the WiFi network type (Open Wi-Fi, WPA/WPA2). Choosing None means that the user must manually connect to Wi-Fi. |
| SSID | Enter the Service Set Identifier, more commonly known as the name of the Wi-Fi Network. |
| Password | Enter the Wi-Fi password for the entered SSID. |
- Select Next.
- (Custom DPC only) Select where the device should download Workspace ONE Intelligent Hub from:
|Setting|Description| |-------|-----------| |Workspace ONE Intelligent Hub|Select to Use latest Workspace ONE Intelligent Hub: The device will download the latest version of Intelligent Hub from Google Play Store. Alternatively, you can select Use Hosted on an external URL: The device will download Intelligent Hub from an endpoint hosted by your organization. Use this for closed network configurations or when devices should download a specific version of Intelligent Hub.| |URL|The endpoint where your organization hosts Workspace ONE Intelligent Hub.|
- Select Next.
- Set the Enrollment Details settings. If the QR code is for Custom DPC and end users will use token-based authentication, leave Configure Organization Group and Configure Login Credentials disabled.
| Setting | Description |
|---|---|
| Configure Organization Group | Enable and select the organization group the device will enroll into. |
| Configure Login Credentials (Custom DPC only) | Set the login credentials the device will enroll with. Enter the Workspace ONE UEM account username and password. This is useful for enrolling devices using single- or multi-user staging accounts. |
| System Apps | Applies to Work Managed devices only. You can Enable to keep non-critical system applications installed on your Work Managed device. Select Disable which remove these applications. |
| Force AOSP/ Closed Network Enrollment(Custom DPC only) | When this field is enabled, you can enroll GMS and non-GMS devices in the same organization group regardless of the Work Managed device enrollment type set during Android EMM registration. - If the flag is set to use GMS and the UEM console is set to AOSP in the Android EMM registration page, the device will use the UEM console flag and enroll without Google account. |
- Select Next.
- In the Summary page, select Download File to download the QR code in PDF format or select View PDF to see a preview of the QR code.
Generate a QR Code Manually
You can manually create a QR code to further customize enrollment by:
- (Custom DPC only) Using additional enrollment flags for Workspace ONE Intelligent Hub. See Additional Supported Enrollment Flags for Android Enrollment for a list of supported flags.
- Using additional enrollment flags for Android. See flags starting in “Extra_Provisioning” under Android Device Policy Manager documentation.
Manual QR code generation for Custom DPC
To manually create a QR code for Custom DPC enrollment, copy the following template:
{
"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.airwatch.androidagent/com.airwatch.agent.DeviceAdministratorReceiver",
"android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "6kyqxDOjgS30jvQuzh4uvHPk-0bmAD-1QU7vtW7i_o8=\n",
"android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://getwsone.com/mobileenrollment/airwatchagent.apk",
"android.app.extra.PROVISIONING_SKIP_ENCRYPTION": false,
"android.app.extra.PROVISIONING_WIFI_SSID": "Your_SSID",
"android.app.extra.PROVISIONING_WIFI_PASSWORD": "SSID Password",
"android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
"serverurl": "Server URL",
"gid": "Group ID",
"un": "Username",
"pw": "Password"
}
}
Then:
- Update android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE as needed:
- Remove any unnecessary keys. For example, if a username and password should not be configured in the QR code, remove these keys.
- For keys that should be configured, replace them with values for the Workspace ONE UEM environment, organization group, and/or login credentials.
- Add any desired additional enrollment flags for Workspace ONE Intelligent Hub under android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE. See Additional Supported Enrollment Flags for Android Enrollment for a list of supported flags.
- Add additional enrollment flags for Android as needed. See flags starting in “Extra_Provisioning” under Android Device Policy Manager. documentation.
- Configure Wi-Fi:
- To not configure Wi-Fi before enrollment, remove android.app.extra.PROVISIONING_WIFI_SSID and android.app.extra.PROVISIONING_WIFI_PASSWORD.
- To configure an Open Wi-Fi configuration, replace “Your SSID” with the network SSID and remove android.app.extra.PROVISIONING_WIFI_PASSWORD.
- To configure a WPA/WPA2 Wi-Fi configuration, replace “Your SSID” and “SSID Password” with the SSID and password for the network, respectively.
Manual QR code generation for AMAPI
To manually create a QR code for AMAPI enrollment, copy the following template:
{
"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver",
"android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "I5YvS0O5hXY46mb01BlRjq4oJJGs2kuUcHvVkAPEXlg",
"android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://play.google.com/managed/downloadManagingApp?identifier=setup",
"android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
"com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "{enrollment-token}"
}
}
Then:
- Replace {enrollment-token}:
- If the user should specify what organization group they will enroll into, use the Android Management Sign Up Token under Groups & Settings > All Settings > Devices & Users > Android > Android EMM Registration > Configuration.
- To specify what organization group the device should enroll into when manually creating the QR code, use the Enrollment Configuration Wizard to generate a QR code for AMAPI. In the wizard, select the organization group the device should enroll into. Decode the QR code and copy the enrollment token.
- Add additional enrollment flags for Android as needed. See flags starting in “Extra_Provisioning” under Android Device Policy Manager documentation.
- Configure Wi-Fi:
- To not configure Wi-Fi before enrollment, remove android.app.extra.PROVISIONING_WIFI_SSID and android.app.extra.PROVISIONING_WIFI_PASSWORD.
- To configure an Open Wi-Fi configuration, replace “Your SSID” with the network SSID and remove android.app.extra.PROVISIONING_WIFI_PASSWORD.
- To configure a WPA/WPA2 Wi-Fi configuration, replace “Your SSID” and “SSID Password” with the SSID and password for the network, respectively.
Was this page helpful?