1page.title=Provisioning for Device Administration 2@jd:body 3 4<!-- 5 Copyright 2015 The Android Open Source Project 6 7 Licensed under the Apache License, Version 2.0 (the "License"); 8 you may not use this file except in compliance with the License. 9 You may obtain a copy of the License at 10 11 http://www.apache.org/licenses/LICENSE-2.0 12 13 Unless required by applicable law or agreed to in writing, software 14 distributed under the License is distributed on an "AS IS" BASIS, 15 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 See the License for the specific language governing permissions and 17 limitations under the License. 18--> 19<div id="qv-wrapper"> 20 <div id="qv"> 21 <h2>In this document</h2> 22 <ol id="auto-toc"> 23 </ol> 24 </div> 25</div> 26 27<p>This page describes the process for deploying devices to corporate users 28using NFC or with an activation code (for a complete list of requirements, see 29<a href="{@docRoot}devices/tech/admin/implement.html">Implementing Device 30Administration</a>).</p> 31 32<p>To get started, download the 33<a href="https://github.com/googlesamples/android-NfcProvisioning">NfcProvisioning 34APK</a> 35and 36<a href="https://github.com/googlesamples/android-DeviceOwner">Android-DeviceOwner 37APK</a>. 38</p> 39 40<p class="caution"><strong>Caution:</strong> If provisioning has already 41started, affected devices must be factory reset first.</p> 42 43<h2 id=managed_provisioning>Managed provisioning</h2> 44 45<p>Managed Provisioning is a framework UI flow to ensure users are adequately 46informed of the implications of setting a device owner or managed profile. It is 47designed to act as a setup wizard for managed profiles.</p> 48 49<p class="note"><strong>Note:</strong> The device owner can be set only from an 50unprovisioned device. If <code>Settings.Secure.USER_SETUP_COMPLETE</code> has 51ever been set, the device is considered provisioned and the device owner cannot 52be set.</p> 53 54<p>Devices that enable default encryption offer a considerably simpler and 55quicker device administration provisioning flow. The managed provisioning 56component:</p> 57 58<ul> 59 <li>Encrypts the device</li> 60 <li>Creates the managed profile</li> 61 <li>Disables non-required applications</li> 62 <li>Sets the enterprise mobility management (EMM) app as profile owner</li> 63</ul> 64 65<p>In turn, the EMM app:</p> 66 67<ul> 68 <li>Adds user accounts</li> 69 <li>Enforces device compliance</li> 70 <li>Enables any additional system applications</li> 71</ul> 72 73<p>In this flow, managed provisioning triggers device encryption. The framework 74copies the EMM app into the managed profile as part of managed provisioning. The 75instance of the EMM app inside of the managed profile gets a callback from the 76framework when provisioning is done. The EMM can then add accounts and enforce 77policies; it then calls <code>setProfileEnabled()</code>, which makes the 78launcher icons visible.</p> 79 80<h2 id=profile_owner_provisioning>Profile owner provisioning</h2> 81 82<p>Profile owner provisioning assumes the user of the device (and not a company 83IT department) oversees device management. To enable profile owner provisioning, 84you must send an intent with appropriate extras. For an example, use the TestDPC 85application 86(<a href="https://play.google.com/store/apps/details?id=com.afwsamples.testdpc&hl=en">Download 87from Google Play</a> or <a href="https://github.com/googlesamples/android-testdpc/">Build 88from GitHub</a>). Install TestDPC on the device, launch the app from the 89launcher, then follow the app instructions. Provisioning is complete when badged 90icons appear in the launcher drawer.</p> 91 92<p>Mobile Device Management (MDM) applications trigger the creation of the 93managed profile by sending an intent with action: 94<a href="https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/app/admin/DevicePolicyManager.java">DevicePolicyManager.ACTION_PROVISION_MANAGED_PROFILE</a> 95. Below is a sample intent that triggers the creation of the managed profile 96and sets the DeviceAdminSample as the profile owner:</p> 97 98<pre>adb shell am start -a android.app.action.PROVISION_MANAGED_PROFILE \ 99 -c android.intent.category.DEFAULT \ 100 -e wifiSsid $(printf '%q' \"WifiSSID\") \ 101 -e deviceAdminPackage "com.google.android.deviceadminsample" \ 102 -e android.app.extra.deviceAdminPackageName $(printf '%q' 103 .DeviceAdminSample\$DeviceAdminSampleReceiver) \ 104 -e android.app.extra.DEFAULT_MANAGED_PROFILE_NAME "My Organisation" 105</pre> 106 107<h2 id=device_owner_provisioning_via_nfc>Device owner provisioning</h2> 108<p>Use one of the following methods to set up device owner (DO) 109provisioning.</p> 110 111<h3 id=do_provision_nfc>Provisioning via NFC</h3> 112<p>DO provisioning via NFC is similar to the profile owner method but requires 113more bootstrapping. To use this method, 114<a href="http://developer.android.com/guide/topics/connectivity/nfc/nfc.html">NFC 115bump</a> the device during the initial setup step (i.e., first page of the setup 116wizard). This low-touch flow configures Wi-Fi, installs the DPC, and sets the 117DPC as device owner.</p> 118 119<p>A typical NFC bundle includes the following:</p> 120 121<pre> 122 EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME 123 EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_LOCATION 124 EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM 125 EXTRA_PROVISIONING_WIFI_SSID 126 EXTRA_PROVISIONING_WIFI_SECURITY_TYPE 127</pre> 128 129<p>Devices must have NFC configured to accept the managed provisioning 130mimetype from the setup experience:</p> 131 132<pre>/packages/apps/Nfc/res/values/provisioning.xml 133 134 <bool name="enable_nfc_provisioning">true</bool> 135 <item>application/com.android.managedprovisioning</item> 136</pre> 137 138<h3 id=do_provision_cs>Provisioning via Cloud Services</h2> 139<p>Device owner provisioning via cloud services includes the ability to 140provision a device in device owner mode during out-of-the-box setup. The device 141can collect credentials (or tokens) and use them to perform a lookup to a cloud 142service, which can then be used to initiate the device owner provisioning 143process.</p> 144 145<h2 id=emm_benefits>EMM benefits</h2> 146 147<p>An enterprise mobility management (EMM) app can help by conducting the 148following tasks:</p> 149 150<ul> 151 <li>Provision managed profile</li> 152 <li>Apply security policies 153 <ul> 154 <li>Set password complexity</li> 155 <li>Lockdowns: disable screenshots, sharing from managed profile, etc.</li> 156 </ul></li> 157 <li>Configure enterprise connectivity 158 <ul> 159 <li>Use WifiEnterpriseConfig to configure corporate Wi-Fi</li> 160 <li>Configure VPN on the device</li> 161 <li>Use <code>DPM.setApplicationRestrictions()</code> to configure corporate 162 VPN</li> 163 </ul></li> 164 <li>Enable corporate app Single Sign-On (SSO) 165 <ul> 166 <li>Install desired corporate apps 167 <li>Use <code>DPM.installKeyPair()</code> to silently install corp client 168 certs</li> 169 <li>Use <code>DPM.setApplicationRestrictions()</code> to configure 170 hostnames, cert alias’ of corporate apps</li> 171 </ul></li> 172</ul> 173 174<p>Managed provisioning is just one part of the EMM end-to-end workflow, with 175the end goal of making corporate data accessible to apps in the managed 176profile. For testing guidance, see 177<a href="{@docRoot}devices/tech/admin/testing-setup.html">Setting up Device 178Testing</a>.</p> 179 180<h2 id=automate>Automated provisioning testing</h2> 181<p>To automate the testing of enterprise provisioning processes, use 182the Android for Work (AfW) Test Harness. For details, see 183<a href="{@docRoot}devices/tech/admin/testing-provision.html">Testing Device 184Provisioning</a>.</p> 185