Generate QR code

Getting started

To create a new enrollment QR code, go to the Android Enterprise QR Code Generator web page and select Create. The following sections explain how to configure, generate, and save enrollment QR codes.

Select an EMM

To begin adding properties to the enrollment QR code, select an EMM from the list. The default is Other, which allows the administrator to manually create a QR code.

 

To create a QR code for one of Datalogic's EMM partners, select the desired EMM from the drop down list. Selecting an EMM will pre-populate the Component name of admin receiver and Download and enrollment sections.

tip

The fields in the Component name of admin receiver and Download and enrollment sections are editable. However, it is not recommended to edit these values unless:

1. Your EMM provides alternate values
2. You are required to generate them yourself

Component name of admin receiver

DEVICE_ADMIN_COMPONENT_NAME

The admin receiver of the MDM application that will be set as the device owner.

Example: com.emm.android/DeviceAdminReceiver

This should be provided for you by the app developer, but if necessary, it is possible to discover this field if you have the APK file.

Manually extract admin receiver from APK

Disclaimer

This example method requires the use of a third party tool: apktool. By following this example, the end user is agreeing to assuming all risk that may be associated with the installation and usage of the aforementioned tool. Datalogic will not be held liable for any issues that may arise from its use.

1. Run the tool on your APK.

   apktool.bat decode <file.apk>

2. Find the package name.

   grep "package=" file/AndroidManifest.xml

3. Find the receiver with the BIND_DEVICE_ADMIN permission:

   grep BIND_DEVICE_ADMIN file/AndroidManifest.xml

4. The value output should be placed in the DEVICE_ADMIN_COMPONENT_NAME field.

Download and enrollment

The fields in this section are required if the EMM Agent (DPC) is not already installed.

DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION

A url that specifies the download location of the device admin package. This should be made available by the app developer, but it is possible to upload the file to your own http or https location if desired.

Example: https://github.com/mdm/agent.apk

On Datalogic devices with supported firmware, the device admin package can be downloaded from a FTP server.

Format: ftp://user:password@host:port/path

Example: ftp://username:1234@192.168.1.2:21/mdm/agent.apk

important

If you are going to host the file on a server on your local area network, it is necessary to configure the EMM Agent download settings.

DEVICE_ADMIN_SIGNATURE_CHECKSUM

This field stores a checksum value that is used by the device to verify that the admin application being installed has not been tampered with. This should be provided for you by the app developer, but if necessary, it is possible to generate the value if you have the APK file.

disclaimer

This example method requires the use of a third party tools: apksigner, xxd, tr, and openssl. By following this example, the end user is agreeing to assuming all risk that may be associated with the installation and usage of the aforementioned tools. Datalogic will not be held liable for any issues that may arise from their use.

The checksum output can be generated as follows:

Bash

apksigner verify -print-certs MY_APP.apk | grep -Po "(?<=SHA-256 digest:) .*" | xxd -r -p | openssl base64 | tr -- '+/' '-_'

PowerShell One-Liner

$hex = (apksigner verify -print-certs MY_APP.apk | Select-String -Pattern 'SHA-256 digest:\s*(\w+)' | ForEach-Object { $_.Matches[0].Groups[1].Value }); [Convert]::ToBase64String(([byte[]]($hex -split '(.{2})' | Where-Object { $_ } | ForEach-Object { [Convert]::ToByte($_,16) }))) -replace '\+','-' -replace '/','_' -replace '=',''

PowerShell Script

# PowerShell script to extract the SHA-256 digest from an APK file,
# convert it from hex to binary, encode it in Base64, and make it URL-safe.

# Step 1: Run apksigner to print certificate info
# Replace the path with your actual APK file path
$apkFile = "MY_APP.apk"
$apksignerOutput = apksigner verify -print-certs $apkFile

# Step 2: Extract the SHA-256 digest (hex string) using regex
$hex = ($apksignerOutput | Select-String -Pattern 'SHA-256 digest:\s*(\w+)' | ForEach-Object {
    $_.Matches[0].Groups[1].Value
})

# Step 3: Convert the hex string to a byte array
$bytes = $hex -split '(.{2})' | Where-Object { $_ } | ForEach-Object {
    [Convert]::ToByte($_, 16)
}

# Step 4: Encode the byte array to Base64
$base64 = [Convert]::ToBase64String([byte[]]$bytes)

# Step 5: Make the Base64 string URL-safe by replacing characters and removing padding
$urlSafeBase64 = $base64 -replace '\+', '-' -replace '/', '_' -replace '=', ''

# Step 6: Output the result
$urlSafeBase64 

ADMIN_EXTRAS_BUNDLE

The ADMIN_EXTRAS_BUNDLE field is optional. Selecting an EMM will auto populate the keys that are accepted by the EMM Agent. You will need to provide the values for the auto populated keys. Any key that does not have a value will be trimmed when the QR code is created. The auto populated keys may also be deleted, if desired. Additional key-value pairs may be added to the admin extras bundle. You should check with your EMM before adding keys to the admin extras bundle to prevent errors during provisioning. This field must contain valid JSON.

Configure Wi-Fi network

Configuring Wi-Fi is optional, but recommended to speed the provisioning process. All devices support WPA, WPA2, WEP, and Open networks.

Support for configuring an EAP Wi-Fi network in a standard Android Enterprise enrollment QR code will be available in Android Q. However, Datalogic has added the ability to configure an EAP network in the enrollment QR code on Datalogic devices running Android 8 and above with supported firmware.

Datalogic supports PEAP, PWD, SIM, AKA, and AKA PRIME networks.

Additional Android Enterprise properties

These are Android Enterprise properties that can modify the setup result and experience. They are all optional.

Datalogic properties

These properties are only supported on Datalogic devices with the minimum required firmware. They are all optional.

Mobile network settings

Group of settings for configuring an APN and enabling mobile data.

Network time protocol (NTP)

Setting to specify an NTP server for time synchronization.

EMM Agent download

Additional settings to support downloading the EMM agent from a server located on a closed network.

caution

EMM Agent download settings are only supported on a subset of Datalogic devices with the minimum required firmware.

LOCAL_CONNECTION_ONLY: Allows the EMM Agent to be downloaded from a server located on a closed network, without internet access. If the server uses HTTP, this is the only required setting. If the server uses HTTPS, see TRUST_SERVER.

TRUST_SERVER: Allows the EMM Agent to be downloaded from a server that uses a HTTPS certificate that is not trusted by the Android Keystore.

Scanning a QR code with these download properties on a device that does not meet the minimum firmware requirements will result in the following error message on the device.

USB Settings

Setting to enable the Android Debug Bridge (ADB) over USB.

AE-QR Code Backup

Preserves enrollment information and automatically re-applies after an enterprise reset.

Expedite Setup

Streamlines the setup process, allowing for automated provisioning of the device.

EXPEDITE_SETUP: Skips most manual interactions during the Setup Wizard.

GMS_ACCEPT_TERMS: Automates the GMS terms acceptance.

important

Older firmware will not evaluate the acceptance terms and will skip this interaction. Newer firmware will apply the selected term conditions below if this option is selected, but will require manual interaction with the GMS term acceptance screen if not selected. Please consult the feature support table to determine which firmware requires this option for automation.

Terms

GMS acceptance terms to be applied. These options will only be shown in both EXPEDITE_SETUP and GMS_ACCEPT_TERMS are selected.

ALLOW_USE_LOCATION: Allow apps and services to use device location with Location Accuracy features.

ALLOW_SCANNING: Allow Google to improve your device experience by scanning for nearby devices, networks, and apps.

ALLOW_PHONE_NUMBER_VERIFICATION: Allow Google to verify your phone number for security and account recovery.

SEND_USAGE_AND_DIAGNOSTIC_DATA: Send usage and diagnostic data to Google to improve products and services.

tip

These settings can also be configured in Scan2Deploy Studio

Encrypt QR code

Encryption is enforced by the generator. Please check that your device meets the minimum firmware requirements for encryption. Scanning an encrypted QR code on a device that does not support encryption will result in no action from the device.

Depending on the amount of data in the enrollment QR code, an encrypted QR code may be split into multiple QR codes. If multiple QR codes are generated, scan each QR code in the Setup Wizard to initiate device provisioning.

Generate QR code

Once the QR code properties have been configured, click Generate QR Code at the end of the form to view and save your QR code(s). If the Generate QR Code button is disabled, review the form for errors. Errors are indicated by a red error symbol and an error message.

Save

The enrollment QR code(s) can be scanned directly from the screen or can be saved to a PDF file. A unique filename is auto populated. The filename is editable. You may also add a description that will appear at the top of the PDF file. Click Save and the PDF file will be saved to your Downloads folder.

Edit

To make changes to the QR code, click Edit or the Back button in the top left corner. All previously entered values are persisted and editable.

Start Over

To discard all progress and start over, click the Home button in the top left corner.

caution

Discarding your progress cannot be undone.