Skip to main content

Enrollment

Overview​

Enrollment links a device to your MDM and installs the MDM agent, also called the Device Policy Controller (DPC). On fully managed and dedicated devices, the DPC becomes the device owner and manages the entire device. With a work profile, the DPC becomes the profile owner and manages only the work profile.

Before enrolling devices, create an enrollment profile in your MDM. The profile sets the management use case and provides the enrollment details used by each enrollment method.

MDM enrollment profile​

These steps are based on SOTI's Creating an Android Enterprise Device Policy guide and Device Side Actions for Enrollment guide.

Prerequisites

Your SOTI MobiControl deployment must have Android Enterprise configured and connected to managed Google Play before enrolling Android Enterprise devices.

Create the enrollment policy

  1. Sign in to the SOTI MobiControl web console.
  2. Navigate to Policies > Enrollment > All Policies.
  3. Select New Enrollment Policy.
  4. Select Google > Android Enterprise as the device family.
  5. On the General tab, enter a name and description for the policy (for example, Datalogic Work Managed).
  6. Select the enterprise binding linked to your managed Google Play account.
  7. Select Next.
  8. On the Device Type tab, select Work Managed.
  9. Select Next.
  10. On the Groups tab, select the authentication required to enroll: No authentication, Password, or Directory.
  11. Select the device group to which enrolled devices will be assigned.
  12. Select Next.
  13. On the Settings tab, select any additional settings required by your organization.
  14. Select Finish.
  15. On the Enrollment Policy Info page, note the Enrollment ID and enrollment URL.
  16. Select OK.

Use the following admin extras with the enrollment method below:

  • enrollmentId: the Enrollment ID from the enrollment policy

Android Enterprise enrollment​

Datalogic devices support the standard Android Enterprise enrollment methods: zero-touch, QR code, NFC, and manual DPC identifier. Each starts from a factory reset device in the Setup Wizard and uses the enrollment profile created above. Android Enterprise enrollment requires Google Mobile Services (GMS).

Android zero-touch enrollment automatically enrolls devices in your MDM during initial setup. Simply power on the device and connect it to the internet using cellular data. If cellular connectivity is unavailable, connect to Wi-Fi instead.

Connecting to a network

WWAN devices with an active SIM card connect to the cellular network automatically. On WLAN devices, scan a Wi-Fi QR code with the built-in scanner to connect to Wi-Fi. Wi-Fi QR codes can be created with the Wi-Fi QR Code Generator.

Register the devices

  1. Purchase devices from an authorized zero-touch reseller, including directly from Datalogic.
  2. The reseller creates your organization's zero-touch account, if you don't already have one, and registers the devices to it.

Create a zero-touch configuration

These steps are based on Google's Create custom zero-touch configurations guide.

  1. Sign in to the zero-touch enrollment portal with your organization's account.
  2. Select Configurations.
  3. Select Add.
  4. In Configuration name, enter a name (for example, Datalogic Dedicated).
  5. Under EMM DPC, select the DPC for your MDM: SOTI MobiControl, Android Device Policy (Microsoft Intune), 42Gears MDM (SureMDM), or Workspace ONE Intelligent Hub.
  6. In DPC extras, paste the admin extras from your enrollment profile as JSON (see the example below).
  7. Optionally, enter the Company name, Support email address, Support phone number, and a Custom message. These are shown on the device during setup.
  8. Select Add.
  9. Optionally, under Default configuration, select the new configuration and select Apply, so that newly registered devices receive it automatically.

The DPC extras are the admin extras wrapped in android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE. For example, for Workspace ONE:

{
  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
    "serverurl": "<Server URL>",
    "gid": "<Group ID>",
    "un": "<Staging user name>",
    "pw": "<Staging user password>"
  }
}

To see the admin extras for another MDM, select it in the Android Enterprise QR Code Generator. The generator lists the admin extras for each supported MDM.

Protect your DPC extras

DPC extras can contain enrollment credentials. Share them only with administrators who manage your zero-touch account.

Assign the configuration and enroll

  1. In the zero-touch portal, select Devices.
  2. Find each device by IMEI or serial number and set its Configuration. To assign many devices at once, select More > Upload batch configurations and upload a CSV file.
  3. Power on the device (or factory reset it).
  4. Connect to a network, either cellular or Wi-Fi (scan a Wi-Fi QR code).
  5. The device downloads the MDM agent and enrolls automatically.

Android Classic enrollment​

Legacy enrollment

Android Classic (device administrator) enrollment is supported only with SOTI MobiControl and may not be supported in the near future. Google has deprecated device administrator management; use Android Enterprise for new deployments.

On Datalogic devices, the SOTI MobiControl agent is preinstalled, so no download is needed during setup.

  1. In the SOTI MobiControl console, create an enrollment policy with Android Classic as the device family and note its Enrollment ID or QR code.
  2. Power on the device and complete the Setup Wizard.
  3. Open the SOTI MobiControl app on the device.
  4. Enter the enrollment ID, or scan the SOTI enrollment QR code.
  5. Follow the on-screen prompts and activate the device administrator when asked.