This guide details the onboarding workflow for provisioning corporate Android endpoints using Zero-Touch Enrollment.
Overview of Android Zero-Touch Provisioning
Zero-Touch enrollment enables out-of-the-box, hands-free provisioning for IT administrators deploying enterprise Android devices:
- Automated Configuration: The device contacts Google’s Zero-Touch servers upon connecting to the internet, fetching the organization's configuration profile.
- Full Enterprise Management: The device is provisioned as a fully managed corporate asset, automatically downloading the Mobile Guardian client and assigned security profiles without manual IT intervention.
- Rapid Deployment: Enables efficient, scalable rollouts across large fleets of hardware.
Device Onboarding Procedure
Follow these steps to provision a new or factory-reset corporate Android device:
- Power On & Connect: Turn on the endpoint, select the system language, and establish a network connection via Wi-Fi or cellular data. The operating system will automatically query the server and detect the assigned Mobile Guardian configuration.
- Review Ownership Prompt: When prompted by the system dialogue confirming that the device belongs to your business and is subject to enterprise management, tap Next.
- Complete Automated Provisioning: The setup wizard will apply assigned corporate configurations and silently install the Mobile Guardian client to complete enrollment.
- Setup Wizard: Select Continue.
- Proceed: Select "Next".
- Install Work Apps: Navigate to "Install work apps" and select "Install".
- Configure Mobile Guardian: Navigate to "Configure Mobile Guardian" and select "Setup".
The device automatically deploys assigned security policies, business details, and enterprise-managed configurations. Upon application startup, the endpoint is immediately locked to the Mobile Guardian client.
Terms of Service Presentation
If a Terms of Service URL was defined during the dashboard configuration phase, the agreement screen will display immediately upon launching the application. The employee must accept the terms before proceeding with enrollment.
User acceptance is mandatory. If the student declines the Terms of Service, the device will remain locked on the acceptance screen until acceptance is granted.
Environment & Device Naming
Following acceptance of the Terms of Service, the next screen displays the device's target Environment. The student must then name the device and check a box to acknowledge and accept the Mobile Guardian Privacy Policy and Terms.
Student Registration
Selecting "Activate" triggers the appearance of the Student Registration Fields. The contents of this form will precisely match the fields configured (enabled or disabled toggles) by the administrator.
Login Completion and Operational Mode
After the student completes the form and selects "Login," the enrollment process concludes. The device will then exit Kiosk Mode and return to normal operational mode.
If the student chooses to sign out of the Mobile Guardian application, the device will immediately re enter Kiosk Mode, reverting to the initial Terms of Service acceptance screen.
Grant Permissions
After successfully installing the Mobile Guardian app, you will be prompted to provide usage access to the app.
Authorise the following permissions:
- Device Admin
- Package Usage Stats
- System Alert Window
- After granting permissions, tap Continue.
- The Mobile Guardian application will open to finalise the registration.
- Press the back button to redirect to the home screen.
On some devices, a restart may occur shortly after registration to apply device policies.