Device Enrollment
This guide covers all methods and options for enrolling Android devices into your AndroidNexus enterprise, organized by enrollment type.
The Installation Guide walks through enrollment by type - Fully Managed, Dedicated, BYOD, or COPE - with the exact steps for each method. This page is the deeper reference on methods, options, and troubleshooting. Note that the Installation Guide's method tabs aren't individually linkable, so links back to it point to the guide generally rather than a specific method.
Enrollment Types
| Type | Description |
|---|---|
| Fully Managed | Full corporate control - recommended for most corporate-owned, single-purpose fleets |
| Dedicated | Kiosk and single-purpose devices locked to specific apps |
| BYOD | Personal device with a separate work profile |
| COPE | Company-owned, with a separate profile for personal use |
Fully Managed
The device is entirely under organizational control. This is the recommended enrollment type for most devices.
Prerequisites
- A new or factory-reset Android device
- For QR Code: Device must have a Camera
- DPC Identifier (AFW): Camera is not required but makes enrollment quicker
- For Zero-Touch / Knox: Devices purchased through an authorized reseller and assigned to the appropriate company portal (Google or Samsung)
- For NFC: a second NFC-enabled device configured as the programmer
Available Methods
| Method | Best For | Setup Required |
|---|---|---|
| QR Code | Individual devices, quick setup | Camera on the device |
| Google Zero-Touch | Bulk corporate deployments | Devices assigned via an authorized reseller |
| Samsung Knox | Bulk Samsung deployments | Knox Mobile Enrollment portal access |
| NFC | Pairing without scanning | A second NFC-enabled "programmer" device |
| DPC Identifier (AFW) | Manual setup when scanning isn't available | Typing afw#setup at the sign-in prompt |
All methods start by creating a policy in AndroidNexus with Fully Managed selected as the enrollment type - see the policy template reference for basic setup suggestions - then creating an enrollment token and applying that policy to it.
NFC provisioning requires Android 6.0+ and NFC enabled on the target device. It does not support COPE (work profile on a company-owned device) on Android 11+.
Troubleshooting
| Problem | Solution |
|---|---|
| "Invalid token" error | Check that the token hasn't expired and verify the enterprise ID matches your AndroidNexus organization |
| "Already managed" error | The device has an existing device owner set - factory reset the device first, then retry enrollment |
| Enrollment times out | Check the device's network connectivity and try again; if it persists, generate a new enrollment token |
Dedicated
Single-purpose devices - kiosks, digital signage, and shared-use hardware locked to specific apps.
Prerequisites
- New or factory-reset Android device
Kiosk Policy Setup
Every dedicated enrollment method starts with creating the kiosk policy - it's step one regardless of which method you use to enroll the device. In Policies, create a new policy and configure the kiosk apps and allowed system features:
Kiosk Apps:
- com.company.app1 (Primary)
- com.android.chrome
Allowed Features:
- Status bar: Enabled/Disabled
- Power Button: Available/Blocked
- System Navigation: Enabled/Disabled/Home Button Only
- Setting App Access: Blocked/Allowed (Emergency Exit)
- Show System Error Messages: Shown/Muted
If your kiosk application is a web app or has browser dependencies, make sure Google Chrome is an installed app in the policy - otherwise the application will not launch.
Available Methods
Once the kiosk policy exists, enroll the device using any of the same methods available for Fully Managed: QR Code, Google Zero-Touch, Samsung Knox, NFC, or DPC Identifier (AFW). Each method's remaining steps (create an enrollment token, then the on-device provisioning flow) are identical to their Fully Managed counterparts - the only difference is the enrollment token is attached to the kiosk policy instead of a standard Fully Managed policy.
Troubleshooting
| Problem | Solution |
|---|---|
| Device enrolls but does not enter kiosk mode | Confirm the enrollment token has the kiosk policy attached - kiosk mode is applied through the policy, not the enrollment method itself |
| "Already managed" error | Factory reset the device first, then retry enrollment with the kiosk-policy token |
BYOD
Bring Your Own Device - a separate work profile is created alongside the user's personal profile.
Prerequisites
- The user's personal Android device, with access to the Google Play Store
- An enrollment token generated in AndroidNexus with personal usage allowed
Available Methods
| Method | Best For | Setup Required |
|---|---|---|
| Add Work Profile | Users setting up from device Settings | User navigates to Settings → Google → Set up & restore |
| Android Device Policy | Direct install from Play Store | User installs the Android Device Policy app themselves |
| Enrollment Link | Remote/self-service setup | Admin generates and shares a link containing the enrollment token |
All three methods start the same way: create a policy in AndroidNexus with BYOD selected as the enrollment type and the work profile settings configured, then create an enrollment token. From there, the user either opens Settings and taps Set up your work profile, downloads Android Device Policy from the Play Store directly, or opens an enrollment link - each path leads to scanning or entering the token to finish creating the work profile.
Differences from Fully Managed
| Feature | Fully Managed | Work Profile (BYOD) |
|---|---|---|
| Device owner | Organization | User |
| Personal apps | Not allowed | Allowed |
| Device wipe | Full factory reset | Work data only |
| Camera control | Full | Work profile only |
| Location tracking | Always available | Work hours only |
Troubleshooting
| Problem | Solution |
|---|---|
| Work profile creation fails | Make sure the device has enough free storage before starting enrollment |
| "Invalid token" error | Check that the token hasn't expired and verify the enterprise ID matches your AndroidNexus organization |
COPE
Corporate-Owned, Personally Enabled - full device management with a separate profile for personal use.
Prerequisites
- A new or factory-reset Android device
- An enrollment token with personal usage allowed on a company-owned policy
Available Methods
| Method | Best For | Setup Required |
|---|---|---|
| QR Code | Individual devices, quick setup | Camera and Wi-Fi on the device |
| Google Zero-Touch | Bulk corporate deployments | Devices assigned via an authorized reseller |
| DPC Identifier (AFW) | Manual setup when scanning isn't available | Typing afw#setup at the sign-in prompt |
All methods start by creating a policy with enrollment type set to COPE and the COPE-specific settings configured, then creating and applying an enrollment token as usual. Samsung Knox and NFC are not available as COPE enrollment methods.
Troubleshooting
| Problem | Solution |
|---|---|
| "Already managed" error | Factory reset the device first, then retry enrollment |
| Work profile does not appear after enrollment | Confirm the enrollment token's policy allows personal usage on a company-owned device (COPE), rather than a standard Fully Managed policy |
Best Practices
- Test enrollment on one device before bulk deployment
- Use descriptive token names to track enrollment batches
- Add tags to the enrollment token Tags make tracking and device updates quicker
- Set appropriate expiration - don't leave tokens active forever