How to enroll Android devices with/without Camera and/or Google Play Services support?

Generally, mobile devices used for work have built-in cameras and support Google Play Services. However, in a few organizations, such as those related to Defence and high-security red zones, devices with cameras are prohibited for security reasons. Google Play Services may also not be supported in specific devices or regions. In some cases, a device may not support both. For management of these devices using MDM, different enrollment methods are available to suit each case. The cases and methods have been discussed below.

• Devices with no Camera nor Google Play Services support
  In this case, the Communication Type needs to set to Periodic, followed by enrollment via NFC or ADB methods. Follow the steps given below for ADB enrollment.
  

  Steps to enroll via ADB:

  This method is recommended for Device Owner provisioning only when the Android device cannot be provisioned using Near-Field Communication (NFC). This Android provisioning method can also be used for enrolling devices without Google Services as Device Owner (fully managed corporate device). As the name suggests this method uses Android Debug Bridge (or ADB) to provision devices as Device Owner and is applicable for devices running 5.0 or later versions.

  Steps for provisioning

  These are the steps you should provision in the mobile device to configure ADB enrollment:

  1. Factory reset the mobile device to be managed, if it is already in use or boot up if it is a new device.
  2. Follow the on-screen instructions to configure basic device settings and ensure you do not have any Google account logged in or syncing any data.
  3. Go to Settings > About Device, and tap on the Build Number for 7 times to enable Developer mode.
  4. Now, navigate back to Settings and select Developer Options . Then enable USB debugging.

  

  5. Click Allow to confirm the USB Debugging pop-up appearing on the device.

  

  6. Again navigate back to Settings and select Security. Enable Install from unknown sources (only applicable for devices with OS version lesser than or equal to 7.1.1 )
  7. Now connect your device to the Mac machine or Windows machine which is used to configure ADB Enrollment.
  8. Enable the option Transferring files on the mobile device to which the USB is connected.
  9. In the machine download the Device Owner provisioning tool from the following link for Windows or Mac.
     Note:

     The Device Owner Provisioning file should be downloaded once every 2 months to get the updated app. The updated app can be pushed to new devices or be used for future enrollments.

  10. After downloading, extract all the files in the zip file to a location on your machine.
  11. Now open the Command prompt (for a windows device) or terminal (for a Mac device).
  12. Open the zip file folder in the command prompt/terminal and execute the command makedeviceowner.bat for windows or makedeviceowner.sh for Mac OS.
  13. The ME MDM app will be installed, and the Device owner profile will be configured after the successful execution of the command. If the execution is successful, you can see a success message in the command prompt as shown below:
      • For Windows

      

      • For Mac

      

  14. Now open the ME MDM app, you can either scan the QR code from EMM Enrollment using the barcode scanner present on the device or paste the JSON data copied from ZTE/Knox Enrollment.

  

  15. You can then assign users to the enrolled devices either individually or in bulk using a CSV file, to complete enrollment.

  Troubleshooting tips

• While trying to enroll a Xiaomi device, the command makedeviceowner.bat does not get executed and displays an error.

A few Xiaomi devices cannot be enrolled using ADB enrollment method if MIUI optimization is turned on. To enroll these devices, turn off MIUI optimization by navigating to Settings ->Build number. Tap on the build number 6 to 8 times to enable Developer options and disable MIUI optimization. Perform the above mentioned steps again to successfully enroll these devices.

• Devices with Camera but no support for Google Play Services
  In this case, the devices can be enrolled using EMM Token Enrollment, Android Debug Bridge (ADB), or Near-Field Communication (NFC) methods. Prior to enrollment, on the MDM console, navigate to Enrollment->ME MDM app (under Android), set Communication Type to Periodic, and save the changes.


• Devices with both Camera and Google Play Services support
  These device can be enrolled using any of the enrollment methods listed here.

NOTE:

• If you were unable to enter the JSON data, contact mdm-support@manageengine.com (MDM On-premises) or mdmcloud-support@manageengine.com (MDM Cloud).
• Devices with a low camera resolution can also be enrolled using the enrollment methods for devices without a camera.

• Devices without Google Services:

Android devices that do not support Google Mobile Services can be added via NFC enrollment or Android Debug Bridge(ADB) enrollment methods. To enroll devices running android 9.0 and above via EMM Token enrollment, contact Support.
The following functionalities are also different for these devices:

• Instant Agent-Server Communication : MDM uses Google Firebase messaging to communicate with the devices. Since this is not possible, the devices communicate with the server directly, once every 60 minutes. Note: If the frequency of contacting the server has to be changed, please contact Support.
• Silent installation of Play Store apps : Silent installation of Play store apps is dependent on Google Play Services and hence, is not available. However, features are in development so that when an app is published in the MDM app catalog, it redirects the device user to the native app store to install, if the particular app is available.
• Enterprise Factory Reset Protection : Not supported.
• SafetyNet Attestation : Not supported.
• Google Play Protect : Not available because it is part of Google Play services.