How to enroll devices in Android Enterprise using QR code

Android Enterprise (formerly Android for Work) provides advanced management capabilities for business devices. Hexnode UEM supports QR code enrollment for three distinct Android Enterprise modes:

1. Device Owner: Full control (Corporate-owned).
2. Profile Owner: Work Profile (BYOD).
3. Work Profile on Company-Owned Device (WP-C): Work Profile on corporate hardware.

Prerequisite: Before proceeding, ensure you have enrolled your organization in the Android Enterprise program.

1. Enrollment as Device Owner (Fully Managed)

Use Case: Best for corporate-owned devices requiring full control. Only corporate-approved apps are available.

Supported Versions:

• Android 7.0+

Pre-condition: The device must be Factory Reset and have no personal Gmail account linked.

Step 1: Configure Enrollment Profile (Portal Side)

Before handling the device, ensure the correct QR code is ready in the Hexnode portal.

1. Navigate to Enroll > Platform-Specific > Android > Android Enterprise > Organization.
   1. Alternative Path: Enroll > All Enrollments > Enterprise > Android Enterprise > Organization or Admin > Android Enterprise > Organization.



2. A QR code for the default enrollment profile will be displayed.
3. Verify Profile Type: Ensure the Enterprise management type was set to Device Owner during the profile creation.
   1. Action: If you need to change the profile, select the desired profile from the dropdown or create a new one at Enroll > Platform-Specific > Android > Android Enterprise > Enrollment Profiles.
4. The QR code will update automatically based on the selected profile.

Critical Warning: Do not remove or delete the default enrollment profile from the Hexnode UEM console until the device has fully completed its enrollment. Doing so will cause the enrollment process to fail.

Step 2: Initiate Enrollment (Device Side)

1. Turn on the factory-reset device.
2. On the Welcome Screen (Language selection), tap the screen six times in the same spot.
3. Connect the device to a Wi-Fi network when prompted.
4. The device will automatically download and install a QR code reader.

Step 3: Scan and Configure

1. Open the QR code reader on the device and Scan the QR code displayed in the Hexnode portal (from Step 1).
2. Tap Accept & Continue to proceed with setting up the work device.
3. Follow the on-screen prompts to enable necessary Hexnode UEM app configurations:
   1. Device Administration
   2. Usage Access
   3. Draw Over Apps
4. Tap Next and complete the remaining setup steps.
5. Once finished, the device is successfully enrolled in Device Owner mode.

2. Enrollment as Profile Owner (BYOD)

Use Case: Best for personal devices (BYOD). Creates a separate “Work Profile” container. The IT admin controls only the Work Profile, not the personal data.

Supported Versions:

• Standard Android: 5.0 and above.
• Samsung Knox: 6.0 and above.

Step 1: Install the Hexnode App

1. Open the Google Play Store on the personal device.
2. Search for and install the Hexnode For Work app.

Step 2: Retrieve the QR Code (Portal Side)

1. Log in to the Hexnode UEM portal.
2. Navigate to Enroll > Platform-Specific > Android > QR Code, Email or SMS.
   1. Note: You can scan this code directly from the screen or send it to the user via email as an enrollment request.

Step 3: Scan and Enroll (Device Side)

1. Open the installed Hexnode For Work app.
2. Tap the QR code symbol on the screen to open the scanner.
3. Scan the QR code retrieved in Step 2.
4. Agreements: Agree to the End-User License Agreement to proceed.
5. Setup: Tap Continue to enter the work profile setup screen.
6. Follow the on-screen instructions.
   1. Note: The app may automatically minimize and relaunch after a few seconds. This is normal behaviour as the device creates the work profile.

Step 4: Finalize Enrollment

Once the work profile creation is complete, you will see two versions of the Hexnode app on the device:

1. Badged App: The app with the briefcase badge is the managed work app.
2. Unbadged App: The app without the badge was used for the initial setup.

Action Required: Open the Hexnode For Work app without the badge and tap Continue to uninstall it. This removes the setup agent, leaving only the managed work profile.

3. Enrollment as Work Profile on Company-Owned Device (WP-C)

Use Case: Corporate-owned devices that require data separation (Work vs. Personal) but are not fully locked down.

Supported Versions:

• Standard Android: 10.0 and above.
• Samsung Knox: 11.0 and above.

Pre-condition: The device must be Factory Reset.

Step 1: Configure Enrollment Profile (Portal Side)

1. Log in to the Hexnode UEM portal.
2. Navigate to Enroll > Platform-Specific > Android > Android Enterprise > Organization.
   1. Alternative Path: Enroll > All Enrollments > Enterprise > Android Enterprise > Organization.
3. A QR code for the default enrollment profile will be displayed.
4. Verify Profile Type: Ensure the selected enrollment profile has the Enterprise Management Type set to Work Profile on a company-owned device.
   1. Action: If you need to create a new profile with this setting, navigate to Enroll > Platform-Specific > Android > Android Enterprise > Enrollment Profiles.



5. The QR code will automatically update to reflect the selected profile configuration.

Critical Warning: Do not remove or delete the default enrollment profile from the Hexnode UEM console until the device enrollment is fully complete. Doing so will cause the process to fail.

Step 2: Initiate Enrollment (Device Side)

1. Turn on the factory-reset device.
2. On the Welcome Screen (Language Selection), tap the screen six times in the same spot.
3. Connect the device to a Wi-Fi network.
4. The device will automatically install a QR code reader.

Step 3: Scan and Setup

1. Scan: Use the device to scan the QR code displayed in the Hexnode portal (from Step 1).
   1. Note: The device will automatically connect to the Wi-Fi network configured in the portal profile (if applicable).
2. Accept: Tap Accept & Continue to begin setting up the work profile.
3. Agree: Accept the End-User License Agreement.
4. The system will now initiate enrollment, registering the device with Hexnode UEM and creating the managed work account.
5. Follow the on-screen prompts to complete the device setup.

Step 4: Finalize Configuration

Upon completion, you will see two Hexnode For Work apps on the device: one with a briefcase badge (Work) and one without (Personal/Setup).

1. Open the Hexnode For Work app without the badge.
2. Tap Continue to uninstall this setup app.
3. Your device is now fully enrolled in WP-C mode.

Frequently Asked Questions (FAQs)

Q1: What is the difference between “Device Owner” and “WP-C”?

• Device Owner: The organization has full control over the entire device. There is no separation for personal data.
• WP-C: The organization owns the device, but a “Work Profile” is created to separate corporate data from personal usage, offering the user privacy on a company device.

Q2: What is the main difference between Profile Owner and WP-C?

The primary difference is device ownership and the enrollment method:

• Profile Owner (BYOD): Designed for personal devices. The user initiates enrollment by downloading an app. The organization controls only the Work Profile.
• WP-C (Company-Owned): Designed for devices owned by the organization. Enrollment requires a factory reset (6-tap method). The organization controls the device’s lifecycle but allows a private “Personal” profile for the employee.

Troubleshooting

1. Error Message: “Your device is not authorized to be enrolled”

Description: This error occurs after entering the server name, indicating that the Hexnode portal is actively blocking the enrollment request based on current administrative rules.

Probable Causes:

• Platform Restrictions: The portal is configured to block Android device enrollment entirely.
• Pre-Enrollment Enforcement: The portal is configured to allow only pre-approved devices (imported via Serial Number/IMEI), and this specific device is not on the list.

Solution:

Step 1: Check Portal Restrictions

1. Log in to the Hexnode UEM portal as an Administrator.
2. Navigate to Admin > Enrollment.

Step 2: Update Enrollment Rules

1. Under Enrollment Restrictions, ensure the checkbox for Android is checked (allowed).
2. Check the Pre-approved Device only setting:
   1. If you are enrolling a new, ad-hoc device, uncheck this option.
   2. If you want to keep this option checked, you must first add the device’s Serial Number/IMEI to the Pre-enrolled devices list in the portal.
3. Save the settings and retry enrollment on the device.

2. Error Message: “Couldn’t find your Google Account”

Description: This error appears during Device Owner enrollment when using the DPC identifier afw#hexnodemdm.

Probable Cause: Factory Reset Protection (FRP) is active. The device was factory reset without first removing the previously synced Google account, locking the device to the original credentials.

Solution:

To resolve this, you must unlock the device and properly clear the account:

1. Unlock: Enter the credentials of the previously configured Google account to bypass the lock.
2. Remove Account: Once logged in, navigate to Settings > Accounts and remove the Google account.
3. Reset: Perform a Factory Reset on the device again.
4. Retry: Start the enrollment process from the beginning.