Provisioning Android Devices with NFC

Owned by Kari Mattsson
2019-08-01
5 min read

NFC provisioning is used for provisioning company-issued Work Managed Devices ("device owner mode"), typically in COBO scenarios. They are also the recommended methods when provisioning a large number of devices. The task is typically done by support personnel when giving out the devices to the users.

With either NFC or QR code (see Provisioning Android Devices with a QR Code) provisioning, you can provision devices using another Android device and a compatible provisioning app. The two methods are almost identical, but NFC provisioning is significantly easier, as using a QR code requires setting up the network manually. Nevertheless, it may work in devices in which NFC does not. The recommended app to use is NFC Device Provisioner, which is also used for QR code provisioning.

See the following video for a quick introduction to NFC provisioning. As entering the installation code is done after the initial setup, adding the device in the EMM service can be done either before or during process, and you could also operate with imported device configurations.

The target device must support the provisioning method; it should generally have Android 5.0 or newer. It must be in initial condition (new or wiped). For NFC provisioning, it must support NFC.

Setting up the NFC Device Provisioner

Before starting to provision devices, you need to install the NFC Device Provisioner app and make its basic configuration.

  1. Download the NFC Device Provisioner app to another device that supports NFC with Android 4.1 or newer.
    Latest version is the Play Store. Alternatively install the APK manually from here.

  2. Start the NFC Device Provisioner.

    The settings are initially empty and you need to fill them.

  3. Configure the required options in the app. The options describe the client application, its download location, and the WiFi environment used to download the file. Some options may only be used in certain target device Android versions.

    Component name

    Enter the following value: eu.mysync.android.dm/eu.mysync.android.dm.receiver/MysyncDeviceAdmin

    Package name

    Enter the following value: eu.mysync.android.dm

    APK download URL

    Enter a working URL to the EMM client installer file for the organisation. For example: https://myserver.com/mysync.apk.

    Note – In the examples given here, we use the mySync client, but the actual EMM client depends on your service provider.

    The URL depends on where you are hosting the file. You can usually get it from the EMM service. To find the URL, 1) navigate to Devices→Applications, 2) uncheck Hide system applications, 3) select the Android EMM client that you are using, 4) click Edit, and 5) see the Web URL field. You can also use the Short URL, which is usually shorter and easier to type.

    You need to type in in the provisioning device manually.

    After entering the URL, press the Download& Calculate Hash Value button to test the URL and to calculate the SHA1 hash for the file.

    SHA values

    Click Download & Calculate Hash Value to calculate these values. The SHA values must be recalculated if the installer file changes later.

    Locale

    Locale string that controls which language to use on device. The current locale of the provisioning device is used by default.

    Time zone

    Time zone string that controls which time zone is used on device. The current time zone of the provisioning device is used by default.

    WiFi SSID and WiFi Password

    These settings allow the target device to connect to the internet. It is required for downloading the apps to be installed.

    WiFi hidden checkbox

    Enable if the WiFi SSID is hidden

    Installation code

    Installation code to use for the particular device. You get an automatically generated installation code when you create the new device and can find it later in the Send initial settings to device view.

    Service URL (optional)

    These parameters are for the EMM client app, which can be entered either in the target device or here. The service URL depends on the EMM server used. It usually it looks like "https://<server.com>/rest/api".

    Leave all system apps enabled

    Select this to keep all system apps (preloaded apps) enabled. If disabled, the user cannot use them (unless enabled later with policies).

    Skip encryption

    Select this to avoid the encryption step in provisioning.

The entered values are automatically saved, so that you do not need to re-enter them later.

For example:

You can leave this view on, as provisioning is done with it.

Provisioning a Device

Resetting the Target Device

Before a device can be provisioned with NFC or QR code, it must be in the initial state, such as a new device. If not, you need to perform wipe for it to reset it to initial state.

  • If the device is previously managed by the EMM service, you can wipe it in Devices→Inventory by selecting the device and clicking Execute on selected devices→Wipe device to factory settings.
  • If the device is unmanaged, you can reset it manually in the Android settings menu.

Notice

On some rare occasion, wiping a managed device may leave protections that prevent provisioning with NFC or QR code. In such case, it may help that you initialise the device as an ordinary user and then wipe it again manually from Android settings.

After the reset, the device will begin the setup process.

Do not continue from the first step!

Do not continue. NFC or QR code provisioning can only be done at this first screen.

Provisioning with NFC

To provision devices, you need to have the working Android device with the NFC Device Provisioner app installed, as described earlier.

Do the following:

  1. Start the NFC Device Provisioner in the provisioning device
  2. Check that the parameters are correct (see above)
  3. Hold the two devices close to each other, back-to-back. You should hear a happy beep (unhappy beep indicates trouble and you should see an error message).
  4. Tap the screen as instructed to beam the NFC message.
  5. The target device starts setting up. This may take for a while.
  6. You are asked to enter the installation code

    Using the QR code is usually the easiest.
  7. In the Devices→Inventory view:
    1. If necessary create the device if not already created
    2. Click Execute on selected devices...
    3. Click Send initial settings to device
      You should now see the installation code as well as the QR code.
  8. Click In a QR code image in the target device
  9. Scan the QR code with the target device
  10. The device is now set up. Confirm by clicking Start <app name> (the actual client app depends on your EMM service provider)
  11. The client app should now start