Skip to content
barcoder

Standards/android-enterprise-qr

Android Enterprise QR

TypeQR Data Format
Completeness76%high

Overview

An Android Enterprise provisioning QR code is a QR Code scanned during the first-run setup of a new or factory-reset Android device. Its content is a UTF-8 JSON object of android.app.extra.PROVISIONING_* keys that tells the setup wizard which device policy controller (DPC, the management app) to download, how to verify it, and which network to use, after which the device comes up under management as a device owner 2 6.

Android 7.0 introduced the method 3, and Google lists it as a required feature for fully managed devices 9. The format is Google's: it is defined by Android's DevicePolicyManager extras and Google's enterprise developer documentation, not by a standards body.

History

No source consulted names the people who designed the format. The dated milestones below come from Google's documentation and AOSP source.

  • Before QR. The source comments for the checksum extras record SHA-1 hashes on Android 5.0 and 5.1 and SHA-256 from Android 6.0, so these provisioning extras predate QR delivery 5. NFC bump provisioning has a 6.0 minimum in Google's current feature list 9.
  • Android 7.0. Google's release notes for enterprise state that QR codes can now provision corporate-liable devices, with the scan done in the setup wizard 3.
  • August 2017. Vendor support was still uneven. Consultant Jason Bayton found that MobileIron's agent could be provisioned by QR before it was officially supported, by comparing AirWatch's published JSON with a captured NFC payload and decompiling the APK to find the admin receiver. This account is third-party reverse engineering 15.
  • Android 9. The platform bundled a QR library and allowed Wi-Fi, time, time zone and locale to be carried in the code, so the device could join a network and continue with no manual entry 4.
  • Android 10. Checksums became SHA-256 only 5.
  • Android 12. A DPC that supports QR or another provisioning method must handle ACTION_GET_PROVISIONING_MODE and ACTION_ADMIN_POLICY_COMPLIANCE, or provisioning fails 8.
  • 2022 to 2024. The maximum enrollment-token lifetime rose from 90 days to 10,000 years in 2022, and from May 2024 the token get and list methods return the qrCode field 7.
  • November 2025. Enrollment through the Android Management API began to require Android Enterprise registration and approval, effective 1 November 7.

Technical specification

Carrier. An ordinary QR Code. Google specifies the content as a UTF-8 encoded JSON string 2 6. The Google pages consulted set no QR version or error-correction level, and Samsung tells developers that any third-party generator will do 20.

Starting the scan. On the setup wizard's Welcome screen, the user taps six times in the same spot 2 1 16; Microsoft's guide says only to tap the first screen repeatedly 18. Google's Play EMM page then describes connecting to the internet so a QR reader can be downloaded through Google Play services 2. From Android 9 a reader is preinstalled 18 4.

After the scan. The wizard downloads the DPC and starts device owner provisioning 2. In AOSP's ManagedProvisioning app, QR counts as a trusted source and sets a dedicated trigger value 17. The framework's PROVISIONING_TRIGGER_QR_CODE is 2, and the related activity action ACTION_PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE is a hidden system API 5.

Payload keys

All names below take the prefix android.app.extra..

  • Required. PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME, the DPC's receiver in package/class form 2 20.
  • Required if the DPC is not installed. PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION, plus a checksum 2.
  • Checksum, one of two. PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM hashes the APK, and PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM hashes any signing certificate. Both are URL-safe base64 SHA-256 values, and a mismatch shows an error that requires a factory reset 5. Samsung's guide gives a shell recipe: SHA-256 digest, base64, swap +/ for -_, strip = 20.
  • Network. PROVISIONING_WIFI_SSID and PROVISIONING_WIFI_PASSWORD are recommended when the device has no Wi-Fi 2. PROVISIONING_WIFI_SECURITY_TYPE takes NONE, WPA, WEP or EAP 5. Further keys cover hidden networks, proxy and PAC settings 4, EAP identity, and CA and user certificates as base64 DER 5. PROVISIONING_USE_MOBILE_DATA is a boolean; with a QR code and no SSID, the source comment says mobile data is always used 5.
  • Localisation. PROVISIONING_LOCALE (xx_yy form), PROVISIONING_TIME_ZONE and PROVISIONING_LOCAL_TIME (milliseconds) 5 4.
  • Behaviour. PROVISIONING_SKIP_ENCRYPTION and PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED are booleans 5 20. PROVISIONING_ALLOW_OFFLINE lets provisioning continue without network access to a role-holder update 5.
  • DPC data. PROVISIONING_ADMIN_EXTRAS_BUNDLE is a nested object handed to the DPC after provisioning 5. This is where an enrollment token goes.

The older PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME is deprecated in favour of the component name 5.

Official sample

Google's Android Management API page publishes this structure for its own DPC, Android Device Policy 1. Microsoft prints the same keys and values with its own placeholder for the token 18. {enrollment-token} is Google's placeholder:

{
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "I5YvS0O5hXY46mb01BlRjq4oJJGs2kuUcHvVkAPEXlg",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://play.google.com/managed/downloadManagingApp?identifier=setup",
  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
    "com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "{enrollment-token}"
  }
}

The Android Management API returns the ready string in the token's qrCode field, and Google warns to remove the escape backslashes when pasting it 6 1. Samsung's sample shows that JSON booleans are used for the flag keys 20.

Structurally illustrative only. Adding Wi-Fi means three more top-level keys beside those above; these values are placeholders, not a working network:

"android.app.extra.PROVISIONING_WIFI_SSID": "EXAMPLE-SSID",
"android.app.extra.PROVISIONING_WIFI_PASSWORD": "EXAMPLE-PASSWORD",
"android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE": "WPA"

Size

Long key names make these symbols large. Worked examples, computed with segno 1.6.6 with no error-level boost, on compact JSON:

Payload Bytes L M Q H
Official sample above 531 v16 (81 × 81) v18 (89 × 89) v22 (105 × 105) v25 (117 × 117)
Plus the three Wi-Fi keys 713 v18 (89 × 89) v22 (105 × 105) v25 (117 × 117) v30 (137 × 137)

The ceiling is QR's 2,953 bytes [qr-ref]. Bayton warns that certificate fields in particular add considerable data, and that larger payloads are less reliable to scan 13.

Security properties

  • Plain text. A Wi-Fi password sits in the code in plaintext, so printed codes need handling as sensitive material 13 11. Enrollment tokens are also sensitive and should be revoked if exposed 14 19.
  • Token limits. A token defaults to 1 hour of validity, can be limited to a single device with oneTimeOnly, and can require Google authentication at enrollment 6.
  • Integrity. The checksum protects the download, not the code: anyone holding a valid code can use it until the token expires or is revoked 5 19.

Use cases

  • Corporate phones. Fully managed devices are a named target of the method, and corporate-owned devices with a work profile can use it on Android 8 and later 1. Microsoft Intune recommends QR enrollment for most customer scenarios 18.
  • Kiosks and frontline devices. Intune's dedicated-device mode covers single-purpose devices such as digital signage, ticket printing and inventory management. Each enrollment profile yields a token as both a string and a QR code 19.
  • Shared devices. An Intune token type can set up Microsoft Authenticator in Entra shared device mode during enrollment, giving single sign-in and sign-out across participating apps 19.
  • Digital signage. signageOS provisions ordinary Android 7+ tablets and phones with the six-tap method, passing its own module URL through the admin extras bundle 21.
  • Android development. Google's TestDPC sample publishes a QR code and JSON so developers can try device owner mode on a reset device 16.
  • Batch staging. A code can be printed and reused to set up a run of devices 11.

Implementations

Project Lang Stars Last active Notes
googlesamples/android-testdpc Java ~1.1k 2026-09 Google's sample DPC; README gives a ready QR code and payload 16
azoila/openmdm-android Kotlin 7 2026-09 Young open-source agent; its README documents the QR path and the allowlist block 22
zxing/zxing Java ~34.2k 2026-10 General QR library; the payload is plain text, so any QR encoder or decoder handles it 20

On the device, the receiving code is AOSP's ManagedProvisioning app, whose ExtrasProvisioningDataParser reads the extras 17. It is hosted on Android's own Gitiles, so it has no GitHub star count. Bayton publishes browser generators for custom DPCs and Android Management API solutions; both state that data is processed locally and not stored 13 14.

No dedicated open-source decoder or validator for this payload turned up.

Comparison

  • QR vs zero-touch. Zero-touch needs Android 8.0 (Pixel 7.1) 1, devices bought through an authorised reseller 18, and no scan at all; devices re-enrol after a factory reset 11. Choose zero-touch for reseller-bought fleets and QR for devices it doesn't cover 11.
  • QR vs NFC. NFC needs Android 6.0 1 and is not supported for corporate-owned work profiles on Android 11 1. It carries the same properties, serialised as java.util.Properties rather than JSON 6. Android 14 removed Android Beam, leaving tags only, according to Bayton, who suggests NFC where cameras are absent 11.
  • QR vs DPC identifier (afw#). The user types a short token where the wizard asks for an account, and a temporary account fetches the DPC 2. It needs no code but suits fallback use, and it disables most system apps by default 11. QR, by contrast, needs no Google identity by default 2.
  • QR vs enrolment link. For personally-owned devices, the URL QR-style enrolment link is the usual route, because the JSON method targets company-owned devices 1 11.
  • Provisioning payload vs WiFi QR. A WIFI: code only joins a network, and any camera app can read it [wifi-ref]. A provisioning code is read by the setup wizard and hands over the whole device.

Other onboarding-by-QR formats have their own pages: Matter QR, HomeKit Setup Code, Wi-Fi Easy Connect QR and eSIM Activation Code.

Fun facts

  • AOSP's parser accepts abbreviated aliases for most keys, such as a.a.e.PDACN for the component name and a.a.e.PWS for the Wi-Fi SSID. It tries the long name first and falls back to the short one. The file gives no reason for them, and Google's published samples use the long forms 17. Whether every setup wizard forwards them from a QR code is undocumented.
  • PROVISIONING_SKIP_EDUCATION_SCREENS is offered by third-party generators 13, but in AOSP's current parser the education-skip check returns false when the trigger is a QR code 17.

Status

Active, with tightening control over which DPC may be installed. Google's feature list, updated in October 2026, keeps QR provisioning as a required fully managed feature 9. Google's help centre describes an allowlist of DPCs verified by Android Enterprise: anything else is blocked during enrollment with "App blocked to protect your device" 10. The help page carries no effective date. Bayton says the change arrived in 2025 without a public announcement 12, and the OpenMDM README says late 2025 and reports QR provisioning blocked on Google Mobile Services hardware for its unlisted agent 22.

The practical effect is that a custom-built QR code still parses, but the DPC it names must be approved. Google's Play EMM API is also closed to new registrations 2. Bayton reports that on Android 13 and later a payload with no Wi-Fi prompts the user to pick a network 11, which sits awkwardly with the AOSP comment that QR without an SSID uses mobile data 5; the two have not been reconciled here.

Sources

1 Enroll and provision a device — Android Management API, Google, updated 2026-08-04, accessed 2026 2 Provision devices — Google Play EMM API, Google, updated 2025-08-28, accessed 2026 3 What's new in Android 7.0 — Android Developers, accessed 2026 4 What's in Android 9 for enterprise apps — Android Developers, accessed 2026 5 DevicePolicyManager.java — Android Open Source Project (GitHub mirror), accessed 2026 6 REST Resource: enterprises.enrollmentTokens — Android Management API, Google, updated 2026-06-15, accessed 2026 7 Release notes — Android Management API, Google, accessed 2026 8 Device management: provisioning — Android Open Source Project, updated 2026-09-22, accessed 2026 9 Fully managed device feature list — Android Enterprise, Google, updated 2026-10-23, accessed 2026 10 Approved Android Enterprise device policy controllers allowlist — Android Enterprise Help, Google, accessed 2026 11 Android Enterprise provisioning methods — Jason Bayton, 2026 (third party) 12 Google Play Protect is now the custom DPC gatekeeper — Jason Bayton, 2025 (third party) 13 Android Enterprise custom DPC provisioning generator — Jason Bayton, accessed 2026 (third party) 14 Android Enterprise AMAPI QR code generator — Jason Bayton, accessed 2026 (third party) 15 MobileIron supports QR provisioning for Android Enterprise work-managed devices — Jason Bayton, 2017 (third party) 16 android-testdpc — Google samples on GitHub, accessed 2026 17 ExtrasProvisioningDataParser.java — Android Open Source Project, accessed 2026 18 Enroll Android Enterprise dedicated, fully managed, or corporate-owned work profile devices in Intune — Microsoft Learn, 2026 19 Set up Intune enrollment for Android Enterprise dedicated devices — Microsoft Learn, 2026 20 How to create a QR code to enroll a device into Android Enterprise Device Owner (DO) mode — Samsung Knox, accessed 2026 21 Android tablets and phones: 6-tap provisioning — signageOS, accessed 2026 22 openmdm-android README — OpenMDM project, accessed 2026

Deployments

No country reports mention this standard by name.

Regions / aggregations not mapped to a single country

  • Universal
source · content/standards/android-enterprise-qr/index.md