# Android Enterprise QR

> Source: https://docs.barcoder.ai/docs/standards/android-enterprise-qr
> research date 2026-10-30 · extracted at 2026-10-30
> Publisher: Barcoder — encyclopedia of QR, barcode and payment-code standards

Specifications:
- [Enroll and provision a device — Android Management API](https://developers.google.com/android/management/provision-device)
- [Provision devices — Google Play EMM API](https://developers.google.com/android/work/play/emm-api/prov-devices)
- [REST Resource: enterprises.enrollmentTokens — Android Management API](https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens)
- [DevicePolicyManager — Android API reference](https://developer.android.com/reference/android/app/admin/DevicePolicyManager)

## Overview

An **Android Enterprise provisioning QR code** is a [QR Code](https://docs.barcoder.ai/docs/standards/qr-code) scanned during the first-run setup of a new or factory-reset Android device. Its content is a UTF-8 JSON object of `android.app.extra.PROVISIONING_*` keys that tells the setup wizard which device policy controller (DPC, the management app) to download, how to verify it, and which network to use, after which the device comes up under management as a device owner <sup>[2][2]</sup> <sup>[6][6]</sup>.

Android 7.0 introduced the method <sup>[3][3]</sup>, and Google lists it as a required feature for fully managed devices <sup>[9][9]</sup>. The format is Google's: it is defined by Android's `DevicePolicyManager` extras and Google's enterprise developer documentation, not by a standards body.

## History

No source consulted names the people who designed the format. The dated milestones below come from Google's documentation and AOSP source.

- **Before QR.** The source comments for the checksum extras record SHA-1 hashes on Android 5.0 and 5.1 and SHA-256 from Android 6.0, so these provisioning extras predate QR delivery <sup>[5][5]</sup>. NFC bump provisioning has a 6.0 minimum in Google's current feature list <sup>[9][9]</sup>.
- **Android 7.0.** Google's release notes for enterprise state that QR codes can now provision corporate-liable devices, with the scan done in the setup wizard <sup>[3][3]</sup>.
- **August 2017.** Vendor support was still uneven. Consultant Jason Bayton found that MobileIron's agent could be provisioned by QR before it was officially supported, by comparing AirWatch's published JSON with a captured NFC payload and decompiling the APK to find the admin receiver. This account is third-party reverse engineering <sup>[15][15]</sup>.
- **Android 9.** The platform bundled a QR library and allowed Wi-Fi, time, time zone and locale to be carried in the code, so the device could join a network and continue with no manual entry <sup>[4][4]</sup>.
- **Android 10.** Checksums became SHA-256 only <sup>[5][5]</sup>.
- **Android 12.** A DPC that supports QR or another provisioning method must handle `ACTION_GET_PROVISIONING_MODE` and `ACTION_ADMIN_POLICY_COMPLIANCE`, or provisioning fails <sup>[8][8]</sup>.
- **2022 to 2024.** The maximum enrollment-token lifetime rose from 90 days to 10,000 years in 2022, and from May 2024 the token `get` and `list` methods return the `qrCode` field <sup>[7][7]</sup>.
- **November 2025.** Enrollment through the Android Management API began to require Android Enterprise registration and approval, effective 1 November <sup>[7][7]</sup>.

## Technical specification

**Carrier.** An ordinary [QR Code](https://docs.barcoder.ai/docs/standards/qr-code). Google specifies the content as a UTF-8 encoded JSON string <sup>[2][2]</sup> <sup>[6][6]</sup>. The Google pages consulted set no QR version or error-correction level, and Samsung tells developers that any third-party generator will do <sup>[20][20]</sup>.

**Starting the scan.** On the setup wizard's Welcome screen, the user taps six times in the same spot <sup>[2][2]</sup> <sup>[1][1]</sup> <sup>[16][16]</sup>; Microsoft's guide says only to tap the first screen repeatedly <sup>[18][18]</sup>. Google's Play EMM page then describes connecting to the internet so a QR reader can be downloaded through Google Play services <sup>[2][2]</sup>. From Android 9 a reader is preinstalled <sup>[18][18]</sup> <sup>[4][4]</sup>.

**After the scan.** The wizard downloads the DPC and starts device owner provisioning <sup>[2][2]</sup>. In AOSP's ManagedProvisioning app, QR counts as a trusted source and sets a dedicated trigger value <sup>[17][17]</sup>. The framework's `PROVISIONING_TRIGGER_QR_CODE` is 2, and the related activity action `ACTION_PROVISION_MANAGED_DEVICE_FROM_TRUSTED_SOURCE` is a hidden system API <sup>[5][5]</sup>.

### Payload keys

All names below take the prefix `android.app.extra.`.

- **Required.** `PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME`, the DPC's receiver in `package/class` form <sup>[2][2]</sup> <sup>[20][20]</sup>.
- **Required if the DPC is not installed.** `PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION`, plus a checksum <sup>[2][2]</sup>.
- **Checksum, one of two.** `PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM` hashes the APK, and `PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM` hashes any signing certificate. Both are URL-safe base64 SHA-256 values, and a mismatch shows an error that requires a factory reset <sup>[5][5]</sup>. Samsung's guide gives a shell recipe: SHA-256 digest, base64, swap `+/` for `-_`, strip `=` <sup>[20][20]</sup>.
- **Network.** `PROVISIONING_WIFI_SSID` and `PROVISIONING_WIFI_PASSWORD` are recommended when the device has no Wi-Fi <sup>[2][2]</sup>. `PROVISIONING_WIFI_SECURITY_TYPE` takes `NONE`, `WPA`, `WEP` or `EAP` <sup>[5][5]</sup>. Further keys cover hidden networks, proxy and PAC settings <sup>[4][4]</sup>, EAP identity, and CA and user certificates as base64 DER <sup>[5][5]</sup>. `PROVISIONING_USE_MOBILE_DATA` is a boolean; with a QR code and no SSID, the source comment says mobile data is always used <sup>[5][5]</sup>.
- **Localisation.** `PROVISIONING_LOCALE` (`xx_yy` form), `PROVISIONING_TIME_ZONE` and `PROVISIONING_LOCAL_TIME` (milliseconds) <sup>[5][5]</sup> <sup>[4][4]</sup>.
- **Behaviour.** `PROVISIONING_SKIP_ENCRYPTION` and `PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED` are booleans <sup>[5][5]</sup> <sup>[20][20]</sup>. `PROVISIONING_ALLOW_OFFLINE` lets provisioning continue without network access to a role-holder update <sup>[5][5]</sup>.
- **DPC data.** `PROVISIONING_ADMIN_EXTRAS_BUNDLE` is a nested object handed to the DPC after provisioning <sup>[5][5]</sup>. This is where an enrollment token goes.

The older `PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME` is deprecated in favour of the component name <sup>[5][5]</sup>.

### Official sample

Google's Android Management API page publishes this structure for its own DPC, Android Device Policy <sup>[1][1]</sup>. Microsoft prints the same keys and values with its own placeholder for the token <sup>[18][18]</sup>. `{enrollment-token}` is Google's placeholder:

```json
{
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.google.android.apps.work.clouddpc/.receivers.CloudDeviceAdminReceiver",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "I5YvS0O5hXY46mb01BlRjq4oJJGs2kuUcHvVkAPEXlg",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://play.google.com/managed/downloadManagingApp?identifier=setup",
  "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE": {
    "com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "{enrollment-token}"
  }
}
```

The Android Management API returns the ready string in the token's `qrCode` field, and Google warns to remove the escape backslashes when pasting it <sup>[6][6]</sup> <sup>[1][1]</sup>. Samsung's sample shows that JSON booleans are used for the flag keys <sup>[20][20]</sup>.

**Structurally illustrative only.** Adding Wi-Fi means three more top-level keys beside those above; these values are placeholders, not a working network:

```json
"android.app.extra.PROVISIONING_WIFI_SSID": "EXAMPLE-SSID",
"android.app.extra.PROVISIONING_WIFI_PASSWORD": "EXAMPLE-PASSWORD",
"android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE": "WPA"
```

### Size

Long key names make these symbols large. Worked examples, computed with segno 1.6.6 with no error-level boost, on compact JSON:

| Payload | Bytes | L | M | Q | H |
|---|---|---|---|---|---|
| Official sample above | 531 | v16 (81 × 81) | v18 (89 × 89) | v22 (105 × 105) | v25 (117 × 117) |
| Plus the three Wi-Fi keys | 713 | v18 (89 × 89) | v22 (105 × 105) | v25 (117 × 117) | v30 (137 × 137) |

The ceiling is QR's 2,953 bytes [[qr-ref]]. Bayton warns that certificate fields in particular add considerable data, and that larger payloads are less reliable to scan <sup>[13][13]</sup>.

### Security properties

- **Plain text.** A Wi-Fi password sits in the code in plaintext, so printed codes need handling as sensitive material <sup>[13][13]</sup> <sup>[11][11]</sup>. Enrollment tokens are also sensitive and should be revoked if exposed <sup>[14][14]</sup> <sup>[19][19]</sup>.
- **Token limits.** A token defaults to 1 hour of validity, can be limited to a single device with `oneTimeOnly`, and can require Google authentication at enrollment <sup>[6][6]</sup>.
- **Integrity.** The checksum protects the download, not the code: anyone holding a valid code can use it until the token expires or is revoked <sup>[5][5]</sup> <sup>[19][19]</sup>.

## Use cases

- **Corporate phones.** Fully managed devices are a named target of the method, and corporate-owned devices with a work profile can use it on Android 8 and later <sup>[1][1]</sup>. Microsoft Intune recommends QR enrollment for most customer scenarios <sup>[18][18]</sup>.
- **Kiosks and frontline devices.** Intune's dedicated-device mode covers single-purpose devices such as digital signage, ticket printing and inventory management. Each enrollment profile yields a token as both a string and a QR code <sup>[19][19]</sup>.
- **Shared devices.** An Intune token type can set up Microsoft Authenticator in Entra shared device mode during enrollment, giving single sign-in and sign-out across participating apps <sup>[19][19]</sup>.
- **Digital signage.** signageOS provisions ordinary Android 7+ tablets and phones with the six-tap method, passing its own module URL through the admin extras bundle <sup>[21][21]</sup>.
- **Android development.** Google's TestDPC sample publishes a QR code and JSON so developers can try device owner mode on a reset device <sup>[16][16]</sup>.
- **Batch staging.** A code can be printed and reused to set up a run of devices <sup>[11][11]</sup>.

## Implementations

| Project | Lang | Stars | Last active | Notes |
|---|---|---|---|---|
| [googlesamples/android-testdpc](https://github.com/googlesamples/android-testdpc) | Java | ~1.1k | 2026-09 | Google's sample DPC; README gives a ready QR code and payload <sup>[16][16]</sup> |
| [azoila/openmdm-android](https://github.com/azoila/openmdm-android) | Kotlin | 7 | 2026-09 | Young open-source agent; its README documents the QR path and the allowlist block <sup>[22][22]</sup> |
| [zxing/zxing](https://github.com/zxing/zxing) | Java | ~34.2k | 2026-10 | General QR library; the payload is plain text, so any QR encoder or decoder handles it <sup>[20][20]</sup> |

On the device, the receiving code is AOSP's ManagedProvisioning app, whose `ExtrasProvisioningDataParser` reads the extras <sup>[17][17]</sup>. It is hosted on Android's own Gitiles, so it has no GitHub star count. Bayton publishes browser generators for [custom DPCs](https://bayton.org/qr-generator-dpc/) and [Android Management API solutions](https://bayton.org/qr-generator); both state that data is processed locally and not stored <sup>[13][13]</sup> <sup>[14][14]</sup>.

No dedicated open-source decoder or validator for this payload turned up.

## Comparison

- **QR vs zero-touch.** Zero-touch needs Android 8.0 (Pixel 7.1) <sup>[1][1]</sup>, devices bought through an authorised reseller <sup>[18][18]</sup>, and no scan at all; devices re-enrol after a factory reset <sup>[11][11]</sup>. Choose zero-touch for reseller-bought fleets and QR for devices it doesn't cover <sup>[11][11]</sup>.
- **QR vs NFC.** NFC needs Android 6.0 <sup>[1][1]</sup> and is not supported for corporate-owned work profiles on Android 11 <sup>[1][1]</sup>. It carries the same properties, serialised as `java.util.Properties` rather than JSON <sup>[6][6]</sup>. Android 14 removed Android Beam, leaving tags only, according to Bayton, who suggests NFC where cameras are absent <sup>[11][11]</sup>.
- **QR vs DPC identifier (`afw#`).** The user types a short token where the wizard asks for an account, and a temporary account fetches the DPC <sup>[2][2]</sup>. It needs no code but suits fallback use, and it disables most system apps by default <sup>[11][11]</sup>. QR, by contrast, needs no Google identity by default <sup>[2][2]</sup>.
- **QR vs enrolment link.** For personally-owned devices, the [URL QR](https://docs.barcoder.ai/docs/standards/url-qr)-style enrolment link is the usual route, because the JSON method targets company-owned devices <sup>[1][1]</sup> <sup>[11][11]</sup>.
- **Provisioning payload vs [WiFi QR](https://docs.barcoder.ai/docs/standards/wifi-qr).** A `WIFI:` code only joins a network, and any camera app can read it [[wifi-ref]]. A provisioning code is read by the setup wizard and hands over the whole device.

Other onboarding-by-QR formats have their own pages: [Matter QR](https://docs.barcoder.ai/docs/standards/matter-qr), [HomeKit Setup Code](https://docs.barcoder.ai/docs/standards/homekit-setup-code), [Wi-Fi Easy Connect QR](https://docs.barcoder.ai/docs/standards/wi-fi-easy-connect-qr) and [eSIM Activation Code](https://docs.barcoder.ai/docs/standards/esim-activation-code).

## Fun facts

- AOSP's parser accepts abbreviated aliases for most keys, such as `a.a.e.PDACN` for the component name and `a.a.e.PWS` for the Wi-Fi SSID. It tries the long name first and falls back to the short one. The file gives no reason for them, and Google's published samples use the long forms <sup>[17][17]</sup>. Whether every setup wizard forwards them from a QR code is undocumented.
- `PROVISIONING_SKIP_EDUCATION_SCREENS` is offered by third-party generators <sup>[13][13]</sup>, but in AOSP's current parser the education-skip check returns false when the trigger is a QR code <sup>[17][17]</sup>.

## Status

**Active, with tightening control over which DPC may be installed.** Google's feature list, updated in October 2026, keeps QR provisioning as a required fully managed feature <sup>[9][9]</sup>. Google's help centre describes an allowlist of DPCs verified by Android Enterprise: anything else is blocked during enrollment with "App blocked to protect your device" <sup>[10][10]</sup>. The help page carries no effective date. Bayton says the change arrived in 2025 without a public announcement <sup>[12][12]</sup>, and the OpenMDM README says late 2025 and reports QR provisioning blocked on Google Mobile Services hardware for its unlisted agent <sup>[22][22]</sup>.

The practical effect is that a custom-built QR code still parses, but the DPC it names must be approved. Google's Play EMM API is also closed to new registrations <sup>[2][2]</sup>. Bayton reports that on Android 13 and later a payload with no Wi-Fi prompts the user to pick a network <sup>[11][11]</sup>, which sits awkwardly with the AOSP comment that QR without an SSID uses mobile data <sup>[5][5]</sup>; the two have not been reconciled here.

## Sources

[1]: https://developers.google.com/android/management/provision-device
[2]: https://developers.google.com/android/work/play/emm-api/prov-devices
[3]: https://developer.android.com/work/versions/android-7.0
[4]: https://developer.android.com/work/versions/android-9.0
[5]: https://raw.githubusercontent.com/aosp-mirror/platform_frameworks_base/main/core/java/android/app/admin/DevicePolicyManager.java
[6]: https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens
[7]: https://developers.google.com/android/management/release-notes
[8]: https://source.android.com/docs/devices/admin/provision
[9]: https://developers.google.com/android/work/requirements/fully-managed-device
[10]: https://support.google.com/work/android/answer/16694822
[11]: https://bayton.org/android/android-enterprise-provisioning-methods/
[12]: https://bayton.org/blog/2025/12/the-dpc-allowlist/
[13]: https://bayton.org/qr-generator-dpc/
[14]: https://bayton.org/qr-generator
[15]: https://bayton.org/2017/08/mobileiron-supports-qr-provisioning-for-android-enterprise-work-managed-devices-this-is-how-i-found-it/
[16]: https://github.com/googlesamples/android-testdpc
[17]: https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/refs/heads/main/src/com/android/managedprovisioning/parser/ExtrasProvisioningDataParser.java
[18]: https://learn.microsoft.com/en-us/intune/device-enrollment/android/ref-corporate-methods
[19]: https://learn.microsoft.com/en-us/intune/device-enrollment/android/setup-dedicated
[20]: https://docs.samsungknox.com/dev/knox-sdk/kbas/how-to-create-a-qr-code-to-enroll-a-device-into-android-enterprise-device-owner-do-mode/
[21]: https://docs.signageos.io/devices/device-provisioning/device-guides/android/android-tablets-and-phones-6-tap-provisioning
[22]: https://github.com/azoila/openmdm-android/blob/main/README.md
[qr-ref]: https://docs.barcoder.ai/source/standards/qr-code
[wifi-ref]: https://docs.barcoder.ai/source/standards/wifi-qr

[1] [Enroll and provision a device](https://developers.google.com/android/management/provision-device) — Android Management API, Google, updated 2026-08-04, accessed 2026
[2] [Provision devices](https://developers.google.com/android/work/play/emm-api/prov-devices) — Google Play EMM API, Google, updated 2025-08-28, accessed 2026
[3] [What's new in Android 7.0](https://developer.android.com/work/versions/android-7.0) — Android Developers, accessed 2026
[4] [What's in Android 9 for enterprise apps](https://developer.android.com/work/versions/android-9.0) — Android Developers, accessed 2026
[5] [DevicePolicyManager.java](https://raw.githubusercontent.com/aosp-mirror/platform_frameworks_base/main/core/java/android/app/admin/DevicePolicyManager.java) — Android Open Source Project (GitHub mirror), accessed 2026
[6] [REST Resource: enterprises.enrollmentTokens](https://developers.google.com/android/management/reference/rest/v1/enterprises.enrollmentTokens) — Android Management API, Google, updated 2026-06-15, accessed 2026
[7] [Release notes](https://developers.google.com/android/management/release-notes) — Android Management API, Google, accessed 2026
[8] [Device management: provisioning](https://source.android.com/docs/devices/admin/provision) — Android Open Source Project, updated 2026-09-22, accessed 2026
[9] [Fully managed device feature list](https://developers.google.com/android/work/requirements/fully-managed-device) — Android Enterprise, Google, updated 2026-10-23, accessed 2026
[10] [Approved Android Enterprise device policy controllers allowlist](https://support.google.com/work/android/answer/16694822) — Android Enterprise Help, Google, accessed 2026
[11] [Android Enterprise provisioning methods](https://bayton.org/android/android-enterprise-provisioning-methods/) — Jason Bayton, 2026 (third party)
[12] [Google Play Protect is now the custom DPC gatekeeper](https://bayton.org/blog/2025/12/the-dpc-allowlist/) — Jason Bayton, 2025 (third party)
[13] [Android Enterprise custom DPC provisioning generator](https://bayton.org/qr-generator-dpc/) — Jason Bayton, accessed 2026 (third party)
[14] [Android Enterprise AMAPI QR code generator](https://bayton.org/qr-generator) — Jason Bayton, accessed 2026 (third party)
[15] [MobileIron supports QR provisioning for Android Enterprise work-managed devices](https://bayton.org/2017/08/mobileiron-supports-qr-provisioning-for-android-enterprise-work-managed-devices-this-is-how-i-found-it/) — Jason Bayton, 2017 (third party)
[16] [android-testdpc](https://github.com/googlesamples/android-testdpc) — Google samples on GitHub, accessed 2026
[17] [ExtrasProvisioningDataParser.java](https://android.googlesource.com/platform/packages/apps/ManagedProvisioning/+/refs/heads/main/src/com/android/managedprovisioning/parser/ExtrasProvisioningDataParser.java) — Android Open Source Project, accessed 2026
[18] [Enroll Android Enterprise dedicated, fully managed, or corporate-owned work profile devices in Intune](https://learn.microsoft.com/en-us/intune/device-enrollment/android/ref-corporate-methods) — Microsoft Learn, 2026
[19] [Set up Intune enrollment for Android Enterprise dedicated devices](https://learn.microsoft.com/en-us/intune/device-enrollment/android/setup-dedicated) — Microsoft Learn, 2026
[20] [How to create a QR code to enroll a device into Android Enterprise Device Owner (DO) mode](https://docs.samsungknox.com/dev/knox-sdk/kbas/how-to-create-a-qr-code-to-enroll-a-device-into-android-enterprise-device-owner-do-mode/) — Samsung Knox, accessed 2026
[21] [Android tablets and phones: 6-tap provisioning](https://docs.signageos.io/devices/device-provisioning/device-guides/android/android-tablets-and-phones-6-tap-provisioning) — signageOS, accessed 2026
[22] [openmdm-android README](https://github.com/azoila/openmdm-android/blob/main/README.md) — OpenMDM project, accessed 2026

## Deployments

_No country reports mention this standard by name._

## Regions / aggregations not mapped to a single country

- Universal