Android Enterprise 编辑

Android Enterprise is a set of tools and services provided by Google as an enterprise management solution for Android devices. With Android Enterprise:

• You use Endpoint Management to manage company-owned and bring your own device (BYOD) Android devices.
• You can manage the entire device or a separate profile on the device. The separate profile isolates business accounts, apps, and data from personal accounts, apps, and data.
• You can also manage devices dedicated to a single use, such as inventory management. For an overview from Google of what Android Enterprise can do, see Android Enterprise Management.

Resources:

• For a list of terms and definitions related to Android Enterprise, see the Google Android Enterprise developers guide article, Android Enterprise terminology. Google updates these terms frequently.

• For a list of Android operating systems supported for Endpoint Management, see Supported device operating systems.

• For information about the outbound connections to consider when setting up network environments for Android Enterprise, see the Google support article, Android Enterprise Network Requirements.

• For information about deploying Android Enterprise, see Deploy resources).

Getting started with Android Enterprise

Important:

Device administration mode is no longer supported. If your users have devices in device administration mode, see Migrate from device administration to Android Enterprise. After your devices are migrated to Android Enterprise, use the following steps to set up Android Enterprise devices.

One-time setup

1. Create a managed Google Play account.

   See Using managed Google Play with Endpoint Management and Requirements.

2. Bind your Google Play account to Endpoint Management.

   See Connecting Endpoint Management to Google Play.

3. Plan how you want to manage devices.

   See Device deployment scenarios and profiles.

4. Plan enrollment security for user devices.

   See Enrollment security.

5. Prepare to deliver MDX-enabled apps.

   Use the MAM SDK to develop apps. Or, if you aren’t ready to transition to the new SDK, use the command-line based MDX Toolkit to wrap the apps.

   See MAM SDK overview.

At this point, you’re prepared to configure your Android Enterprise devices with app and devices policies, enrollment profiles, and apps. See the following section for guidance.

Configure devices

1. Create delivery groups.

   Control who gets what resources and when they get them. See Deploy resources.

   We’ll stop delivering apps published for the legacy DA platform to devices enrolled in Android Enterprise. For Android Enterprise devices, publish apps for the Android Enterprise platform. To continue to publish legacy DA apps to devices in DA mode, create a separate delivery group for those apps. See Deprecation.

2. Add apps. You can approve the apps in Google Play directly from the Endpoint Management console.

   See the Google support article, Manage apps in your organization.

3. Create enrollment profiles.

   Specify device and app management enrollment options. See Device deployment scenarios and profiles and Creating enrollment profiles.

   • When you deploy an Android Enterprise public app store app to an Android device user, that user is automatically enrolled in Android Enterprise.
   • Zero-touch enrollment allows you to configure devices to enroll automatically when they’re first powered on. See Zero-touch enrollment.

4. Configure device and app policies.

   Balance enterprise security with user privacy and user experience. See Configure Android Enterprise device and app policies.

5. Distribute apps.

   You use managed Google Play to add, buy, and approve apps for deployment to the Android Enterprise workspace on a device. Users can only install apps from managed Google Play that you make available for them.

   See:

   • Distribute Android Enterprise apps
   • Managed configurations policy
   • App permissions policy

6. Configure security actions to monitor and provide compliance.

   See Security actions.

Using managed Google Play with Endpoint Management

When you integrate Endpoint Management with managed Google Play to use Android Enterprise, you create an enterprise. Google defines an enterprise as binding between the organization and your enterprise mobile management (EMM) solution. All the users and devices that the organization manages through your solution belong to its enterprise.

An enterprise for Android Enterprise has three components: an EMM solution, a device policy controller (DPC) app, and a Google enterprise app platform. When you integrate Endpoint Management with Android Enterprise, the complete solution has these components:

• Citrix Endpoint Management: The Citrix EMM. Endpoint Management is the unified endpoint management for a secure digital workspace. Endpoint Management provides the means for IT administrators to manage devices and apps for their organizations.
• Citrix Secure Hub: The Citrix DPC app. Secure Hub is the launchpad for Endpoint Management. Secure Hub enforces policies on the device.
• Managed Google Play: A Google enterprise app platform that integrates with Endpoint Management. The Google Play EMM API sets app policies and distributes apps.

This illustration shows how administrators interact with these components and how the components interact with each other:

Note:

You can use either managed Google Play or Google Workspace (formerly G Suite) to register Citrix as your EMM provider. This article discusses using Android Enterprise with managed Google Play. If your organization uses Google Workspace to provide access to apps, you can use it with Android Enterprise. See Legacy Android Enterprise for Google Workspace customers.

When you use managed Google Play, provision managed Google Play Accounts for devices and end users. Managed Google Play Accounts provide access to managed Google Play, allowing users to install and use the apps you make available. If your organization uses a third-party identity service, you can link managed Google Play Accounts with your existing identity accounts.

Because this type of enterprise isn’t tied to a domain, you can create more than one enterprise for a single organization. For example, each department or region within an organization can enroll as a different enterprise. Using different enterprises lets you manage separate sets of devices and apps.

For Endpoint Management administrators, managed Google Play combines the user experience and app store features of Google Play with a set of management features designed for enterprises. You use managed Google Play to add, buy, and approve apps for deployment to the Android Enterprise workspace on a device. You can use Google Play to deploy public apps, private apps, and third-party apps.

For users of managed devices, managed Google Play is the enterprise app store. Users can browse apps, view app details, and install them. Unlike the public version of Google Play, users can only install apps from managed Google Play that you make available for them.

Device deployment scenarios and profiles

Device deployment scenarios refer to who owns the devices you deploy and how you manage them. Device profiles refer to how the DPC manages and enforces policies on devices.

A work profile isolates business accounts, apps, and data from personal accounts, apps, and data. Work profiles and personal profiles are separated at an OS level. For more details about work profiles, see What is a work profile.

Important:

When Android Enterprise devices update to Android 11, Google migrates devices managed as “fully managed with a work profile” to a new security-enhanced work profile experience. The new enrollment mode is called “work profile on corporate-owned devices.” For more information, see Changes ahead for Android Enterprise’s Fully Managed with Work Profile. For Android 12 devices, see Security and privacy enhancements for work profile.

* Users can share a dedicated device. When a user signs on to an app on a dedicated device, the state of their work is with the app, not the device.

** Endpoint Management does not support Zebra devices as in BYOD work profile mode. Endpoint Management supports Zebra devices as fully managed devices and in device legacy mode (also called device admin mode).

Enrollment security

Enrollment profiles determine whether Android devices enroll in MAM, MDM, or MDM+MAM, with the option for users to opt out of MDM.

For information about specifying the level of security and required enrollment steps, see User accounts, roles, and enrollment.

Endpoint Management supports the following authentication methods for Android devices enrolled in MDM or MDM+MAM. For information, see the following articles:

• Domain or domain plus security token authentication
• Client certificate or certificate plus domain authentication
• Identity providers:
  • Authentication with Azure Active Directory through Citrix Cloud (Preview)
  • Authentication with Okta through Citrix Cloud (Preview)

A rarely used authentication method is client certificate plus security token. For information, see https://support.citrix.com/article/CTX215200.

Requirements

Before you start using Android Enterprise, you need:

• Accounts and credentials:

  • To set up Android Enterprise with managed Google Play, a corporate Google account
  • To download the latest MDX files, a Citrix customer account

• Firebase Cloud Messaging (FCM) and a Connection scheduling device policy configured for Endpoint Management. See Firebase Cloud Messaging and Connection scheduling device policy.

Connecting Endpoint Management to Google Play

To set up Android Enterprise for your organization, register Citrix as your EMM provider through managed Google Play. That setup connects managed Google Play to Endpoint Management and creates an enterprise for Android Enterprise in Endpoint Management.

You need a corporate Google account to sign in to Google Play.

1. In the Endpoint Management console, go to Settings > Android Enterprise.

2. Click Connect. Google Play opens.

1. Sign in to Google Play with your corporate Google account credentials. Enter your organization name and confirm that Citrix is your EMM provider.

2. An enterprise ID is added for Android Enterprise. To enable Android Enterprise, slide Enable Android Enterprise to Yes.

   

Your Enterprise ID appears in the Endpoint Management console.

Your environment is connected to Google and is ready to manage the devices. You can now provide apps for users.

Endpoint Management can provide users with Citrix mobile productivity apps, MDX apps, public app store apps, web and SaaS apps, enterprise apps, and web links. For more information on giving these types of apps to users, see Distribute Android Enterprise apps.

The following section shows how to provide mobile productivity apps.

Providing Citrix mobile productivity apps to Android Enterprise users

Giving Citrix mobile productivity apps to Android Enterprise users requires these steps.

1. Publish the apps as MDX apps. See Configure apps as MDX apps.

2. Configure the rules for the security challenge your users use to access the work profiles on their devices. See Configure security challenge policy.

The apps you publish are available to devices enrolled in your Android Enterprise enterprise.

Note:

When you deploy an Android Enterprise public app store app to an Android user, that user is automatically enrolled in Android Enterprise.

Configure apps as MDX apps

To configure a Citrix productivity app as an MDX app for Android Enterprise:

1. In the Endpoint Management console, click Configure > Apps. The Apps page appears.

   

2. Click Add. The Add App dialog box appears.

   

3. Click MDX. The App Information page appears.

4. On the left side of the page, select Android Enterprise as the platform.

5. On the App Information page, type the following information:

   • Name: Type a descriptive name for the app. This name appears under App Name on the Apps table.
   • Description: Type an optional description of the app.
   • App category: Optionally, in the list, click the category to which you want to add the app. For more information about app categories, see About app categories.

6. Click Next. The Android Enterprise MDX App page appears.

7. Click Upload and navigate to the file location of the .mdx files for the app. Select the file and click Open.

8. The UI notifies you if the attached application requires approval from the managed Google Play store. To approve the application without leaving the Citrix Endpoint Management console, click Yes.

   

9. When the managed Google Play store page opens, click Approve.

   

10. Click Approve again.

11. Select Keep approved when app requests new permissions. Click Save.

    

12. When the app is approved and saved, more settings appear on the page. Configure these settings:

    • File name: Type the file name associated with the app.
    • App Description: Type a description for the app.
    • Product track: Specify which product track that you want to push to user devices. If you have a track designed for testing, you can select and assign it to your users. The default is Production.
    • App version: Optionally, type the app version number.
    • Package ID: The URL of the app in the Google Play store.
    • Minimum OS version: Optionally, type the oldest operating system version that the device can run to use the app.
    • Maximum OS version: Optionally, type the most recent operating system that the device must run to use the app.
    • Excluded devices: Optionally, type the manufacturer or models of devices that can’t run the app.

13. Configure the MDX Policies. For more information about app policies for MDX apps, see MDX Policies at a Glance and MAM SDK overview.

14. Configure the deployment rules. For information, see Deploy resources.

15. Expand Store Configuration. This setting doesn’t apply to Android Enterprise apps, which appear only in managed Google Play.

    

    Optionally, you can add an FAQ for the app or screen captures that appear in the app store. You can also set whether users can rate or comment on the app.

    • Configure these settings:
      • App FAQ: Add FAQ questions and answers for the app.
      • App screenshots: Add screen captures to help classify the app in the app store. The graphic you upload must be a PNG. You can’t upload a GIF or JPEG image.
      • Allow app ratings: Select whether to allow a user to rate the app. The default is On. Allow app comments: Select whether to allow users to comment about the selected app. The default is On.

16. Click Next. The Approvals page appears.

    

    You use workflows when you need approval when creating user accounts. If you don’t want to set up approval workflows, you can skip to Step 15.

    Configure these settings to assign or create a workflow:

    • Workflow to Use: In the list, click an existing workflow or click Create a new workflow. The default is None.
    • If you select Create a new workflow, configure these settings. For more information, see Create and manage workflows.
    • Name: Type a unique name for the workflow.
    • Description: Optionally, type a description for the workflow.
    • Email Approval Templates: In the list, select the email approval template to be assigned. When you click the eye icon to the right of this field, a dialog box appears where you can preview the template.
    • Levels of manager approval: In the list, select the number of levels of manager approval required for this workflow. The default is 1 level. Possible options are:
      • Not Needed
      • 1 level
      • 2 levels
      • 3 levels
    • Select Active Directory domain: In the list, select the appropriate Active Directory domain to be used for the workflow.
    • Find additional required approvers: Type the name of the additional required person in the search field and then click Search. Names originate in the Active Directory.
    • When the name appears in the field, select the check box next to the name. The name and email address appear in the Selected additional required approvers list.
      • To remove a person from the Selected additional required approvers list, do one of the following:
        • Click Search to see a list of all the persons in the selected domain.
        • Type a full or partial name in the search box, and then click Search to limit the search results.
        • Persons in the Selected additional required approvers list have check marks next to their name in the search results list. Scroll through the list and clear the check box next to each name you want to remove.

17. Click Next. The Delivery Group Assignment page appears.

    

18. Next to Choose delivery groups, type to find a delivery group or select a group or groups in the list. The groups you select appear in the Delivery groups to receive app assignment list.

19. Expand Deployment Schedule and then configure the following settings:

    • Next to Deploy, click On to schedule deployment or click Off to prevent deployment. The default option is On.
    • Next to Deployment schedule, click Now or Later. The default option is Now.
    • If you click Later, click the calendar icon and then select the date and time for deployment.
    • Next to Deployment condition, click On every connection or click Only when previous deployment has failed. The default option is On every connection.

    • Next to Deploy for always-on connection, make sure that Off is selected. The default option is Off. The always-on connections aren’t available for Android Enterprise to customers who began using Endpoint Management with version 10.18.19 or later. We don’t recommend the connections for customers who began using Endpoint Management before version 10.18.19.

      This option applies when you’ve configured the scheduling background deployment key in Settings > Server Properties.

      The deployment schedule that you configure is the same for all platforms. Any changes you make apply to all platforms, except for Deploy for always-on connection.

20. Click Save.

Repeat the steps for each mobile productivity app.

Configure security challenge policy

The Endpoint Management Passcode device policy configures security challenge rules. The challenges appear when users access their devices or the Android Enterprise work profiles on their devices. A security challenge can be a passcode or biometric recognition. For more information about the Passcode policy, see Passcode device policy.

• If your Android Enterprise deployment includes BYOD devices, configure the passcode policy for the work profile.
• If your deployment includes, company-owned, fully managed devices, configure the passcode policy for the device itself.
• If your deployment includes both types of devices, configure both types of passcode policy.

To configure the passcode policy:

1. In the Endpoint Management console, go to Configure > Device Policies.

2. Click Add.

3. Click Show filter to show the Policy Platform pane. In the Policy Platform pane, select Android Enterprise.

4. Click Passcode on the right pane.

1. Enter a Policy Name. Click Next.

   

2. Configure the Passcode policy settings.
   • Set Device passcode required to On to see the settings available for security challenges for the device itself.
   • Set Work profile security challenge to On to see the settings available for work profile security challenges.

3. Click Next.

4. Assign the policy to one or more delivery groups.

5. Click Save.

Creating enrollment profiles

Enrollment profiles control how Android devices are enrolled if Android Enterprise in enabled for your Endpoint Management deployment. When you create an enrollment profile to enroll Android Enterprise devices, you can configure the enrollment profile to enroll new and factory reset devices as:

• Fully managed devices
• Dedicated devices
• Fully managed devices with a work profile/Work profile on corporate-owned devices

You can also configure each of these Android Enterprise enrollment profiles to enroll BYOD Android devices as work profile devices.

If Android Enterprise is enabled for your Endpoint Management deployment, all newly enrolled or reenrolled Android devices are enrolled as Android Enterprise devices. By default, the Global enrollment profile enrolls new and factory reset Android devices as fully managed devices and enrolls BYOD Android devices as work profile on corporate-owned devices.

When you create enrollment profiles, you assign delivery groups to them. If a user belongs to multiple delivery groups that have different enrollment profiles, the name of the delivery group determines the enrollment profile used. Endpoint Management selects the delivery group that appears last in an alphabetized list of delivery groups. For more information, see Enrollment profiles.

Add an enrollment profile for fully managed devices

The Global enrollment profile enrolls fully managed devices by default, but you can create more enrollment profiles to enroll fully managed devices.

1. In the Endpoint Management console, go to Configure > Enrollment Profiles.

2. To add an enrollment profile, click Add. In the Enrollment Info page, type a name for the enrollment profile.

3. Set the number of devices that members with this profile can enroll.

4. Select Android under Platforms or click Next. The Enrollment Configuration page appears.

5. Set Management to Android Enterprise.

6. Set Device owner mode to Company-owned device.

   

7. BYOD work profile allows you to configure the enrollment profile to enroll BYOD devices as work profile devices. New and factory reset devices are enrolled as fully managed devices. Set BYOD work profile to On to allow enrollment of BYOD devices as work profile devices. Set BYOD work profile to Off to restrict enrollment to fully managed devices. Default is On.

8. Choose whether to enroll devices in Citrix MAM.

9. If you set BYOD work profile to On, configure user consent. To allow users of BYOD work profile devices to decline device management when they enroll their devices, set Allow users to decline device management to On.

   If BYOD work profile is set to On, the default value of Allow users to decline device management is On. If BYOD work profile is set to Off, then Allow users to decline device management is disabled.

10. Select Assignment (options). The Delivery Group Assignment screen appears.

11. Choose the delivery group or delivery groups containing the administrators who enroll fully managed devices. Then click Save.

    The Enrollment Profile page appears with the profile that you added.

Add a dedicated device enrollment profile

When your Endpoint Management deployment includes dedicated devices, a single Endpoint Management administrator or small group of administrators enroll many dedicated devices. To make sure that these administrators can enroll all the devices required, create an enrollment profile for them with unlimited devices allowed per user.

1. In the Endpoint Management console, go to Configure > Enrollment Profiles.

2. To add an enrollment profile, click Add. In the Enrollment Info page, type a name for the enrollment profile. Set to Unlimited the number of devices members with this profile can enroll.

3. Select Android under Platforms or click Next. The Enrollment Configuration page appears.

4. Set Management to Android Enterprise.

5. Set Device owner mode to Dedicated device.

   

6. BYOD work profile allows you to configure the enrollment profile to enroll BYOD devices as work profile devices. New and factory reset devices are enrolled as dedicated devices. Set BYOD work profile to On to allow enrollment of BYOD devices as work profile devices. Set BYOD work profile to Off to restrict enrollment to company-owned devices. Default is On.

7. Choose whether to enroll devices in Citrix MAM.

8. If you set BYOD work profile to On, configure user consent. To allow users of BYOD work profile devices to decline device management when they enroll their devices, set Allow users to decline device management to On.

   If BYOD work profile is set to On, the default value of Allow users to decline device management is On. If BYOD work profile is set to Off, then Allow users to decline device management is disabled.

9. Select Assignment (options). The Delivery Group Assignment screen appears.

10. Choose the delivery group or delivery groups containing the administrators who enroll the dedicated devices. Then click Save.

    The Enrollment Profile page appears with the profile that you added.

Add an enrollment profile for fully managed devices with a work profile / work profile on corporate-owned devices

1. In the Endpoint Management console, go to Configure > Enrollment Profiles.

2. To add an enrollment profile, click Add. In the Enrollment Info page, type a name for the enrollment profile.

3. Set the number of devices that members with this profile can enroll.

4. Select Android under Platforms or click Next. The Enrollment Configuration page appears.

5. Set Management to Android Enterprise. Set Device owner mode to Fully managed with work profile / Work profile on corporate-owned devices.

   

6. BYOD work profile allows you to configure the enrollment profile to enroll BYOD devices as work profile devices. New and factory reset devices are enrolled as fully managed devices with a work profile. Set BYOD work profile to On to allow enrollment of BYOD devices as work profile devices. Set BYOD work profile to Off to restrict enrollment to dedicated devices. Default is Off.

7. Choose whether to enroll devices in Citrix MAM.

8. If you set BYOD work profile to On, configure user consent. To allow users of BYOD work profile devices to decline device management when they enroll their devices, set Allow users to decline device management to On.

   If BYOD work profile is set to On, the default value of Allow users to decline device management is On. If BYOD work profile is set to Off, then Allow users to decline device management is disabled.

9. Select Assignment (options). The Delivery Group Assignment screen appears.

10. Choose the delivery group or delivery groups containing the administrators who enroll fully managed devices with a work profile. Then click Save.

    The Enrollment Profile page appears with the profile that you added.

Adding an enrollment profile for legacy devices

Google deprecated the device administrator mode of device management. Google encourages customers to manage all Android devices in device owner mode or profile owner mode. (See Device admin deprecation in the Google Android Enterprise developer guides.)

To support this change:

• Citrix made Android Enterprise the default enrollment option for Android devices.
• If Android Enterprise is enabled for your Endpoint Management deployment, all newly enrolled or re-enrolled Android devices are enrolled as Android Enterprise devices.

Your organization might not be ready to begin managing legacy Android devices using Android Enterprise. In that case, you can continue to manage them in device administrator mode. For devices already enrolled in device administrator mode, Endpoint Management continues to manage them in device administrator mode.

Create an enrollment profile for legacy devices to allow new Android device enrollments to use device administrator mode.

To create an enrollment profile for legacy devices:

1. In the Endpoint Management console, go to Configure > Enrollment Profiles.

2. To add an enrollment profile, click Add. In the Enrollment Info page, type a name for the enrollment profile.

3. Set the number of devices that members with this profile can enroll.

4. Select Android under Platforms or click Next. The Enrollment Configuration page appears.

5. Set Management to Legacy device administration (not recommended). Click Next.

   

6. Choose whether to enroll devices in Citrix MAM.

7. To allow users to decline device management when they enroll their devices, set Allow users to decline device management to On. Default is On.

8. Select Assignment (options). The Delivery Group Assignment screen appears.

9. Choose the delivery group or delivery groups containing the administrators who enroll the dedicated devices. Then click Save.

The Enrollment Profile page appears with the profile that you added.

To continue managing legacy devices in device administrator mode, enroll or re-enroll them using this profile. You enroll device administrator devices similar to work profile devices, by having users download Secure Hub and giving an enrollment server URL.

Provisioning Android Enterprise work profile devices

Android Enterprise work profile devices are enrolled in profile owner mode. These devices do not need to be new or factory reset. BYOD devices are enrolled as work profile devices. The enrollment experience is similar to Android enrollment in Endpoint Management. Users download Secure Hub from Google Play and enroll their devices.

By default, the USB Debugging and Unknown Sources settings get disabled on a device when you enroll the device in Android Enterprise as a work profile device.

When enrolling devices in Android Enterprise as work profile devices, always go to Google Play. From there, enable Secure Hub to appear in the user’s personal profile.

Provisioning Android Enterprise fully managed devices

You can enroll fully managed devices in the deployment you set up in the previous sections. Fully managed devices are company-owned devices and are enrolled in device owner mode. Only new or factory reset devices can be enrolled in device owner mode.

You can enroll devices in device owner mode using any of these enrollment methods:

• DPC identifier token: With this enrollment method, users enter the characters afw#xenmobile when setting up the device. afw#xenmobile is the Citrix DPC identifier token. This token identifies the device as managed by Endpoint Management and downloads Secure Hub from the Google Play store. See Enrolling devices using the Citrix DPC identifier token.
• Near field communication (NFC) bump: The NFC bump enrollment method transfers data through between two devices using near-field communication. Bluetooth, Wi-Fi, and other communication modes are disabled on a new or factory-reset device. NFC is the only communication protocol that the device can use in this state. See Enrolling devices with NFC bump.
• QR code: QR code enrollment can be used to enroll a distributed fleet of devices that do not support NFC, such as tablets. The QR code enrollment method sets up and configures device profile mode by scanning a QR code from the setup wizard. See Enrolling devices using a QR code.
• Zero-touch: Zero-touch enrollment allows you to configure devices to enroll automatically when they’re first powered on. Zero-touch enrollment is supported on some Android devices running Android 9.0 or later. See Zero-touch enrollment.
• Google Accounts: Users enter their Google Account credentials to start the provisioning process. This option is for enterprises using Google Workspace.

Enrolling devices using the Citrix DPC identifier token

Users enter afw#xenmobile when prompted to enter a Google account after powering on new or factory reset devices for initial setup. This action downloads and installs Secure Hub. Users then follow the Secure Hub set-up prompts to complete the enrollment.

System requirements

• Supported on all Android devices running the Android OS.

To enroll the device

1. Power on a new or factory reset device.

2. The initial device setup loads and prompts for a Google account. If the device loads the home screen of the device, check the notification bar for a Finish Setup notification.

   

3. Enter afw#xenmobile in the Email or phone field.

   

4. Tap Install on the Android Enterprise screen prompting to install Secure Hub.

5. Tap Install on the Secure Hub installer screen.

6. Tap Allow for all app permission requests.

7. Tap Accept & Continue to install Secure Hub and allow it to manage the device.

8. Secure Hub is now installed and on the default enrollment screen. In this example, AutoDiscovery isn’t set up. If it was, the user can enter their username/email and a server would be found for them. Instead, enter the enrollment URL for the environment and tap Next.

   

9. The default configuration for Endpoint Management allows users to choose if they use MAM or MDM+MAM. If prompted in this way, tap Yes, Enroll to choose MDM+MAM.

10. Enter the user email address and password, then tap Next.

11. The user is prompted to configure a device passcode. Tap Set and enter a passcode.

12. The user is prompted to configure a work profile unlock method. For this example, tap Password, tap PIN, and enter a PIN.

13. The device is now on the Secure Hub My Apps landing screen. Tap Add apps from Store.

14. To add Secure Web, tap Secure Web.

    

15. Tap Add.

    

16. Secure Hub directs the user to the Google Play store to install Secure Web. Tap Install.

    

17. After Secure Web is installed, tap Open. Enter a URL from an internal site in the address bar and verify that the page loads.

    

18. Go to Settings > Accounts on the device. Observe that the Managed Account can’t be modified. The developer options for sharing screen or remote debugging are also blocked.

    

Enrolling devices with NFC bump

To enroll a device as a fully managed device using NFC bumps requires two devices: One that is reset to its factory settings and one running the Endpoint Management Provisioning Tool.

System requirements and prerequisites

• Supported Android devices.
• A new or factory-reset device with the NFC feature, provisioned for Android Enterprise as a fully managed device. See the section on Provisioning Android Enterprise fully managed devices.
• Another device with the NFC feature, running the configured Provisioning Tool. The Provisioning Tool is available in Secure Hub or on the Citrix downloads page.

Each device can have only one Android Enterprise profile. In this case, the profile is for managed Secure Hub. Trying to add a second DPC app removes the installed Secure Hub.

Data transferred through the NFC bump

Provisioning a factory-reset device requires you to send the following data through an NFC bump to initialize Android Enterprise:

• Package name of the DPC app that acts as device owner (in this case, Secure Hub).
• Intranet/Internet location from which the device can download the DPC app.
• SHA-256 hash of the DPC app to verify if the download is successful.
• Wi-Fi connection details so that a factory-reset device can connect and download the DPC app. Note: Android now does not support 802.1x Wi-Fi for this step.
• Time zone for the device (optional).
• Geographic location for the device (optional).

When the two devices are bumped, the data from the Provisioning Tool is sent to the factory-reset device. That data is then used to download Secure Hub with administrator settings. If you don’t enter time zone and location values, Android automatically configures the values on the new device.

Configuring the Endpoint Management Provisioning Tool

Before doing an NFC bump, you must configure the Provisioning Tool. This configuration is then transferred to the factory-reset device during the NFC bump.

You can type data into the required fields or populate them by using a text file. The steps in the next procedure describe how to configure the text file with descriptions for each field. The app doesn’t save information after you type it, so you might want to create a text file to keep the information for future use.

To configure the Provisioning Tool by using a text file

Name the file nfcprovisioning.txt and place the file in the /sdcard/ folder on the SD card of the device. The app can then read the text file and populate the values.

The text file must have the following data:

android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION=<download_location>

This line is the intranet/internet location of the EMM provider app. After the factory-reset device connects to Wi-Fi following the NFC bump, the device must have access to this location for downloading. The URL is a regular URL, with no special formatting required.

android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM=<SHA-256 hash>

This line is the checksum of the EMM provider app. This checksum is used to verify that the download is successful. Steps to get the checksum are discussed later in this article.

android.app.extra.PROVISIONING_WIFI_SSID=<wifi ssid>

This line is the connected Wi-Fi SSID of the device on which the Provisioning Tool is running.

android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE=<wifi security type>

Supported values are WEP and WPA2. If the Wi-Fi is unprotected, this field must be empty.

android.app.extra.PROVISIONING_WIFI_PASSWORD=<wifi password>

If the Wi-Fi is unprotected, this field must be empty.

android.app.extra.PROVISIONING_LOCALE=<locale>

Enter language and country codes. The language codes are two-letter lowercase ISO language codes (such as en) as defined by ISO 639-1. The country codes are two-letter uppercase ISO country codes (such as US) as defined by ISO 3166-1. For example, type en_US for English as spoken in the United States. If you don’t type any codes, the country and language are automatically populated.

android.app.extra.PROVISIONING_TIME_ZONE=<timezone>

The time zone in which the device is running. Type the database name of the area/location. For example, type America/Los_Angeles for Pacific time. If you don’t type a name, the time zone automatically populates.

android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_NAME=<package name>

This data isn’t required, because the value is hardcoded into the app as Secure Hub. It’s mentioned here only for the sake of completion.

If there’s Wi-Fi protected using WPA2, a completed nfcprovisioning.txt file might look like the following:

android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION=https://www.somepublicurlhere.com/path/to/securehub.apk

android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM=ga50TwdCmfdJ72LGRFkke4CrbAk\u003d

android.app.extra.PROVISIONING_WIFI_SSID=Protected_WiFi_Name

android.app.extra.PROVISIONING_WIFI_SECURITY_TYPE=WPA2

android.app.extra.PROVISIONING_WIFI_PASSWORD=wifiPasswordHere

android.app.extra.PROVISIONING_LOCALE=en_US

android.app.extra.PROVISIONING_TIME_ZONE=America/Los_Angeles

If there’s unprotected Wi-Fi, a completed nfcprovisioning.txt file might look like the following:

android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION=https://www.somepublicurlhere.com/path/to/securehub.apk

android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM=ga50TwdCmfdJ72LGRFkke4CrbAk\u003d

android.app.extra.PROVISIONING_WIFI_SSID=Unprotected_WiFi_Name

android.app.extra.PROVISIONING_LOCALE=en_US

android.app.extra.PROVISIONING_TIME_ZONE=America/Los_Angeles

To get the checksum of Citrix Secure Hub

The checksum of Secure Hub is a constant value: qn7oZUtheu3JBAinzZRrrjCQv6LOO6Ll1OjcxT3-yKM. To download an APK file for Secure Hub, use the following Google Play store link: https://play.google.com/managed/downloadManagingApp?identifier=xenmobile.

To get an app checksum

Prerequisites:

• The apksigner tool from the Android SDK Build Tools
• OpenSSL command line

To get the checksum of any app, follow these steps:

1. Download the app’s APK file from the Google Play store.

2. In the OpenSSL command line, navigate to the apksigner tool: android-sdk/build-tools/<version>/apksigner and type the following:

   apksigner verify -print-certs <apk_path> | perl -nle 'print $& if m{(?<=SHA-256 digest:) .*}'  | xxd -r -p | openssl base64 | tr -d '=' | tr -- '+/=' '-_'
   <!--NeedCopy-->