Zero-touch enrollment for IT admins

Open the zero-touch iframe in your EMM console. For details on where to find the iframe, contact your EMM provider.

1. On the landing page of the iframe, click Next.

2. Log in with the Google account you provided to your reseller.
3. Select the zero-touch account you wish to link to your enterprise and click Link.

4. You will see a screen with basic information about the zero-touch configuration that your zero-touch enabled devices will use. If you want to add or update your EMM configurations, click Configuration info. After reviewing this information, click Next.

5. Enter the support information that will be displayed to users during their device setup if they need assistance.

6. Click Save.

Open the portal and sign in with the Google account.

For instructions for device users on how to use zero-touch enrollment, see the instructions for users.

Portal languages

You can use the portal in one of the following languages:

American English, British English, Danish, Dutch, French, German, Italian, Japanese, Norwegian, Polish, Portuguese, Spanish, or Swedish.

To change to another language, update the preferred language in your Google Account. For more help, follow the instructions in Change language.

Follow the steps below to check your account's role:

1. Open the portal.
2. Click Users in the sidebar.
3. Look in the Role column to see your account's role.

Before you start, check your account role to ensure that it's Owner. You must be an owner to add team members. Give portal access to new team members by following the steps below:

1. Ask your team member to associate a Google Account with their corporate email. Your team member can follow the instructions in Associate a Google Account.
2. Open the portal.
3. Click Users in the sidebar.
4. Click Add user.
5. Set Email address to the team member's corporate email.
6. Select a Role from the dropdown.
7. Click Add.

The portal doesn't notify your team members that they have access so you must remember to inform them yourself.

Before you start, check your account role to ensure that it's Owner. You need to be an account owner to delete team members. To remove a team member's access to the portal, follow the steps below:

1. Open the portal.
2. Click Users in the sidebar.
3. Hover over the row for the user you wish to remove
4. Before you proceed, check that the account is correct.
5. Select Delete. Before deletion is completed the portal provides a warning message to ensure you wish to go ahead with deletion. You must click the delete button again to confirm.

If you accidentally delete an account, re-add it by following the instructions in Add team members above.

Before you start, check your account role to ensure that it's Owner. You need to be an account owner to edit team members' roles. To change the role of a team member, follow the steps below:

1. Open the portal.
2. Click Users in the sidebar.
3. Click Edit for the account you want to change.
4. Select a Role from the dropdown.
5. Click Save.

Before you add a configuration, check that you have access to your EMM console. You’ll need to copy and paste your mobile policy data from your EMM console to the portal. To add a configuration for your organization's devices, follow the steps below:

1. Open the portal. You might need to sign in.

2. Click Configurations in the navigation panel.

3. Click  Add Configuration.

Use the notes below to help you complete the new configuration panel. Once you've created a configuration, we recommend you set a default configuration.

Choose a default configuration that zero-touch enrollment applies to any new devices your organization purchases in the future. Follow the steps below:

1. Open the portal. You might need to sign in.

2. Click Configurations in the navigation panel.

3. Click on the edit icon and select the configuration you want applied to new devices in the Default configuration panel.

4. Click Save.

To customize the table on the Devices tab:

1. Go to the Devices tab.
2. On the upper right corner, beside the Add Device button, click the three dots.
3. Select Customize table.
4. Select the check boxes for the information you’d like to display.
5. Click Save.

You can apply a configuration one device at a time by selecting devices in the portal. Follow the steps below:

1. Open the portal. You might need to sign in.

2. Click Devices in the navigation panel.

3. Find the device you want to apply the configuration to—using its IMEI or serial number.

4. Click on the Edit and select configuration you want to apply or select None to temporarily remove the device from zero-touch enrollment.

5. Click Save.

You apply a configuration to devices by uploading a CSV file. A CSV text file represents a data table, and each line represents a row in that table. Commas separate the values in that row.

Each row in your CSV file lists the fields that include:

• The ID of the configuration you want to apply.

• A hardware identifier of the device you want to apply the configuration to.

Prepare a CSV file containing your device and configuration information. You can download a sample file and fill the profiletype and profileid field to get started. Alternatively, if you want to start with a blank file, learn about the fields needed by reading Device configuration CSV file format.

The largest CSV file you can upload to the portal is 50 MB. If you have more than 50 MB of data, consider splitting the file into smaller files. When you've prepared your CSV file, follow the steps below:

1. Open the portal. You might need to sign in.

2. Click Devices in the navigation panel.

3. Click More in the Devices table header.

4. Click Apply configurations from .CSV.

5. Select your CSV file from the file picker.

6. Click Upload.

After the file uploads, the portal processes the data rows. When processing finishes, the portal shows a notification with an upload status. You also receive an email summarizing the processing of your CSV data. Click the See details button in the email to open a status page. The status page lists each device that wasn't assigned a configuration with a reason for the error.

If you close your browser window after the CSV file uploads, the backend server continues to process your data. To know when the portal finishes processing your data, check your email inbox for the status email. When you receive the processing summary email, check for any errors.

To apply a configuration to devices, you upload a CSV file. The following snippet shows the CSV field format with example values to apply the configuration to a device identified by the IMEI number:

You can also use the serial, manufacturer, and model fields:

You can also register both types of devices from the same CSV file:

The following table shows the field values you use in your CSV file:

You can deregister devices from zero-touch enrollment. You might need to deregister a device when you transfer ownership. You can deregister one device at a time by selecting devices in the portal.

1. Open the portal. You might need to sign in.

2. Click Devices in the navigation panel.

3. Find the device you want to delete—using its IMEI or serial number.
4. Click Remove in the device row.

5. Click Remove in the confirmation panel.

Bulk deregister devices

Deregistering multiple devices in bulk can be done using a device configuration CSV file. To do this:

1. Create a device configuration CSV file including every device you wish to deregister.
2. Replace the 'profileid' column in this CSV file with a column titled 'owner', and set the values in this column to 0.
3. Re-upload the CSV to your portal.

Each audit log entry contains the following fields:

You can filter audit logs based on the following criteria:

• Start date: The beginning of the range that will be filtered for the search.
• End date: The end of the range that will be filtered for the search.
• IMEI or serial number: Search for logs related to a specific device.

To export audit logs as a CSV file, follow the steps below:

1. Filter for your desired logs following the steps in the “Searching audit logs” section above.
2. Click the three dots  next to the search bar.
3. Select "Download results as .csv".

The export CSV file contains the following fields:

Devices eligible for zero-touch enrollment need to be purchased directly from an enterprise reseller or Google partner and not through a consumer store. Reseller partners are listed in Android's Enterprise Solutions Directory.

Supported devices vary by reseller. From September 2020, selected resellers can offer any Android device with zero touch, with other resellers continuing to offer zero-touch on a selected number of devices. The ability to assign any device running Android Pie (9.0) or later for zero-touch enrollment will expand to all resellers by the end of 2020.

Most EMM providers (for Android) support zero-touch enrollment. A list of compatible EMMs can be found in the Android site's Partners list.

Many EMMs also implement the zero-touch iframe to simplify the process of setting up zero-touch devices after you purchase them from a reseller. To see if this feature is available, contact your EMM provider.

You can request your device reseller to register for the Android Enterprise Partner Program where they can then apply to become a zero-touch reseller.

You manage zero-touch enrollment for your organization from an online portal in your web browser. We call this the zero-touch enrollment portal, or often just the "portal" when describing zero-touch enrollment. Use this document, and your EMM’s documentation, to help you complete the following steps:

1. Purchase your devices from a reseller who sets up a zero-touch enrollment account for your organization.

2. Create a configuration in the portal that consists of your EMM choice and mobile policies.

3. Link your enterprise to your zero-touch account using the zero-touch iframe, or, use the zero-touch console to either set a default configuration or manually apply your configuration to a range of devices .

You can also use the portal to:

• Activate and deactivate the resellers from whom your organization purchases devices.

• Control access to the portal for users in your organization.

To display the second IMEI in the zero-touch portal:

1. Go to the Devices tab.
2. On the upper right corner, beside the Add Device button, click the three dots.
3. Select Customize table.
4. Select the checkbox for IMEI2.
5. Click Save.

First, check that the device is registered for zero-touch enrollment using the portal. Find the device using the hardware identifier, such as the IMEI number. If you don’t find the device, contact the device reseller and ask them to register the device.

Next, confirm that you applied a configuration to the device. Find the device using the portal, and check that the Configuration column of the table isn’t listed as No config. Devices without a configuration aren’t provisioned through zero-touch enrollment and boot unmanaged.

If you make either of the changes above, you’ll need to factory reset the device so that zero-touch enrollment provisions it.

Finally, check that the device has a working data connection when it's being set up. Zero-touch enrollment needs a connection to Google servers. The connection can be ethernet, Wi-Fi, or cellular data. If you're using cellular data when roaming, note that the setup wizard blocks the use of roaming data by default.

If there's no data connection, or if the connection blocks traffic to Google servers, then the zero-touch enrollment flow is skipped. If zero-touch enrollment is skipped but the device has a configuration, then the device resets itself after the first connection to Google servers. The system warns the person using the device one hour before the reset.

When your device is registered for zero-touch enrollment, it starts up and shows the Your device at work panel explaining the device is managed. Even after a factory reset.

First, confirm that the device isn’t registered with your organization for zero-touch enrollment. Find the device in the portal using a hardware identifier, such as the IMEI number. If you find the device, click Deregister.

Next, contact the organization that’s attempting to enroll the device. Start by following the steps below:

1. Factory reset the device.

2. Click the link to contact your device’s provider in the Your device at work screen.

3. Make a note of the telephone number, email address, and the identifiers in Device information.

Ask the organization to deregister the device from zero-touch enrollment. Include the identifiers you noted previously. You might want to include a link to this page.