Cosu app development through Android Management Api or device owner locktask

Question

i have to implement single use application for my Enterprise's devices where there is only one major android app that itself can use 2-3 other apps like call, sms and google maps, other than that user must not be able to use or access other apps and settings,

1) I have considered Corporate owned Single use through Enterprise Management Api which is more sophisticated and big, but more complete solution.

2) I have implemented and tested the sample Lock task with an android device owner app that looks more like being my solution, but there is a problem

How do i provision device owner for production level devices? for my test i was able to provision with adb shell commmand. i know that device must be new/Reset and unprovisioned thats not a problem.

I am seeking some suggestion here, if anybody has implemented it it could help.

Update

going with the android management Api QuickStartGuide, suggested by Fred seems like correct way. where my policy is Multiple app from custom launcher now i am stuck in a situation, i want to publish my launcher app or other app to play store only for my enterprise.

I have followed Upload your own app to the Google Play Store,which led me to publish private app, but i am not able to do so as i am not getting Restrict Distribution option.

I don't know how to perfectly achieve this. for my current policy and enterprise, i have 2 active email ids,

first email_1 is the one which is connected to the initial project and

all the google api call is done under email_1 .

and the other is email_2 the one is admin for the enterprise

and connected to managed Google Play Store.

both email_1 and email_2 has admin access to my company developer account .

Now i need to figure out to publish app only for my enterprise, i think there is a issue with correct permission or otherwise, need Help. Thanks

Answer 1

It's easy, once you understand the missing links. The documentation should definitely clarify these steps.

1 Setup the accounts

We created a Google Suite Account for our client and uploaded his app in the Google Play Console account created using a Google Account under their organization, and limited the app distribution to their organization.

We also added Android for Work to our organization here: https://admin.google.com/AdminHome?pli=1&fral=1#SelectServices

And added a role to our organization to manage Google Play Private Uploads: https://admin.google.com/AdminHome#DomainSettings/notab=1&role=new-role&subtab=roles

2 Find the organization ID

This is the key part. You should find your organization ID here: https://play.google.com/work/adminsettings

3 Enroll the organization

When following the steps for the Android Management API, you need to enroll the organization ID found in your Google For Work account.

Follow the step detailed here using your enterpriseID:

enterprises/{enterpriseId}/enrollmentTokens/{enrollmentTokenId}

4 Add your app

Add your app using its PackageName in a ApplicationPolicy. Your devices will now be able to find it and install it.

Answer 2

You no longer need to implement a Device Policy Controller to manage Android devices, Google has recently released the Android Management API which allows you to set up a COSU device with just a few Cloud API calls.

If you have one main app and want to allow to open a few other apps, you can set the main app as a custom launcher and mark the other apps as lockTaskAllowed. You can simply do so by defining an ApplicationPolicy such as the one below (copied from Create a policy):

"applications": [
  {
    "packageName": "com.example.custom_launcher",
    "installType": "FORCE_INSTALLED",
    "lockTaskAllowed": true,
    "defaultPermissionPolicy": "GRANT",
  },
  {
    "packageName": "com.example.app1",
    "installType": "FORCE_INSTALLED",
    "lockTaskAllowed": true,
    "defaultPermissionPolicy": "GRANT",
  }
],
"persistentPreferredActivities": [
  {
    "receiverActivity": "com.example.custom_launcher",
    "actions": [
      "android.intent.action.MAIN"
    ],
    "categories": [
      "android.intent.category.HOME",
      "android.intent.category.DEFAULT"
    ]
  }
]

Answer 3

Google provides a good feature list here: https://developers.google.com/android/work/requirements/features

If your devices have NFC, I would provision using NFC. You can look at the code here for your own implementation or you might be able to use the app with very few modifications. https://github.com/googlesamples/android-NfcProvisioning

By tapping the welcome screen in the Google Setup Wizard 6 times will allow you to use QR code provisioning. It is a bit more cumbersome in my opinion and requires Android 7.0+.

Those are your only two options unless you become a Google EMM Partner or again, partner with them to support Zero Touch Enrollment on Android 8.0+ devices for your own homebaked solution.

You might want to also look at existing open source EMM/MDM implementations that already exist such as WSO2.