Setup guide · from scratch
Create an Android Enterprise corporate enrolment profile (QR/token)
Generates the QR code/token that provisions a factory-reset corporate Android as fully managed, COPE or dedicated. Pick the mode by device ownership — fully managed wipes the whole device. BYOD work profile needs no token.
≈ 15 min
Google — Android · step 3 of 5 · ≈ 15 min‹ PreviousNext ›
Do these first — this guide assumes you already have:
The Decolla way — skip the clicks.
Every step below can be done by hand. Or connect your Microsoft tenant to Decolla once, and Decolla performs this for you over Microsoft Graph in your own tenant — then hands back a verified result you can see and roll back per item. It also puts the fundamentals this step depends on in place — the target group, the licence allocation — so a build is never blocked half-way by a missing dependency.
⏱ By hand: about 15 min of clicking, every build. The Decolla way: part of one tenant connect, then automatic.
Before you start
- A genuinely factory-reset (out-of-box) corporate Android device, plus the Wi-Fi it will use, so you can test the QR enrolment end to end.
- Managed Google Play already bound to the tenant - the Android Enterprise section stays hidden until it is.
- A decided mode for each device - fully managed (COBO), COPE or dedicated - driven by who owns the hardware, because fully managed wipes it.
- Intune sign-in with device enrolment rights.
The steps
- In Intune go to Devices > Enrollment > Android tab (Managed Google Play must…
- Under 'Android Enterprise' > 'Enrollment Profiles' pick the mode: Corporate-owned…
- Click 'Create profile', set Name/Description, token expiry and options, then Create.
- Re-open the profile and click 'Token' to reveal the QR code plus numeric string…
- On a factory-reset device tap the setup screen 6 times to open the QR scanner (or…
- Scan the QR; the device provisions as managed.
- For personally-owned BYOD work profile, skip the token — the user installs Company…
0 of 7 done
Step 1. In Intune go to Devices > Enrollment > Android tab (Managed Google Play must already be connected).
Screenshot: Devices > Enrollment > Android tab (captured during a live customer build — coming to this page)
Why: Corporate enrolment profiles live under this tab; the Android Enterprise section only appears once the Managed Google Play binding is live.
Watch for: If 'Enrollment Profiles' is missing, the Managed Google Play connection has not finished - fix the binding before going any further.
Step 2. Under 'Android Enterprise' > 'Enrollment Profiles' pick the mode: Corporate-owned fully managed (COBO), Corporate-owned with work profile (COPE), or Corporate-owned dedicated (kiosk).
Screenshot: Enrollment Profiles list showing the three corporate types (captured during a live customer build — coming to this page)
Why: The mode is fixed at enrolment and written into the token - COBO hands Intune the whole device, COPE adds a separate personal work profile, dedicated locks it to kiosk apps.
Watch for: Fully managed (COBO) has no personal space and factory-wipes the device to provision it - right for company-owned hardware only.
Don’t: Do NOT choose a corporate mode for a device the employee personally owns - that is the BYOD work profile flow (step 7), which needs no token.
If this step errors: Android Enterprise: work profile vs fully managed vs COPE
If this step errors: Android stuck at 'Your work checklist': afw#setup + COPE
Step 3. Click 'Create profile', set Name/Description, token expiry and options, then Create.
Screenshot: Create profile Basics pane (captured during a live customer build — coming to this page)
Why: Name and expiry are set once here; the token stays usable until the date you pick, so anyone holding the QR can enrol a device until then.
Watch for: Token expiry is the security control - a long-lived token that leaks lets an outsider enrol a device into your tenant.
On a schedule: Diarise the token expiry date - once it passes the QR silently stops enrolling and you must regenerate a fresh one.
Step 4. Re-open the profile and click 'Token' to reveal the QR code plus numeric string (20-digit fully managed/dedicated, eight-digit corporate work profile).
Screenshot: Profile > Token showing QR code + numeric token (captured during a live customer build — coming to this page)
Why: The QR and the numeric string are the same enrolment payload - the numbers are the manual fallback for a device that will not scan a code.
Watch for: Use the digit count as a sanity check - 20 digits means fully managed/dedicated, eight means corporate work profile; the wrong length means you opened the wrong profile.
Don’t: Do NOT paste the token or QR into shared tickets or chats - it is a live credential that enrols devices into your tenant.
Step 5. On a factory-reset device tap the setup screen 6 times to open the QR scanner (or use NFC / Google Zero Touch / Samsung Knox Mobile Enrollment / manual token).
Screenshot: Factory-reset device QR-scan enrolment screen (captured during a live customer build — coming to this page)
Why: The six taps trigger the hidden QR provisioner on the opening welcome screen; it is the manual path when you are not using Zero Touch or Knox Mobile Enrollment.
Watch for: It must be a genuine factory-reset device - one that was already set up will not offer the six-tap QR provisioner, so wipe it first.
Don’t: Do NOT progress through setup before the six taps - the QR scanner only lives on the very first welcome screen; if you have passed it, factory-reset and start again.
Step 6. Scan the QR; the device provisions as managed.
Screenshot: Device provisioning progress (captured during a live customer build — coming to this page)
Why: This hands the device to Android Enterprise and pulls down the Intune-managed apps and policy for its assigned group.
Watch for: Provisioning needs a live internet connection throughout - drop off Wi-Fi/data partway and it stalls, forcing a wipe and restart.
Step 7. For personally-owned BYOD work profile, skip the token — the user installs Company Portal from Google Play and self-enrols.
Screenshot: Company Portal self-enrol on a BYOD device (captured during a live customer build — coming to this page)
Why: BYOD work profile creates a walled-off work container and leaves the user's personal side untouched - no token, no wipe.
Watch for: This is a genuinely separate enrolment path, not a fallback for the QR flow - it applies only to personally-owned devices.
Don’t: Do NOT hand BYOD users the QR/token - that provisions a corporate mode and can wipe their personal device.
If this step errors: Android devices not in the zero-touch portal — what now
Put these on a schedule
| Step | Recurring action to diarise |
|---|---|
| Step 3 | Diarise the token expiry date - once it passes the QR silently stops enrolling and you must regenerate a fresh one. |
If it goes wrong
The failures people actually hit on this process, each with the diagnosis and fix:
- Android Enterprise: work profile vs fully managed vs COPE — A decision tree for the four Android Enterprise modes — work profile, COPE, fully managed, dedicated — and why switching later means a factory reset.
- Android stuck at 'Your work checklist': afw#setup + COPE — Android 11+ devices enrolled with afw#setup and a corporate-owned work profile token loop at 'Your work checklist'. Why it happens and the supported paths.
- Android devices not in the zero-touch portal — what now — Only authorised resellers can register Android devices for zero-touch. What to demand at purchase, the dual-SIM IMEI trap, and fallback enrolment paths.
‹ Approve Managed Google Play store apps (in-Intune iframe)Create an Entra dynamic device group for corporate Android Enterprise devices ›
See it on a real device.
Decolla is in private build — early-access members see a build defined, deployed and rolled back first.
Get early access