Android Enterprise Deployment

Use a single provision token to auto-create and enrol Android Endpoints at scale. Devices are managed by your MDM.

Prerequisites

Control D Organization account.
Provision token from Dashboard → Endpoints →Provision.
Android Enterprise devices enrolled in your MDM, with permission to push managed app configurations and enforce Always-On VPN.

Step 1 — Sign in to Control D

Ensure you’re using an Organization account.

Step 2 — Create a provision token

Go to Dashboard → Endpoints → Provision and generate a token (e.g., org-v1-xxxx). Keep it handy.

Step 3 — Decide your device identifier

Pick a stable, unique value your MDM can template per device (e.g., device ID, serial, asset tag). This becomes the Control D Endpoint name.

Step 4 — Add the Control D managed app to your MDM

Add the private/managed app to your Android Enterprise catalog.

Step 5 — Create the managed app configuration

Add two keys:

provision_token → your org-v1-... token
device_id → your MDM’s per-device macro (e.g., MaaS360 %deviceid%)

Template (managed_config.xml)

<restrictions xmlns:android="http://schemas.android.com/apk/res/android">
  <restriction
      android:key="provision_token"
      android:title="Control D Provision Token"
      android:restrictionType="string"
      android:defaultValue="" />
  <restriction
      android:key="device_id"
      android:title="Device ID"
      android:restrictionType="string"
      android:defaultValue="%deviceid%" />
</restrictions>

Step 6 — Assign the configuration

Target the devices/groups you plan to enroll. Ensure the managed config is attached to the app assignment.

Step 7 — Distribute the app silently

Push the app to devices. In Android Enterprise Device Owner mode, the install is silent and headless (visible in system settings, not the launcher).

Step 8 — Enforce Always-On VPN

Create or update your security policy to set the Control D app as Always-On VPN and push it to the same devices.

Step 9 — Confirm in the Control D dashboard

Open Dashboard → Endpoints. You should see a new Endpoint named after your device_id. Generate DNS traffic on the device and confirm activity under that Endpoint's Activity Log.

Troubleshooting

Config pushed but no Endpoint showed up? See Provisioning Troubleshooting for the exact failure codes and what to do next.