Google Pixel 3A 64Gb+4Gb LTE [47/132] Device provisioning

[C-1-1] MUST declare android.software.device_admin .

[C-1-2] MUST support device owner provisioning as described in section 3.9.1 and section

3.9.1.1 .

3.9.1 Device Provisioning

3.9.1.1 Device owner provisioning

If device implementations declare android.software.device_admin , they:

[C-1-1] MUST support enrolling a Device Policy Client (DPC) as a Device Owner app as

described below:

When the device implementation has no user data is configured yet, it:

[C-1-3] MUST report true for

DevicePolicyManager.isProvisioningAllowed(ACTION_PROVISION_MANAGED_DEVICE)

[C-1-4] MUST enroll the DPC application as the Device Owner app in

response to the intent action

android.app.action.PROVISION_MANAGED_DEVICE .

[C-1-5] MUST enroll the DPC application as the Device Owner app if

the device declares Near-Field Communications (NFC) support via

the feature flag android.hardware.nfc and receives an NFC message

containing a record with MIME type

MIME_TYPE_PROVISIONING_NFC .

When the device implementation has user data, it:

[C-1-6] MUST report false for the

DevicePolicyManager.isProvisioningAllowed(ACTION_PROVISION_MANAGED_DEVICE)

[C-1-7] MUST not enroll any DPC application as the Device Owner

App any more.

[C-1-2] MUST require some affirmative action during the provisioning process to consent

to the app being set as Device Owner. Consent can be via user action or by some

programmatic means during provisioning but it MUST NOT be hard coded or prevent the

use of other Device Owner apps.

If device implementations declare android.software.device_admin , but also include a proprietary Device

Owner management solution and provide a mechanism to promote an application configured in their

solution as a "Device Owner equivalent" to the standard "Device Owner" as recognized by the standard

Android DevicePolicyManager APIs, they:

[C-2-1] MUST have a process in place to verify that the specific app being promoted

belongs to a legitimate enterprise device management solution and it has been already

configured in the proprietary solution to have the rights equivalent as a "Device Owner".

[C-2-2] MUST show the same AOSP Device Owner consent disclosure as the flow initiated

by android.app.action.PROVISION_MANAGED_DEVICE prior to enrolling the DPC application as

"Device Owner".

MAY have user data on the device prior to enrolling the DPC application as "Device

Owner".

3.9.1.2 Managed profile provisioning

If device implementations declare android.software.managed_users , they:

Page 47 of 132