After setting up your Esper account, creating a blueprint is the first step to managing your devices efficiently, flexibly, and dynamically. This article covers each setting and the process for creating a blueprint and applying those changes to your Android devices.
See Creating a Blueprint for information on blueprint workflows.
- See iOS Blueprint settings article for iOS devices.
- See Managing Linux devices for Linux devices.
- See Managing Windows Devices through a Blueprint for Windows devices.
In this article:
Apps and Configuration
Device Mode
Device Mode determines how users will interact with the device. There are two modes: Multi-app Mode and Kiosk Mode.
Multi-app Mode
The Device mode function enables you to switch a device between Multi-Appmode and Kiosk mode. When a device is in Multi-App mode, the end user can see and use all the approved apps.
Kiosk Mode
When a device is in Kiosk Mode, the device acts as a kiosk, and end users can only interact with the kiosk app, similar to a pinned app.
To change a device to Kiosk Mode, click Switch to Kiosk Mode. On the slide-out from the right side, click the radio button for the mode you prefer. If you click the Kiosk Mode radio button, you will also need to choose the application that will be pinned to the device’s start screen as its primary application. Select it from the searchable Kiosk App dropdown, and then click Save.
Launcher
Choose the launcher.
Esper Launcher
Most users will use the default Esper DPC Launcher. Once selected, the Esper Device agent will take administrative control of the device, and only approved applications will be able to be installed or used, in addition to other Esper features. This gives you more control over the applications that can be used, and the actions that can be taken on the device.
Android Launcher
If you select the Default Android Launcher, the device will function on the Android experience. The device user will be able to exit the Esper Agent as they would any other Android application. The Esper Agent will continue to run in the background and provide some device management, but many management features will not be available.
Specifically, the following features will be unavailable:
- Over-the-Air OS updates for Esper Foundation for Android OS
- The latest Device Agent updates for devices running an Android 6 and lower
The device screen will look and act much like a regular Android device, with the Esper Device Agent showing up as an app that can be opened or closed.
Other Launchers
Learn how to set third party launchers.
Permissions
Default application permissions determine enforcement of the runtime rules across all the apps on a device including Enterprise applications installed by Esper, in-ROM applications that are enabled, as well as applications installed via Managed Google Play. This ensures you can control the user experience on the device regarding how run-time permissions are granted.
Allow Automatically: This rule will grant all the permissions for any application requests without showing a prompt to the user.
Allow automatically is the typical setting for trusted Kiosk Mode applications. Esper will grant permissions to the calendar, camera, microphone, etc.
Ask User: All applications on the device will show a permission request for the user to accept or deny.
For example, each time before accessing a device module, all applications will prompt the user with a message such as “Allow application X to access the Gallery? Allow or Deny." The Ask user option might not be ideal in some solutions, especially Kiosk-based applications. However, it can help in unusual situations when dealing with app permissions— contact us directly to find out more.
Deny Automatically: Permissions revert to their default state as set by the device manufacturer.
Any previously granted permissions are not affected. You can grant permissions to applications individually from the Esper Console. Users can grant permissions to apps individually from the Esper Console or Android Settings (if Android Launcher is enabled).
Learn more about Android runtime permissions.
Allow Local App Installs: Enable this to allow the device user to install applications from an unknown (or any) source.
Allow Application Uninstall: Enable this to allow the device user to uninstall apps from the device.
These settings are typically used when the devices are loaned out to guests, such as through a hotel. Disabling these settings will prevent device users from installing or uninstalling applications.
Application Sync Mode
Requires Esper Agent version 8.0+. Devices on lower versions will default to the Enforce Apps and Version mode.
Choose how apps are handled on devices. You have the option to enforce the blueprint’s apps and remove all other Esper managed apps, or keep apps on the device, even if the app isn’t listed in the blueprint.
- Enforce Apps and Versions: Keep the applications and versions specified in the blueprint on the device. Uninstall, disable, or hide any other applications. Allow downgrades per the blueprint version.
- Do Not Enforce Apps and Versions: Install or upgrade applications defined in the blueprint while keeping other apps that were added through Esper. Disallow downgrades.
Learn more about App Sync Mode scenarios.
Application Management
Applications are managed through blueprints, however, Esper does not always control every application, especially those installed from the Google Play Store. Applications follow certain rules if they are pre-loaded, added from the Esper cloud, or from supported application marketplaces. To understand how applications are managed, see Application Syncs.
To add an application, click Add Application.
This setting will allow you to install applications during provisioning.
You’ll have the options to:
- Upload an APK.
- Choose from an uploaded application and version.
- Add an application from approved Google Play.
Once an app is added to the Application Management list, you can:
- In Multi-App mode, enable Launch on Start to launch apps when the device is powered on.
- Click on the ellipsis (...) to change its settings.
- Set its App State.
- For Google Play Store apps, set its Update Mode.
App State
Determine if and how apps will appear on the device.
For a most applications, you have the following options:
- Show: Show state keeps the application accessible directly and indirectly on your device, which means the user can access the application directly on your device or via some other application.
- Hide: If an application is set to Hide, it will not appear as an app on the device but it can still run in the background. Most preloaded apps are hidden by default.
- Disable: If you want to prevent an application from running, use Disable. The Disable state is helpful for preloaded applications that you cannot uninstall. This state prevents the application from running in the foreground and background.
-
Launchable but hidden: the application will be hidden on the home screen, but will be accessible and launchable from other applications. Requires Android Esper Agent 8.5+. When this mode is selected in a blueprint, and that blueprint is applied to devices below Esper Agent 8.5, the app will default to the Hide state. For devices on versions below 8.5:
-
When converging with Launchable but hidden, devices will show a success message in the Event Feed if all other settings are successfully applied. The device’s apps will be in one of the following states:
- Hidden: The app will be hidden if it’s newly installed on the device.
- As-is: The app will retain its previous state (whatever it was before switching to allowlist) if it was already on the device.
-
When converging with Launchable but hidden, devices will show a success message in the Event Feed if all other settings are successfully applied. The device’s apps will be in one of the following states:
Removing an app will remove it from the Home screen and set the app to its default state (show/hide)—reboot required.
Installation Rule
Control when the app is installed on the device or customize its configurations.
- During Provisioning: The app installs during the provisioning process. Best for devices where the app experience needs to be accessible right away. Kiosk applications must always be installed during provisioning.
- Post Provisioning: The app installs after the provisioning process has completed. If an application applies configurations after provisioning, set it to post-provisioning so those configurations apply correctly. This is also the recommended method for devices with many applications, or large applications.
- Managed Configurations: Specify managed configurations using JSON. Learn more about managed configurations.
App Update Mode
For Google Play Store applications, you’ll be able to choose when an application is updated.
Default Update Mode
This option is good for customers who want to update their app on Wi-Fi and not through mobile data. The update will happen when all of the conditions are met:
- The device is connected to a Wi-Fi network.
- The device is charging.
- The device is not actively being used.
- The app that needs to be updated isn’t running in the foreground.
High Priority Mode
This option is for customers who want their applications updated immediately regardless of whether or not they’re connected to Wi-Fi or using mobile data.
The update triggers:
- As soon as it is available through the Google Play store as long as the device is communicating with Esper. Apps are updated whenever the device starts communicating with Esper again.
Postpone Mode
The app is not automatically updated. After 90 days from when the app first becomes out of date, the latest version is installed (following the Default Update Mode behavior).
Remove App
Remove the app from the app list.
Customization Application Appearance
Customize the way applications are displayed on the device. Requires Android devices using Esper Launcher with Esper Agent 8.6+.
Click on Customize (or Edit to make a change) to customize the appearance of apps on the device.
Choose from large, medium, small, or system default for the app icon size.
When adjusting app icon size:
- Longer application names may appear truncated when adjusting the app icon size.
- The number of apps in each row may change.
Enable Arrange Applications to change the order of apps that appear in the preview. Only apps added or enabled in the blueprint will appear here. If apps are added outside of the blueprint (for example, via the API), they may appear in any order after the ordered apps.
Click on Restore to System Default to return the device to its factory display settings. Learn more about display customizations.
Connectivity
For devices to communicate with Esper, they must have access to at least one access point. If primarily connecting to Wi-Fi, it’s recommended that a Wi-Fi SSID is set in the blueprint.
Esper implements several steps to ensure that devices are connected to the internet. Learn more about Wi-Fi Syncs.
Allow Wi-Fi
When you add a Wi-Fi access point to the blueprint, you need to enter the details of the Wi-Fi access point. To add, click the Add Wi-Fi Access Point link.
Enter the details and click Add. You can also select from previously added Esper-managed access points.
Allow Bluetooth®
If you want the device user to use Bluetooth on the device, set the Bluetooth toggle button to enabled. If not, disable it.
Allow SMS
SMS controls the sending and receiving of SMS or text messages. If SMS is disabled, the device cannot send or receive text messages from any application. Enable SMS if you wish to send and receive messages.
Allow Near-Field Communication (NFC)
If you want device users to use Near-Field Communication (NFC) on their devices when supported, enable NFC. If you don’t, disable it. If any applications require NFC, make sure this setting is enabled.
Note: The NFC setting will remain enabled on the device even when this setting is disabled in the blueprint. However, NFC communications will be disabled as intended if the user attempts NFC transfers.
MAC Address Randomization
Enable or disable MAC address randomization. Requires Lenovo devices running Android 12 or above.
- When enabled, the device will use the default MAC address randomization behavior.
- When disabled, the device will use the device’s MAC address. Device users connecting to a new network via Android settings will not have the option to enable MAC address randomization.
On Android 10+ devices, MAC address randomization is enabled by default to enhance security. Typically, organizations disable this setting if MAC addresses are needed to identify and connect devices to the network or used in their applications.
Need a way to identify devices? Use the Device SDK to get a device’s serial number.
Restrict Incoming Calls
Enable this to block incoming calls from all but the specified contacts. Requires Android devices on version 9 or below.
Click Add/Edit Contacts to enter the caller details.
You can add phone numbers or upload a CSV file of contacts to add to the allowed list only.
All numbers must be preceded by a +country code (for example, +1 for the USA). A comma must separate all numbers.
The following are general guidelines for the CSV when uploading the CSV for Contacts.
- Download the template CSV file.
- Fill in the Contact's information according to the header (for example, Phone Number, Tag, Tag, Tag)
a. Please make sure that the Country Code is included in the Phone Number (for example, +1)
b. Phone numbers should not include parentheses or hyphens (for example, +18881234567)
c. Tag should not contain any numeric or special characters (for example, hyphens, quotes, etc.) - Upload the filled-out CSV (make sure the header is included in the file)
a. For Mac Users, you want to alter the file's End-Of-Line character to the Windows or Linux format.
Restrict Outgoing Calls
Enable this to enable calls from all contacts except for those in the Restricted list. Enable this to block incoming calls from all but the specified contacts. Requires Android devices on version 9 or below.
Wi-Fi Access Points
You can add Wi-Fi access points at:
- The time of provisioning through the QR-code
- Through a blueprint
- Through another Esper-supported method such as the API or SDK.
When added in these ways, access points are considered Esper-managed.
The device will automatically connect to the given Wi-Fi access points with a default timeout of 35 seconds.
The Wi-Fi On/Off and Wi-Fi access points features are not available for devices running Android 10.0 and above.
Adding an Access Point
When adding a new access point, you have four fields to configure: Wi-Fi SSID, Wi-Fi Password, Wi-Fi Security type, and Hidden. The Wi-Fi SSID and Wi-Fi Password fields are text fields for the SSID and password. Select the security type from the drop-down menu. There are four possible choices:
None: None is an open-type network. Requirement: SSID
WEP: WEP is an open-type network with a password. Requirements: SSID, Password (limit: 13 characters)
WPA: Android refers to WPA as WPA/WPA2, but technically, WPA and WPA2 are slightly different. WPA is an enhanced version of WEP. Requirements: SSID, Password (limit: 63 characters).
WPA3-personal (SAE): WPA3 access requires Android 11+ devices with Esper Agent 7.18+. Requirements: SSID, Password (limit: 63 characters).
EAP: Extensible Authentication Protocol. Requires a certificate. The ability to add a Root Certificate Path, Domain Name, and Password is available for Android devices running Esper Agent version 7.18.1175+.
If you select EAP, you will be prompted to enter additional information.
The following EAP methods are available for the EAP security type:
- PEAP: allows you to add a Root CA certificate file path, Domain Name.
- TLS: allows you to add a PKCS12 certificate file path, Domain Name, and certificate file password. Learn more about setting up SCEP.
- TTLS: allows you to add a Root CA certificate file path, Domain Name.
- PWD: allows you to add a password.
- SIM
- AKA
- AKA_PRIME
SIM-based methods may require additional manufacturer support.
Hidden networks
When you enable a hidden network, devices will not scan for the network. For example, if users add a hidden network their device’s Wi-Fi settings won’t see the network even if it is in range.
In Android 10 and above, when a Wi-Fi access point is added directly from the device, we recommend keeping GPS on so that the Wi-Fi access point will reflect on the console.
Strict Wi-Fi Access Point Synchronization
During a converge, all other Esper-managed access points are removed from the device except those provided in the blueprint. Device users will still be able to add Wi-Fi access points if this is selected.
Esper-managed access points: Any Wi-Fi access points are added to the device through the Esper Console or the Esper Settings app.
Click on the Details dropdown to learn more about Strict Synchronization.
Should you use Strict Mode?
In some situations, devices must connect to access points that aren’t listed in the blueprint. For example, a device may be on Blueprint A and then move to Blueprint B, and retain the access points from Blueprint A.
This can be unexpected for some users. If you only want the devices to connect to the access points in the blueprint, use Strict Mode. Keep in mind that this setting still allows device users to connect to access points not listed in the blueprint (although you can hide the Wi-Fi access button using Esper Settings).
In the example above, all other Esper-managed access points will be removed except for Andi’s Wi-Fi. The device will attempt to connect with Andi’s Wi-Fi. For more information about how blueprint affects Wi-Fi scenarios, see Wi-Fi Sync Scenarios.
What isn’t affected by Strict Mode?
Any Wi-Fi access points added to the device outside of Esper (for example, through the Android Launcher) won’t be affected by Strict Mode.
Need a more detailed explanation of how Strict Mode works?
After device A converges to Blueprint B, Esper checks its Wi-Fi access points. If Wi-Fi XYZ was added by Esper, the device attempts to connect with Wi-Fi access point ABC. If it's successful, XYZ will be removed. If not, it will remain connected to XYZ.
If XYZ wasn't added by Esper, XYZ will not be removed.
What makes a Wi-Fi access point "added by Esper"?
If the device belonged to a previous Blueprint, all the access points on that Blueprint would be considered added by Esper. During 6-tap Provisioning, when the user is asked to provide a Wi-Fi access point, that access point is also considered added by Esper.
What if I enable Strict Mode without specifying an access point?
The device will first try to connect to a mobile network, then ethernet. If it has an Esper-managed Wi-Fi connection, the blueprint will fail. If not, the blueprint will succeed.
Use Only Saved Wi-Fi Access Points
When enabled, devices will only be able to connect to the access points defined in the blueprint. To learn more, see Create a Wi-Fi Allow List.
Security
ADB Access
Android Debug Bridge (adb) is a command-line tool that provides a Unix shell to communicate with an Android device. If the adb access option is checked in the blueprint, you may enable adb via the Device Settings and select the session duration. If the adb option is unchecked in the blueprint, you won't be able to turn on adb from the Device Settings. Opening the adb port is required on most stock Android devices before adb debugging.
Keep in mind that adb access could make your devices vulnerable to security threats. Only enable it for situations where adb access is required.
Safe Mode Login
When Safe-Mode login is enabled, users will be able to boot to Safe Mode on the device. When Safe-Mode login is disabled, users will be unable to boot to Safe Mode.
Factory Reset
Factory Reset controls if users can perform a factory reset using the Android Settings app. When Factory Reset is disabled, the user will not be able to complete a factory reset on the device. This does not prevent a hard-key factory reset, see Factory Reset Protection to prevent a hard-key factory reset.
Disabling Factory Reset from System Settings will also remove User Factory Reset configurations from the User Mode in the Esper Settings App.
Screen Timeout
Choose the timeout period for the device.
Lock Screen
The lock screen enables the default lock screen to be displayed whenever a device screen times out, according to the timeout specified in the settings section.
If this is disabled, a lock screen will not be enforced, but a user could still set a lock screen through other methods, such as through the Android settings app. Ensure the Android settings app is disabled to prevent any undesired behavior.
If this is enabled, the device user will be prompted to set a password for the lock screen. The user must enter a password that follows the rules set from the Lock Screen Password option.
Lock Screen Password
The lock screen password specifies the conditions for the device unlock password. The default is None.
If you choose alphabetic or alphanumeric, you must set a password length of at least 4 characters and up to 25. Use the up/down arrows to set the required password length.
- Alphabetic: Restricts acceptable passwords to only upper and lowercase alphabetic characters (A to Z, and a to z).
- Alphanumeric: Expands acceptable passwords to include numbers and special characters in addition to alphabetic characters.
- Numeric: Restricts acceptable passwords to numbers only.
The user will set up the password for a device during the initial setup. The lock screen setting must be enabled to set the password type and character limit. If you select either Alphabetic or Alphanumeric password rules, then the lock screen will be set to On by Esper if it is currently Off.
If a user sets a password and a Blueprint is converged that has a "None" setting later, the user's preference will take priority. You can change the lock screen password remotely with the commands API.
Display & Branding
Brightness
Use the brightness slider to increase or decrease the brightness of the screen.
Screen Orientation
Select screen orientation from the options: Auto, Landscape, and Portrait. Some device makers swap the settings for Landscape and Portrait. If your device was provisioned with a specific orientation but is locked into the other orientation, try switching this setting to achieve the proper screen orientation.
Screen Shot
This setting will allow or restrict the device user from taking a screenshot.
Notification Bar
This setting will enable or disable the notification bar on the device.
Notification Disabled
- App running in Kiosk Mode: Only the Kiosk app will be visible along with the back key in the navigation bar. No status bar.
- App running in Multi-app Mode: The status bar will be visible along with the navigation bar.
Notification Enabled
- App running in Kiosk Mode: The status bar will be visible along with the Kiosk app. No drop-down to view notifications.
- App running in Multi-app Mode: The status bar and a notification bar will be shown along with a drop-down to show notifications.
You may choose to leave this setting On if you request bug report submissions from device users. User bug report requests from Esper must be sent via the notification bar.
Customizations for Esper Launcher
Customize the size of app icons, app names, device IDs, and alias names. Requires Android devices using Esper Launcher and Esper Agent 8.6+. Learn more about display customizations.
Click on Customize (or Edit) to open the customization menu.
Device ID & Name Visibility: Choose whether or not the device ID and alias name appear.
Device Name Size: If visible, choose the size of the device ID.
Alias Name Size: If visible, choose the size of the alias name.
Placement: Choose which corner the device ID and alias name will appear on the device display.
Configure Branding Placement: Choose which corner the branding will appear.
The system default are the size and visibility with no configurations applied.
About device previews
On the preview device, you’ll be able to see the configurations for a mobile and tablet device in portrait or landscape. The mobile device is based off of a device with a resolution of 1080 x 2280. The tablet is based off of a device with a resolution of 1200 x 1920. These previews are meant to give you an idea of the device display. Check the physical device for the most accurate representation. Additionally, System Default sizes vary depending on the device.
Choose from a mobile device or tablet in portrait or landscape mode.
Check the physical device for the most accurate display.
Home Screen Wallpaper
You can upload wallpaper files in either portrait or landscape mode. Click upload and select a file up to 5MB in size. Image ratios will vary by device. Consult your manufacturer's documentation for recommended resolutions. For example, phones typically have a wallpaper resolution from 640 x 960 to 1240 x 1920.
Lock Screen Wallpaper
You can upload a lock screen image or use the same image for the home screen and lock screen. Lock screen wallpapers are limited to Portrait or Landscape.
Esper Setting App
This setting controls the user's access to settings available via a hidden dock on the device. The Esper Setting App has two modes:
- User Mode
- Admin Mode
Click Customize Setting to select different settings for the two modes.
- About: Provides information regarding the endpoint name the device is enrolled in if the customer has access to multiple Esper endpoints.
-
Accessibility: Compatible with one of the following:
-
- Android 8 and below when android.settings.ACCESSIBILITY_SETTINGS is enabled (which is usually the case).
- Samsung devices with the com.samsung.accessibility package set to launchable but hidden through a blueprint or device setting.
- Most Android versions with a Supervisor plugin.
Select from a variety of accessibility settings:
- High Contrast
- Color Correction - Deuteranomaly
- Color Correction - Protanomaly
- Color Correction - Tritanomaly
- Mono Audio (only for Foundation devices)
- Display Size
- Talkback
- Text to Speech
- Reset to Default
-
- Auto-Rotation: Turn auto-rotation On or Off. It has multiple states— Auto, Landscape, Portrait, Inverted Landscape, Inverted Portrait
- Bluetooth: Navigate to the Android settings application on Android 8.1 and lower devices to change the Bluetooth setting. The scan button on the bottom right will allow searches and show nearby devices. Click the Connect button to pair the device; the connection will happen immediately. You can connect only non-A2DP devices like headphones, mouse, and keyboards and can’t connect mobile phones and laptops.
Bluetooth works as a one-to-one relationship between devices. If you need to pair a new device, you’ll need to delete and unpair the old device before connecting the new one.
- Clear App Data: Clears the data and cache for a particular application.
- Display: Manage screen rotation, screen brightness, and screen timeout.
- Factory Reset: Perform a factory reset of the device, regardless of the blueprint applied.
- Esper Branding: Turn off the Esper logo on the device's Home screen.
- Flashlight: Turn On the Torch (AKA “flashlight”) if the device has a camera flash LED.
- Input Selection: Navigate to Android settings on Android 8.1 and lower devices to change the input selection for the device.
- Keyboard: Navigate to Android settings on Android 8.1 and lower devices to change the keyboard settings.
- Kiosk App Selection: Change the App that runs in Kiosk Mode. The device user can choose any app installed on the device to act as the kiosk app, with the Esper Console kept in sync with the configuration stats.
- Language: Navigate to Android settings on Android 8.1 and lower devices to change the language setting.
- Mobile Data: Access mobile data on the device.
- Reboot: Ability to reboot the device. Only available on Android 7 and above.
- Sound: Manage alarm, notification, music, ring, and voice call volume.
- Storage: Helps grant permissions to any directories on the device. On Android 10 or below devices, it is advised that the Console admins inform the users to grant permissions to the root folder. On Android 11 devices, permission cannot be granted to the root folders and download folders.
- Time and Date: Navigate to Android settings on Android 8.1 and lower devices to change the date and time for the device.
- Wi-Fi: Change the Wi-Fi access point used by the device. In Android 10 devices and above, it is recommended to enable GPS to view the network information on the device’s Wi-Fi screen. In devices below Android 10, enabled GPS is needed to display scanned network information.
- Data Roaming: Enables access to data roaming.
- Wi-Fi Tethering: Enables access to Wi-Fi tethering.
- Airplane Mode: Enables access to airplane mode. Requires a supervisor plugin or Knox-enabled device.
Esper Settings
Esper Settings App
This toggle button helps you hide the Esper Settings App. The Esper Setting App can be accessed only by the hidden dock.
A hidden dock is available in both the Kiosk Mode and the Multi-app Mode. You can access it with 3-taps on the right corner in Kiosk Mode or 3-clicks on the power button in Multi-app Mode.
Set Admin Pin
Admin Mode is password-protected to prevent unauthorized access. This password controls access to the hidden dock available in Kiosk Mode, the Esper Settings app, and serves as the PIN used for IMEI-based onboarding via AfW. The password is alphanumeric and can have 1 to 10 characters.
The default password is 1234. It is possible to set up a template without a password for these features or just leave the default password; Esper strongly recommends setting up a more complex password for stronger security. The same password will be set for all devices provisioned using the blueprint.
A hidden dock is available in both the Kiosk and Multi-app Modes. You can access it with 3-taps on the right corner in Kiosk Mode or 3-clicks on the power button in Multi-app Mode.
Android Setting App
This setting will display the icon for the default Android settings application on the device’s Home screen. Clicking this icon will take the user to the default Android settings. Depending on the other configurations set in the blueprints, some options may be disabled for the user.
Advanced Android Settings Enable JSON
When enabled, this setting allows you to:
- Input valid JSON code.
- Gives you access to additional JSON settings.
- Gives you access to accessibility JSON settings.
Paste JSON into the field to get started.
Example
{
"homepage":"https://esper.io"
}
Files
You can upload and push files to all the devices provisioned using this blueprint. Click Add File to upload a new file. You can edit and remove an already uploaded file. To clear the entire file list, click Clear File List.
To understand how files sync to the device in different scenarios, see File Sync.
Geofence
Set up a parameter for devices and trigger actions when the device leaves the parameter. Learn more about creating and managing geofences.
Platform Services
Control Managed Google Play
This setting was formerly known as EMM enrollment. See note.
GMS devices only.
In order for devices and their users to access Google Play Store apps, the device must be enrolled in Managed Google Play. Learn more about creating a Managed Google Play account (formerly called EMM enrollment) or about Managed Google Play.
- For devices below Esper Agent 8.2, you must enable this setting before provisioning. To unenroll devices, you must perform a factory reset.
- For devices on version 8.2+, devices may be enrolled at any time by enabling this toggle. Disable this toggle and converge the devices to remove Play Store apps from the blueprint. If the blueprint’s app sync mode is Do Not Enforce, apps may still remain on the device and can be uninstalled manually
Tips
- As a best practice, set this to Provision Only to avoid accidentally unenrolling devices from Managed Google Play.
- We recommend using Always Apply during device testing.
- Ignore is a rare use case. When this setting is set to Ignore, devices will remain in the same enrollment state they had previously. If the device was enrolled, it will remain enrolled. If the device was unenrolled, it will remain unenrolled.
- This setting defaults to Provision Only for blueprints created after Spring 2025.
Note
Tenants received the Managed Google Play changes over the month of April 2025 and beyond. If you have not yet received the update, refer to the previous behavior:
If you want device users access to your Managed Google Play Store, set the Google Play Store setting to On; if you don’t, set it to Off. You’ll still be able to install any approved Google Play Store applications from Esper if the Play Store is turned Off. This only applies to GMS devices, as AOSP devices do not include Google Play Store support.
Allow Personal Accounts
This setting allows you to restrict the number of Google accounts that can be added to the device and used with Google apps like Gmail, Google Play Store, and YouTube. By default, any number of accounts can be added to a specific device; this setting restricts this number. For example, if you set this setting to two, only two accounts will be permitted on the device, further addition (or deletion) of accounts will not be possible unless a different blueprint is reapplied.
Notes:
- If you don’t check the Google account restrictions box and plan to provision your device in Multi-app Mode, we recommend disabling the Google Play Store to prevent the installation of unapproved applications.
- The Google Account Restriction feature is applicable only to Google Mobile Services (GMS) Android devices. If you include the Android Settings App and wish to prevent any Google accounts from being added, set the number of accounts to zero.
Google Play Store Visibility
This setting will allow the Google Play Store on the device’s home screen. Toggle On to display Google Play Store. If you don’t, set it to Off.
Allow Device Access to Google Assistant
If you’d like device users to be able to use voice commands via Google Assistant on supported devices, enable Google Assistant. If not, disable it.
On some devices, this setting may need to be on if you wish to have the Google Play Store show up on the device.
Factory Reset Protection
Factory Reset Protection (FRP) places an auto-lock on a GMS-certified device if a user factory resets it with soft or hard keys. FRP will auto-lock the device and keep it locked until a pre-authorized Google account ID is entered. See additional information about getting your Google Account ID.
When you turn on the FRP button in the blueprint, you’ll need to pick a Google account to authorize future device unlocks. Your chosen Google account ID will reverse any future auto-lock events triggered by user factory resets for all devices provisioned with this template.
Factory reset protection is only available on GMS devices running Android 5.1 and above.
Hardware Settings
External Device
This setting allows you to connect external devices. If you want device users to be able to connect other hardware to the device, set the External Device toggle button to on. If you don’t, set it Off.
USB Tethering
USB tethering allows users to connect USB devices, such as a flash drive, digital camera, mouse, or keyboard to the device. If you want device users to be able to connect other hardware to the device, set USB Connectivity to On. If you don’t, set it Off.
File Transfer
If you’d like device users to be able to transfer files from the device using a USB cable or flash drive, enable this. If not, disable it.
Camera
If you want device users to be able to use the camera, enable this. If not, disable it.Your application can still access the camera if this setting is disabled.
Location
If you'd like the device to use location services, enable this. If not, disable this setting.
When this setting is disabled:
- Console and other system messages may display no data available or show a blank entry.
- If you disable this setting after it was previously set, the location data may still display the last known location. However, after disabling this feature, the location data will no longer update.
Sound
Adjust the device’s sound settings.
If Android settings are disabled, the end user won’t be able to manipulate this in any way.
System Updates
Choose the system update preference.
- Update Automatically: Updates device when the newest system update becomes available.
- Postpone Installation: Postpone the update for 30 days before the update occurs automatically.
-
Windowed Installation: Installs system updates during
a selected maintenance window.
- Use 12:00 AM as the Start Time and 12:00 AM as the End Time to update over a 24 hour period.
- If you want to schedule for the next day, choose an earlier end time than your start time. For example, you can schedule an update to start at 10:00 PM and end at 6:00 AM.
- Scheduled updates are available within 30 days of an Android system release. After 30 days, the update will be automatically available through a manual installation on the device. Update availability varies by device. See Android’s Help Page for more information.
- Disable Update: Disables OS updates on the device. Updates will default to the Postpone Installation option if this option is unavailable. This feature may require a Knox-enabled device or Lenovo device with CSDK support.
- Default Update: Update the device according to its factory settings. Factory settings may vary, so consult the device's manufacturer for more information. You will need to enable Android Settings to access the update notification.
Time & Date
Edit Time & Date
Using the toggle button, enable/disable the device user’s ability to edit the time and date.
Time Zone
Select the time zone for the device.
You can select:
- A specific timezone
- Auto Device Timezone which is the timezone set by the device manufacturer. A reboot is typically required when switching to this setting.
Type in the timezone field to search. Listings are by country, for example, to find the timezones for the USA, search for "America" or "US".
Language
Set the device's language during 6-tap provisioning.
Requirements: This setting requires a Supervisor Plugin or Knox-compatible device post-provisioning
Click Save when you are ready to save the blueprint.
Step 2: Saving, Publishing, and Converging
After you’ve created a blueprint, or made changes to it, you can press Save.
Pressing Save will save the changes you made, but won’t have any effect on the devices linked to the blueprint.
After saving, you’ll notice that the version number changes. From the blueprint, you can click on the version number to see a list of your saved history.
After saving the blueprint, you can press Edit Blueprint to make more changes. Or, if you’re done making changes, press Publish.
Press Publish when you are ready to publish the new blueprint version.
You can choose two options:
- Publish: Publish the changes without converging. This means the blueprint settings will not be applied to the devices.
- Publish & Converge: Publish the changes and converge (apply the latest blueprint to devices). You can enable this option by checking the Publish & Converge devices box. This is not the only way to converge devices.
Devices will be in Drift until they are converged to the new blueprint version. You can manually Converge devices from the Devices & Groups section as well.