MAC address randomization during provisioning: causes and workaround

Android

When provisioning devices onto an open Wi-Fi network (no password), devices connect using a randomized MAC address instead of their hardware MAC address, causing them to be blocked by network equipment that enforces MAC address whitelisting.

Why this happens

Android 9 and later automatically assigns a randomized MAC address to every new network entry at the system level. When the Esper Agent adds an open SSID to a device during provisioning, Android applies this randomization before the device ever connects, so your network's whitelist never sees the real hardware MAC address.

Before you begin

Confirm the device is running Android 10 or later. The ADB command used in this guide requires Android 10+.
Have ADB installed and working on your computer.
Have the exact SSID name of the open network ready.
Have access to your network equipment's ARP or DHCP table to verify MAC addresses after connecting.

How to fix MAC randomization using ADB

Connect the device to your computer and verify ADB sees it.
```
adb devices
```
The device's serial number should appear with the status device. If it shows unauthorized, unlock the device and accept the ADB debugging prompt.
Remove the open SSID from the device. The existing network entry already has a randomized MAC assigned to it. Forgetting the network clears that entry so it can be re-added cleanly. Go to Settings → Network & Internet → Wi-Fi → [SSID] → Forget, or remove it programmatically through your existing tooling.
Re-add the network with MAC randomization explicitly disabled.
```
adb shell cmd wifi connect-network "YourSSID" open -r none
```
Replace YourSSID with the exact name of your network. The -r none flag instructs Android to use the device's hardware MAC address for this network instead of a randomized one.
Confirm the device connects to the SSID and that the Wi-Fi icon appears in the status bar.
Verify: Open your network equipment's ARP or DHCP table and confirm the MAC address recorded for the device matches the hardware MAC shown in the Esper Console at Devices & Groups → [Device Name] → Device Info. The device should appear as connected and the MAC addresses should match within one to two minutes of joining the network.

If this doesn't resolve it

Work through these checks before contacting support:

The ADB command is rejected or not found: The cmd wifi connect-network command with the -r flag requires Android 10 or later. Run Settings → About Phone → Android Version to confirm the OS version. Devices on Android 9 do not support this flag.
The device still cannot connect after re-adding the network: Confirm that the hardware MAC displayed in the Esper Console under Devices & Groups → [Device Name] → Device Info is the exact MAC address whitelisted on your network equipment. A mismatch here means the whitelist entry needs to be updated, not the device.
Applying this to a large fleet: The ADB method requires a physical or remote ADB connection per device and is not practical beyond a small number of devices. Contact Esper Support to discuss scalable options for your deployment size.

When contacting support, include the device model, Android version, the SSID name, and a screenshot of the MAC address shown in Devices & Groups → [Device Name] → Device Info.

Still need help?

If the steps above don't resolve the issue, submit a support ticket with your device model, Android version, Esper Agent version, and a description of what you've already tried — this helps the support team investigate without a follow-up.