<code>INSTALL_FAILED_VERIFICATION_FAILURE</code> during Blueprint convergence — fix with multi-architecture APK

Android

When a Blueprint converges and attempts to install an app on a managed device, the installation fails with the error INSTALL_FAILED_VERIFICATION_FAILURE and the device remains non-compliant.

Why this happens

Google Play Protect scans APKs before installation. When an app is compiled for a single CPU architecture (most commonly arm64-v8a only), Play Protect can flag it as suspicious on certain devices and block the install entirely. Building the APK with support for multiple architectures resolves the mismatch that triggers this block.

Step 1 — Confirm the app's architecture support

Before rebuilding, verify the APK is actually single-architecture. Run the following command against the APK on your workstation:

aapt dump badging your-app.apk | grep abi

If the output lists only one ABI (for example, abi: 'arm64-v8a'), the APK needs to be rebuilt.

Step 2 — Rebuild the app with multi-architecture support

Update your app's build configuration to include at minimum both arm64-v8a and armeabi-v7a ABIs. Including x86_64 is recommended if any devices in your fleet use emulated or x86 hardware. Consult your build system's documentation (Gradle, CMake, or NDK) for the correct ABI split or universal APK configuration.

Step 3 — Upload the new build to the Esper Console

Navigate to Apps & Configuration → Apps → [Your App] → Upload New Version and upload the updated APK. The new version must be present in the Esper Console before updating any blueprint.

Step 4 — Update the blueprint to reference the new version

Navigate to Blueprints → [Your Blueprint] → Apps, locate the app, and change the pinned version to the newly uploaded build. Save the blueprint. This ensures that the next convergence pushes the corrected APK rather than the previously failing version.

Step 5 — Update the Esper Agent before converging

Navigate to Devices & Groups → [Device Name] → Esper Software Updates and apply the latest available Esper Agent version. Newer Agent versions include improvements in how Play Protect interactions are handled during installation.

Step 6 — Apply the updated blueprint

Navigate to Devices & Groups → [Device Name or Group] → Blueprint → Apply / Converge and trigger convergence. The device will pull and install the new multi-architecture APK.

Verify

Verify: Within 10 minutes of convergence, the device's compliance status in Devices & Groups should change to Compliant. Confirm the installed app version under Devices & Groups → [Device Name] → Apps matches the version you uploaded in Step 3. Check the Activity Feed for the device to confirm no further INSTALL_FAILED_VERIFICATION_FAILURE events appear.

Alternative: Disable Play Protect on individual devices

If rebuilding the app is not immediately possible, Play Protect can be disabled on individual devices. This approach requires touching each device manually and is not practical for large fleets.

Ensure Google Play Store is enabled on the device. If it is currently disabled by policy, temporarily enable it via Devices & Groups → [Device Name] → Apps or through the blueprint.
On the device, open the Play Store app, tap the profile icon, select Play Protect → Settings, and turn off Scan apps with Play Protect.
Return to the Esper Console and trigger convergence from Devices & Groups → [Device Name] → Blueprint → Apply / Converge.
Re-disable the Play Store app after convergence completes if your policy requires it.

If this doesn't resolve it

If the error persists after rebuilding and reconverging, collect the following before contacting Esper Support:

Device ID (visible in Devices & Groups → [Device Name] → Device Info)
Esper Agent version (visible on the same Device Info screen)
Android OS version
Output of
```
aapt dump badging your-app.apk | grep abi
```
confirming the rebuilt APK's supported ABIs
A bug report retrieved via Devices & Groups → [Device Name] → Actions → Request Bug Report or via ADB:
```
adb bugreport
```

Still need help?

If the steps above don't resolve the issue, submit a support ticket with your device model, Android version, Esper Agent version, and a description of what you've already tried — this helps the support team investigate without a follow-up.