Privileged app loses RFID/READ_LOGS access after Esper provisioning on AOSP devices: mark app as preloaded

Android

If a privileged system app loses access to sensitive functions like RFID scanning after Esper provisioning on a custom AOSP device, you may need to mark it as a preloaded app in your Blueprint instead of managing it as a standard enterprise app. This article explains how to preserve system-level permissions for pre-installed applications.

Before you begin

This issue typically occurs on custom AOSP devices without Google Play Services when a pre-installed app that relies on system-level permissions (such as READ_LOGS) loses access after provisioning. Signs include:

An app that worked before provisioning no longer functions after Esper provisioning
The app requires privileged permissions like logcat access
Your device is a custom AOSP build without Google Play Services
The app is pre-installed on the device (located in the system partition)

How to mark a preloaded app as preloaded in your Blueprint

In the Esper Console, go to Blueprints and select the Blueprint applied to your device.
Open the Apps section.
If the affected app is listed as a standard enterprise app, remove it from the enterprise apps list.
Add the app as a Preloaded App and set its state to Show. This tells Esper to recognize the app as OEM-preloaded and preserve its existing system-level permissions.
Save the Blueprint.
Factory reset your device.
Reprovision the device using Device Provisioner with the updated Blueprint.

Verify the fix

After provisioning completes, test the app's functionality. For apps that use logcat access, you can verify the permission is preserved by running:

adb shell dumpsys package <package-name> | grep READ_LOGS

The READ_LOGS permission should appear as granted=true.

If the issue persists

If marking the app as preloaded does not restore its privileges, the device firmware may have limited Android Enterprise support that prevents the standard provisioning flow from preserving system permissions. This is particularly common on custom AOSP devices without full Device Owner API support.

In this case, system-level permissions like READ_LOGS cannot be granted through standard MDM APIs. Your options are:

Work with your OEM to modify the device firmware to explicitly grant the required permission to your app at build time
Request a custom SELinux or AOSP policy change from your OEM
Contact Esper Support to discuss alternative provisioning approaches for your specific device

Still need help?

If you've followed these steps and your preloaded app still lacks the required permissions, contact Esper Support. provide:

Your device serial number and Blueprint name
The package name of the affected app
Device firmware version and build fingerprint
Output of adb shell dumpsys device_policy (taken after provisioning)
Output of adb shell pm list packages -f filtered for your app