MDM onboarding stalls mid-enrollment: recovery steps for failed provisioning

Android

When an Android device stalls mid-enrollment, it remains in an incomplete provisioned state — partially configured but not fully managed by Esper.

Why this happens

Enrollment is a sequential process: Wi-Fi configuration, Esper Agent download, Device Owner rights grant, and policy application must each complete in order. If the device loses network connectivity or the Esper Agent installation is interrupted at any of these stages, enrollment halts at that point and does not automatically retry.

Step 1: Identify where enrollment stalled

1. Navigate to Devices & Groups in the Esper Console and locate the affected device. A stalled device typically appears with a status of Provisioning or Inactive, or may not appear at all if the Esper Agent never completed installation.
2. Match the device's state to one of the following failure points to target your recovery steps:
   • Wi-Fi configured, but Esper Agent download did not start or complete
   • Esper Agent downloaded, but Device Owner rights were not granted
   • Device Owner granted, but the Blueprint failed to apply after enrollment

Step 2: Check network connectivity

1. Confirm the provisioning Wi-Fi network is stable and does not drop connections during the enrollment window. Intermittent connectivity is the most common cause of stalled enrollments.
2. Verify that your firewall and proxy rules allow outbound access to all required Esper endpoints. Refer to Esper's network requirements documentation for the full list of domains and ports.
3. If your network uses a captive portal or requires certificate-based authentication, confirm the provisioning device can bypass or satisfy those requirements before the Esper Agent download begins.

Step 3: Collect diagnostic logs from the stalled device

1. If the device is partially visible in the Esper Console, request a bug report to gather system-level diagnostics without physical access. Navigate to Devices & Groups → [Device Name] → Actions, select Request Bug Report, and wait for the report to generate before downloading it.
2. If the device is not visible in the Esper Console, connect it to a workstation via USB and pull logs using ADB to identify the exact failure point:

   adb shell logcat -d -s EsperDPC > agent_logs.txt

   Review the output for connection errors, permission denials, or installation failures that indicate which enrollment stage failed.

Step 4: Factory reset the stalled device

1. Because Esper does not automatically retry a stalled enrollment, a factory reset is required to return the device to a clean out-of-box state. Use the device's hardware key combination (typically Power + Volume Down held during boot) to enter recovery mode and perform the reset.
2. Confirm network stability on your provisioning network before proceeding — re-enrolling into an unstable network will reproduce the same failure.

Step 5: Re-provision the device

1. Re-initiate provisioning using the same method originally configured for this device:
   • QR code: Generate a fresh enrollment QR code from Devices & Groups → Enroll Device and scan it during the device setup wizard.
   • Zero-Touch Enrollment: Confirm the device's IMEI or serial number is correctly mapped to your Zero-Touch configuration in the Zero-Touch portal. The device will automatically pick up the configuration on first boot after the factory reset.
   • KME (Knox Mobile Enrollment): Verify the device profile is active in the Samsung KME portal. The device will apply the profile automatically on first boot.
2. Stay with the device during re-enrollment to monitor each stage and confirm the process is not interrupted.

Step 6: Handle fleet-scale stalls

1. If multiple devices stalled simultaneously, investigate whether a shared network event (such as a firewall change, DNS failure, or proxy misconfiguration) coincided with the failures before resetting the entire fleet.
2. For Zero-Touch or KME deployments, confirm your enrollment configuration profile is correctly published and active in the respective portal before factory resetting devices — this ensures each device re-enrolls automatically without requiring manual QR code scans.
3. Stage the factory resets in small batches to validate that re-enrollment succeeds on the first few devices before proceeding with the rest of the fleet.

Verify: After re-provisioning, navigate to Devices & Groups in the Esper Console and confirm the device status shows Online and Blueprint compliance shows Applied. The device should reach this state within 10 minutes of completing the setup wizard. A status of Provisioning or Inactive after this window indicates enrollment stalled again.

If this doesn't resolve it

If enrollment continues to stall consistently across multiple devices after verifying network connectivity and re-provisioning, contact Esper Support. Before reaching out, collect the following to speed up diagnosis:

• ADB logcat output captured during the failed enrollment attempt
• Bug report from any device that reached a partially enrolled state in the Esper Console
• The provisioning method used (QR code, Zero-Touch, or KME)
• Device make, model, and Android version
• A description of the network environment, including any proxy, firewall, or captive portal configuration

Still need help?

If the steps above don't resolve the issue, submit a support ticket with your device model, Android version, Esper Agent version, and a description of what you've already tried — this helps the support team investigate without a follow-up.