Restrict provisioning to specific devices using Seamless Provisioning

Android

When you need to ensure only known, pre-approved devices can be provisioned into your fleet, the standard 6-Tap QR code method is not sufficient — QR codes generated in the Esper Console are reusable by design and can provision any device that scans them. Seamless Provisioning with serial number pre-registration locks each provisioning entry to a single, identified device.

Why this happens

6-Tap QR codes in Esper contain configuration data but no device identity check. Any device that scans the code will be provisioned against your Blueprint. Seamless Provisioning works differently: each entry is tied to a hardware serial number, so provisioning only completes when the device identity matches what is registered in the Esper Console.

Before you begin

Gather the hardware serial number for each device you plan to provision. You can find this in three ways:

On the device packaging or printed inside the battery compartment
On the device itself under Settings → About phone → Serial number
Via ADB by running:

adb shell getprop ro.serialno

Seamless Provisioning requires the device to reach the Google Account sign-in screen during initial setup. Devices where the setup wizard is locked by a carrier, or where Google Mobile Services (GMS) is blocked, may not support this method.

Step 1: Register the device serial number in the Esper Console

Open the Esper Console and go to Provisioning → Provisioning Methods.
Select Seamless Provisioning as the provisioning method.
Select the target Blueprint and Group for the device. This determines the configuration and policy applied when the device checks in.
Enter the exact hardware serial number of the device. This creates a provisioning entry that will only match that specific device — any other device attempting to provision through this entry will be rejected.
Save the entry.

Step 2: Review your Blueprint app configuration

In the Esper Console, open the Blueprint assigned to this device.
Review the list of apps configured to install During Provisioning.
For any app that is also pre-installed as a system app on the device — such as Chrome or other OEM-bundled apps — change the install timing to Post Provisioning. Installing a Play Store version of an app that already exists as a system app can cause a version conflict that halts provisioning with an error such as INSTALL_FAILED_MISSING_SPLIT.
Save the Blueprint.

Step 3: Provision the device

Factory reset the device to return it to its out-of-box state.
Power on the device and proceed through the Android setup wizard until the Google Account sign-in screen appears.
In the Google Account field, enter afw#esper and tap Next. This triggers the Android for Work enrollment flow and downloads the Esper Agent.
Follow the on-screen prompts to complete provisioning. The Esper Agent will match the device's serial number against the pre-registered entry and apply the assigned Blueprint and Group.

Verify

Verify: In the Esper Console, go to Devices & Groups and confirm the device appears with a status of Active. The pre-registered serial number entry should now display the live device name rather than a pending state. This should occur within 5 minutes of completing the on-device setup wizard.

If this doesn't resolve it

Check the following before contacting support:

Device stuck on the "Device Onboarded" screen: An app configured to install During Provisioning is likely failing. In the Esper Console, open Activity Feed for the device and look for INSTALL_FAILED_MISSING_SPLIT or similar errors. Move the affected apps to Post Provisioning, factory reset the device, and retry.
Serial number not matching: Confirm the serial number in the Esper Console exactly matches the output of
```
adb shell getprop ro.serialno
```
on the device. Some OEMs report different values in Settings → About versus ADB — use the ADB value as the authoritative source.
Seamless Provisioning flow does not complete: Confirm the device has a stable internet connection at the Google Account screen and that the serial number entry in the Esper Console has not already been consumed by a previous provisioning attempt.

If the issue persists, contact Esper Support with the device serial number, the Blueprint name, and a screenshot or text copy of any error messages shown in the Activity Feed.

Still need help?

If the steps above don't resolve the issue, submit a support ticket with your device model, Android version, Esper Agent version, and a description of what you've already tried — this helps the support team investigate without a follow-up.