Anti-theft strategy on Esper: Geofence beep stops on power-off — use layered security controls to compensate

Android

If you've configured a geofence policy in Esper and noticed that the audible alert stops when a device is powered off, this article explains why and shows you how to build a comprehensive anti-theft strategy using Esper's layered security controls.

Why the geofence beep stops on power-off

The geofence alert is delivered by the Esper Agent running as an Android foreground service. When a device powers off, the Android operating system terminates all foreground services, including the Esper Agent. Because the agent is no longer running, it cannot emit the beep or enforce any further geofence-triggered actions. This is a fundamental Android OS limitation — no MDM solution can execute software-level actions on a powered-off device.

How to build a layered anti-theft strategy

Rather than rely on a geofence beep alone, combine multiple Esper security features so that protective actions activate before a device can be powered off. Follow these steps in order:

Step 1: Set geofence exit action to lock the device

In the Esper Console, navigate to Blueprints → [Your Blueprint Name] → Geofence.
Set the exit action to Lock Device.
Save and apply the Blueprint to your device group.

This renders the device unusable the moment it leaves the boundary — ideally before a thief can power it off.

Step 2: Enable a strong device lock screen policy

Go to Blueprints → [Your Blueprint Name] → Device Security.
Configure a mandatory PIN, password, or pattern.
Set a low failed-attempt threshold (for example, 3–5 attempts).
Enable automatic wipe after N failed unlock attempts to prevent unauthorized access if the device is recovered powered-on.

Step 3: Restrict access to power settings with Kiosk mode

Go to Blueprints → [Your Blueprint Name] → Kiosk Settings.
Enable Kiosk mode and set the Esper Agent as Device Owner.

This restricts access to device settings and the Power menu, making it harder for an unauthorized user to power off the device quickly.

Step 4: Enable always-on location reporting

Go to Blueprints → [Your Blueprint Name] → Location.
Set location reporting to Always On.
Set the polling interval as short as feasible for your use case.

This maximizes the window during which the Esper Console can display a last-known location before the device goes offline.

Step 5: Configure offline alerts

Navigate to Devices & Groups → [Device Name] → Alerts.
Set up notifications for unexpected offline transitions.

A sudden offline event combined with a geofence exit is a strong theft indicator. You can also use the Esper API to configure these alerts programmatically.

Step 6: Record device identifiers

In Devices & Groups → [Device Name] → Device Info, locate the device's IMEI, serial number, and MAC address.
Store these identifiers externally in a secure location.

These identifiers are essential for law-enforcement recovery and carrier-level blacklisting.

How to verify your anti-theft setup

Apply the updated Blueprint to a test device group.
Take a test device outside the geofence boundary.
Confirm in the Esper Console that the lock action was applied by checking Devices & Groups → [Device Name] → Activity.
Verify that location was recorded by checking Device Info → Last Location.

Troubleshooting

The geofence lock action does not trigger reliably: Verify that the Blueprint containing the Geofence policy is actively applied to the device group and that the device has checked in recently (indicated by a green online status).
Location polling is inaccurate or delayed: Confirm that Location Services are enabled at the OS level on the device and that the Esper Agent has been granted location permissions.
You need hardware-level tamper protection: Features such as hardware-level power-off resistance are outside Esper's current scope. Evaluate OEM-specific firmware features (for example, Knox Active Protection on Samsung devices, or physical security accessories).

Still need help?

If the geofence exit action consistently fails to fire despite the device being online and the Blueprint being applied, contact Esper Support. include device logs from Devices → [Device Name] → Logs → Request Logs with your ticket.