"Admin doesn't allow installation from unknown sources" error during Blueprint converge/provisioning

Android

When you try to install a private or enterprise app (not from Google Play) during device enrollment or Blueprint convergence, you may see the error: Admin doesn't allow installation from unknown sources. This article explains how to resolve this issue.

Before you begin

This error occurs when the Esper Esper Agent attempts to install a side-loaded APK on a device where the "install from unknown sources" setting is blocked by device policy. This can happen during Blueprint convergence, initial provisioning, or when manually installing apps after provisioning.

How to fix installation failures during enrollment or Blueprint convergence

In the Esper Console, go to Blueprints and clone the Blueprint that contains the problematic app.
In the cloned Blueprint, remove the app triggering the error from the app list.
Apply the cloned Blueprint to the affected device group and attempt provisioning again to confirm the device can enroll without the problematic app.
If provisioning succeeds, perform a factory reset and reprovision the device using the original Blueprint (or cloned Blueprint with apps re-added). This allows the Esper Agent to establish full Device Owner status cleanly from first boot.
After the device has completed provisioning, go to Devices & Groups → [Device Name] → Apps and manually install the previously failing app.
Verify that the app now shows status Installed in the Apps section and that the convergence operation shows Completed in the device Activity Feed.

How to troubleshoot if the error persists after provisioning

Connect the device via ADB and pull a bug report:
```
adb bugreport bugreport.zip
```
Review the dpc_logs section to confirm whether the Esper Agent is registered as Device Admin and to identify the exact point of failure.
In the Esper Console, go to Devices & Groups → [Device Name] → Device Info and verify that the Esper Agent is listed as the active Device Owner. If it is not, the device requires a full factory reset and clean re-provisioning via QR code, Zero-Touch, or KME to establish Device Owner correctly.
Go to Devices & Groups → [Device Name] → Compliance Policy / Blueprint → Security Settings and confirm that Install from unknown sources is not set to Disallowed. If it is, change the setting to allow installations.

Why this error occurs

Android requires either full Device Owner privileges or explicit user permission to install apps from sources outside Google Play. If the Esper Agent has not yet fully established Device Owner status, or if a policy from a previous MDM enrollment or OEM configuration is blocking unknown source installations, Android's package manager rejects the installation. This is Android's policy enforcement working as designed, but it can indicate an incomplete Device Owner grant or a residual policy from a previous enrollment.

Still need help?

If the error persists after completing these steps, contact Esper Support and include:

Device model, OEM manufacturer, and Android firmware version
The ADB bug report file
A screenshot of the full error message from the Esper Console