Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/Mobile/help/en-us/index.html?contextId=setup-zero-touch

Set up zero-touch enrollment

Requirements

  • You have an account for the Google zero-touch enrollment portal. Usually, the device reseller creates the account for you when you purchase your first devices.
  • You created a task bundle for QR code enrollment. The task bundle must have an Assign policy task for an Android Enterprise device policy and must not have an Enroll task.
  • If you registered your organization with Android Enterprise in managed Google domain mode before April 9, 2024, you must turn on Use managed Google domain device enrollment in your Android Enterprise settings. See Managed Google domain device enrollment.

To set up zero-touch enrollment, do as follows:

  1. On the menu sidebar, select Setup > Google setup, and then select the Zero-touch tab.
  2. Select Use zero-touch enrollment.

  3. Under Zero-touch configuration settings, click DPC extras to configure settings applied to the device:

    • Language: The language of the Android user interface.
    • Time zone: The time zone set on the device.
    • Enable system apps: On Android Enterprise fully managed devices, system apps with a launcher icon are disabled by default. Select this setting to keep all system apps enabled.
    • Use cellular network: The device uses its cellular data connection for enrollment. If a cellular network is unavailable, the user must connect the device to a Wi-Fi network.

    Based on your settings, Sophos Mobile creates a configuration code you must enter in the Google zero-touch enrollment portal.

  4. Under Enrollment settings, configure the enrollment with Sophos Mobile:

    • Device group: The device group devices are assigned to.
    • Task bundle: The task bundle transferred to the device.
    • User authentication: Clear this checkbox to enroll user-less devices such as kiosk devices. User-less devices are Android Enterprise fully managed devices that you don't connect to an email account during enrollment. For details on user-less Android devices, see User-less Android devices.

  5. Select Save to save the enrollment settings.

To complete the zero-touch enrollment setup, create a configuration for Sophos Mobile in the Google zero-touch enrollment portal.