Technical · Course T2Lesson 3 of 5
QR code enrollment
9 min read- Generate and share the enrollment QR code for a policy
- Embed Wi-Fi, locale, and provisioning options in the code
- Run the device-side flow from factory reset to managed home screen
- Troubleshoot the three most common QR enrollment failures
QR enrollment is the workhorse: no external portals, no reseller coordination — a code on your screen and a factory-fresh device. Here's the full loop, console to device.
Generate the code
- Open Policies and find the Android policy the devices should land under — Work Managed for corporate, Work Profile for BYOD, Kiosk for dedicated devices.
- Click the QR code icon in the policy's row.
- The dialog shows three things: the QR code itself, a short enrollment code for reference, and the expiration date (or "Perpetual").
- Download the PNG from the dialog to print or share.
Two properties partners should internalize: the code is per-policy, not per-device — one code enrolls unlimited devices under that policy — and it works until its expiration date, so check expiry before a big enrollment day.
Tune the provisioning payload
Open the policy's QR Code section to embed setup behavior in the code itself:
| Setting | Why you'd use it |
|---|---|
| Wi-Fi configuration | Embed SSID + password (WPA/WEP/EAP) — devices join the network without anyone typing |
| Enable mobile data | Provision over SIM data where Wi-Fi is absent |
| Skip encryption | Faster setup where mandated encryption isn't required |
| Proxy | Manual or PAC-URL proxy for locked-down networks |
| Locale | Pre-set language + timezone for international rollouts |
| Location / Bluetooth | Radio state during provisioning |
| IT compliance | Run compliance checks during enrollment |
Save the policy after changes — the QR regenerates with the new payload, so re-download if you'd already printed it.
Embedding Wi-Fi is the single highest-leverage option: it turns QR enrollment into a near-zero-touch experience where staff just scan and wait.
The device-side flow
- Factory reset used devices (Settings → System → Reset options); new devices just power on. You need the initial Welcome screen.
- Tap the screen six times in the same spot — this summons the built-in QR scanner (Android 7.0+; some devices first prompt to fetch the reader — allow it).
- Scan the code. The device pulls the WeGuard agent, applies the policy, and registers.
- If Wi-Fi wasn't embedded, it prompts for a network mid-flow.
- Done looks different per mode: a work-profile home screen (BYOD), a fully managed home screen (Work Managed), or the kiosk launcher (Dedicated).
Verify in Devices: the new device shows with status Active and the policy applied.
When it fails
- Six taps do nothing — the device isn't at the factory-reset welcome screen, or an OEM skin doesn't support the gesture. Reset properly; on stubborn hardware fall back to another provisioning method.
- Scan errors out — expired code, blurry image, or no connectivity. Regenerate the code and confirm the network.
- Agent downloads but enrollment fails — almost always the Android Enterprise binding: confirm the Enterprise ID is present and valid, then regenerate the QR.
- No QR icon on the policy — plan restriction; check the customer's subscription.