Android Device Enrollment in MDM with QR Code Zero Touch and Samsung Knox
One phone or one thousand — the enrollment method decides how much manual work each device costs you. Here are the three real routes for company Android devices, and the honest differences between them.
🎥 Full video — watch the enrollment flow live in the MDM console
Before an Android phone can receive policies, apps or a wipe command, it must be enrolled — joined to your MDM server as a managed device. For company-owned Android phones, ManageEngine MDM Plus offers three proper methods: QR code enrollment, Zero Touch enrollment and Samsung Knox Mobile Enrollment. All three make the phone a fully managed (device owner) device, which is what gives you silent app installs and full control. What differs is scale, hardware needs and how much of the work happens before the box is even opened.
Company Android — Pick Your Enrollment Route
QR code (EMM token)Any brand • 1-50 devices
Zero Touch EnrollmentReseller-registered • Bulk
Samsung Knox (KME)Samsung only • Bulk
All three requireFactory reset first
Fully managed enrollment always starts from a factory reset or a brand-new phone — there is no way around that on Android.
1
Method 1 — QR Code Enrollment (EMM Token)
The default choice for most offices: it works on any Android brand and needs nothing but the phone and the console.
In the MDM console, open Enrollment and create a QR code enrollment for the group the device should join
Factory reset the phone (or take a new one) and stop at the very first welcome screen
Tap the welcome screen six times in the same spot — the QR code scanner opens
Scan the console's QR code, connect to Wi-Fi, and the phone provisions itself: the ME MDM agent installs, the device becomes fully managed and lands in your group
The same QR flow is sometimes called EMM token enrollment, because the QR carries your organisation's enrollment token.
2
Method 2 — Zero Touch Enrollment (ZTE)
Zero Touch is for buying phones in bulk that should enroll themselves the moment they are switched on — even after any future factory reset.
Phones must be bought from a Zero Touch reseller partner, who registers the devices' IMEIs to your organisation in Google's Zero Touch portal
In the Zero Touch portal, create a configuration that points devices to ManageEngine MDM as the device owner
Hand the phone to the employee sealed — on first boot with internet, it forces enrollment before the user can do anything else
If the user factory resets it later, it enrolls again automatically — the device cannot escape management
Honest catch: phones bought from a normal retail shop cannot be added to Zero Touch afterwards. The reseller registration at purchase time is compulsory.
3
Method 3 — Samsung Knox Mobile Enrollment (KME)
If your fleet is all Samsung, Knox gives the same zero-touch result through Samsung's own portal, with one advantage: it can also enroll devices bought from authorised resellers you add yourself, and supports bulk upload of IMEIs.
Create a Samsung Knox account and a KME profile that points to the ManageEngine MDM agent
Register devices — either the reseller uploads them, or you add them with the Knox Deployment App over Bluetooth/NFC/QR
On setup, the phone downloads the profile and enrolls as fully managed, including Samsung-specific controls other brands do not offer
4
Which Method Should You Choose
A simple decision rule:
Mixed brands, tens of devices, phones already purchased: QR code enrollment
Hundreds of devices, buying fresh through a partner: Zero Touch
All-Samsung fleet: Knox Mobile Enrollment
Employees' personal phones: none of the above — use invite/self-enrollment with a Work Profile, because fully managed enrollment factory-resets the phone and personal devices must never be reset
🔴 Warning before you start: all three methods here erase the phone completely. If a device already has data you need — photos, WhatsApp, files — back it up first. Enrollment cannot be done "over" an existing setup for company-owned control; anyone promising that is describing BYOD work-profile enrollment, which is a different, lighter mode.
🎥 Watch the Complete MDM Setup in the Video
Every step shown live in the ManageEngine MDM console — enrollment, profiles, apps and security commands, in full detail.
Android only allows an app to become device owner — the level of control MDM needs — during initial setup. That is a Google security rule, not a ManageEngine limitation. A phone that is already set up must be reset so the MDM agent can take the device-owner role during provisioning.
Can I enroll Samsung phones with the QR code method instead of Knox?
Yes. Samsung devices support normal QR/EMM token enrollment like any other Android phone. Knox is simply the smoother route for Samsung-only fleets, adding bulk IMEI registration and extra Samsung-specific policies.
What happens if an employee removes the MDM agent?
On a fully managed device the agent is protected — it cannot be uninstalled by the user, and tampering attempts are reported to the console. The device also re-enrolls automatically after a factory reset when it was enrolled through Zero Touch or Knox.
This guide is based on the ManageEngine MDM video by Technical Anshu • Stuck on a step? Ask in the video comments — that is where answers come fastest 🙏