Device Owner Setup

Device Owner Setup

Device Owner is the highest Android management mode. Without it, CORE MDM runs as a Device Admin with a limited feature set; with it, the full policy set works.

Device Admin vs Device Owner

	Device Admin	Device Owner
How it's set	User enables it, or the app requests it	adb dpm set-device-owner, or QR/NFC provisioning
Requires a clean device	No	Yes — no accounts may exist
Lock, Wipe, Alarm	✅	✅
Command queue, rename, inventory	✅	✅
App hide/suspend, Block Social Media	❌	✅
Enforced lock-screen PIN length	❌	✅
Reboot, kiosk, Private DNS, content-filter auto-start	❌	✅
Most system/hardware restrictions	❌	✅

The golden rule

Device Owner can only be set on a device with no user accounts (no Google account, no work accounts, nothing). This is an Android security requirement, not a CORE MDM limitation.

That's why it's normally done on a freshly reset device, before signing into anything.

Option A — ADB on a fresh/reset device (recommended)

1. Factory reset the device (or start with a new one). During setup, skip adding any account (skip Google sign-in, Wi-Fi account prompts, etc.).
2. Enable Developer options → USB debugging.
3. Install the app and set Device Owner:

   adb install -r app-release.apk
   adb shell dpm set-device-owner com.core.mdm/.MdmDeviceAdmin

   Success prints Success: Device owner set to ....
4. Now add your accounts back and sign into CORE MDM. Device Owner persists.

Verify

adb shell dpm list-owners
# Device owner: com.core.mdm/.MdmDeviceAdmin ...

Option B — QR / NFC provisioning

On the very first screen of a fresh device, tap the setup screen several times (or NFC-bump) to start QR provisioning, then scan a provisioning QR that points at the CORE MDM APK. This installs the app as Device Owner before any account is added. (The provisioning front end lives at coremdm.pages.dev/install.)

Why "set device owner" fails

The command refuses with one of these — all mean remove the blocker first:

• "Not allowed to set the device owner because there are already some accounts on the device" — remove every account (Settings → Passwords & accounts). Some system accounts (e.g. Google Meet/Duo) re-register themselves; you may have to unregister inside that app, or factory reset.
• "device owner is already set" — it's already done.
• "Trying to set the device owner, but admin is not active" — set the admin first: adb shell dpm set-active-admin com.core.mdm/.MdmDeviceAdmin.
• A work profile or a second user exists — remove it; Device Owner needs a single-user, account-free device.

Testing without wiping a real phone

Use an emulator — a fresh AVD has no accounts, so Device Owner takes instantly. See Testing with an Emulator.

Removing Device Owner

Because the shipped manifest is not testOnly, you can't remove it with a plain adb shell dpm remove-active-admin without root. Remove it from inside the app (it calls clearDeviceOwnerApp), or factory reset the device.