Building Android Device Owner MDM: A Developer's Journey

3. ADB (Development Only)

adb shell dpm set-device-owner com.yourapp/.AdminReceiver

The Device Admin Receiver

The heart of your MDM app:

class AdminReceiver : DeviceAdminReceiver() {
    
    override fun onEnabled(context: Context, intent: Intent) {
        super.onEnabled(context, intent)
        Log.d("MDM", "Device admin enabled")
    }

    override fun onProfileProvisioningComplete(context: Context, intent: Intent) {
        super.onProfileProvisioningComplete(context, intent)
        
        val manager = context.getSystemService(Context.DEVICE_POLICY_SERVICE) 
            as DevicePolicyManager
        val componentName = ComponentName(context, AdminReceiver::class.java)
        
        // Set up initial policies
        manager.setLockTaskPackages(componentName, arrayOf(context.packageName))
    }
}

Implementing Kiosk Mode

Lock users into your app:

class KioskActivity : Activity() {
    
    private lateinit var dpm: DevicePolicyManager
    private lateinit var adminComponent: ComponentName
    
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        
        dpm = getSystemService(DEVICE_POLICY_SERVICE) as DevicePolicyManager
        adminComponent = ComponentName(this, AdminReceiver::class.java)
        
        // Enable kiosk mode
        if (dpm.isDeviceOwnerApp(packageName)) {
            dpm.setLockTaskPackages(adminComponent, arrayOf(packageName))
            startLockTask()
        }
    }
    
    fun exitKiosk(pin: String): Boolean {
        if (verifyAdminPin(pin)) {
            stopLockTask()
            return true
        }
        return false
    }
}

Managing Device Policies

class PolicyManager(
    private val context: Context,
    private val dpm: DevicePolicyManager,
    private val admin: ComponentName
) {
    
    fun enforcePasswordPolicy() {
        dpm.setPasswordQuality(admin, PASSWORD_QUALITY_COMPLEX)
        dpm.setPasswordMinimumLength(admin, 8)
    }
    
    fun disableCamera() {
        dpm.setCameraDisabled(admin, true)
    }
    
    fun restrictApps(allowedPackages: List<String>) {
        // Hide all apps except allowed ones
        val pm = context.packageManager
        pm.getInstalledApplications(0).forEach { app ->
            if (app.packageName !in allowedPackages) {
                dpm.setApplicationHidden(admin, app.packageName, true)
            }
        }
    }
    
    fun configureWifi(ssid: String, password: String) {
        val config = WifiConfiguration().apply {
            this.SSID = "\"$ssid\""
            this.preSharedKey = "\"$password\""
        }
        dpm.addNetworkConfiguration(admin, config)
    }
}

Remote Management Integration

Connect to your backend for remote control:

class RemoteCommandService : Service() {
    
    private val socket = SocketIO("wss://your-mdm-server.com")
    
    override fun onCreate() {
        socket.on("command") { data ->
            when (data.getString("type")) {
                "LOCK" -> lockDevice()
                "WIPE" -> wipeDevice()
                "INSTALL_APP" -> installApp(data.getString("url"))
                "UPDATE_POLICY" -> updatePolicy(data.getJSONObject("policy"))
            }
        }
        socket.connect()
    }
    
    private fun wipeDevice() {
        dpm.wipeData(DevicePolicyManager.WIPE_EXTERNAL_STORAGE)
    }
}

Challenges and Solutions

Challenge 1: Factory Reset Protection

Solution: Use setFactoryResetProtectionPolicy() to control who can reset the device.

Challenge 2: System Updates

Solution: Use setSystemUpdatePolicy() to control when updates install.

Challenge 3: User Escape Attempts

Solution: Implement multiple layers - disable buttons, intercept intents, monitor foreground app.

Testing Strategies

1. Use test devices - Never test on personal devices
2. Factory reset between tests - Clean slate each time
3. Emulators have limitations - Some features only work on real hardware
4. Automate with QR codes - Makes reprovisioning fast

Conclusion

Building a Device Owner MDM app requires deep understanding of Android's enterprise APIs. The power comes with responsibility - these apps have complete control over devices.

If you're building MDM solutions, start small, test thoroughly, and always have a way to recover devices during development!