Fundamentally a device needs to start from a factory default state in order to be able to enroll in any EMM in Fully Managed / Device Owner mode. This is a design principal of Android Enterprise designed as a consumer protection feature as it prevents malicious actors from requesting elevated device management permissions disguised within another app. This was identified as a vulnerability of Device Administrator based management as any app could request that permission at any point. To combat this vulnerability Android Enterprise dictates that a device should start from an out of box state in order to grant Device Owner permissions to a DPC. By manually installing the VPN app and performing manual configuration steps you're breaking this seal and most likley won't be able to get the device to enroll as a fully managed device. The other issue is how you're installing the SOTI agent. By installing it manually your also taking more of a BYOD approach to the install and enrollment, also resulting in Work Profile mode. You may still be able to get the VPN client app installed first to work around network restrictions but you'd then have to use StageNow to install the agent and set it as DO as you otherwise would not be able to do so with a manual install.

Hi,

todally agree with Matt.

When your MC is only available internaly in our Network, you can only preparire the Enrollment QR and test it in the Office.

Except you have aVPN with Company wifi at Home.

Might a recommandation to Upgrade you instance, that made your life easier with Manageing Devices.

With Version 2024.1.0 you can create the Enrollment QR Code directly in MobiControl and add the Wifi or other Settings. Then you do not need any longer Stagenow to Create a Enrollment QR ;)

With using StageNow it should be possible to enroll this device into Work Managed also some time after it was factory erased, I have never tested how long it is working, but couple of hours was ok in the past.

You can tell the StageNow enrollment wizard that the agent apk is already on the device.

Hi everyone, thank you for your responses. We were able to install SOTI MobiControl and Cisco AnyConnect app through StageNow. We created one profile so both apps were installed simultaneously at the same time. We connected the device to VPN from the AnyConnect app, then entered the enrollment ID into SOTI. It is still prompting me to create a work profile. I'm assuming it's either because another app was installed to the device or because we connected to VPN prior to enrollment?