Skip to content Skip to site navigation Skip to service navigation

Enroll an Android Device in Mobile Device Management (AirWatch)

Note for Google Nexus and Google Pixel users running Android 7 and above: Google has made a change for security reasons that makes AirWatch unable to share network information with MyDevices. In order for your device to be compliant, you need to enroll your device in MDM and then file a compliance exception request with the Information Security Office.

Overview

Stanford's Mobile Device Management (MDM) service installs profiles on your device that configure and maintain settings on your device. MDM helps protect your privacy and the university's data.

Before you can enroll your Android device in the MDM service, you must install the AirWatch app from the Google Play Store. You need a Google account to do this.

Depending on your device, you may also need to install an additional service to support the enterprise capabilities of your device. If your device blocks the installation, change your security settings to allow installation of applications not obtained from the Google Play Store.

During the enrollment process you'll be required to set a password with a minimum of four characters on your device. Your device also needs to be encrypted; it must be plugged in and charged to 80% before encryption can begin. If your device OS is 6.0 or later, or is already encrypted, you will skip this step during enrollment.

Back up your device before enrolling! Your cellular carrier typically provides a mechanism to back up your pictures, contacts, etc. Do this first.

What to expect after you enroll in MDM

Your device will:

  • Require a password to unlock it. Stanford requires that your password is a minimum of four digits. Some manufacturers require a stronger password.
  • Time out after a period of inactivity and require a password to unlock it. You can change your display preferences in Settings to adjust the screen time out.
  • Sync your email, contacts, and calendar appointments during the first few minutes after installation if email activation is supported on your device. 
  • Check periodically to make sure it isn't rooted.
  • Display the AirWatch app and the Stanford App Catalog.
  • Perform otherwise as it did before you installed the MDM.

Warning: If you leave Stanford or get a new device, back up your data. If you remove AirWatch and encryption, the Android OS requires that you reset your phone and all data on the device will be lost. You will then have to restore your phone from the backup.

Before you begin

  • Check that your device is running Android OS 4.4.2 or above. You cannot enroll a device in MDM if the OS is below 4.4.2.
  • Make sure you have a Google ID — otherwise, you won't be able to download AirWatch from Google Play. See Create a new Google Account if you need to set one up.
  • If your OS version is below 6.0 and is not encrypted, make sure your device is at least 80% charged and plugged in. Otherwise, you will not be able to encrypt.
  • Remove any SD cards because they may become inaccessible after encryption.

Download AirWatch

You must be using your Android device to begin the enrollment process.

  1. Install the AirWatch Agent on your Android device.

    install AirWatch from Play Store

Enroll in MDM

Authenticate

  1. After the AirWatch MDM Agent installs, tap Open.
    Alternatively, you can open AirWatch from your home screen by tapping Apps > Agent.
  2. Choose Email Address for your authentication method.
    choose an authentication method
  3. At the prompt for your corporate email ID, enter your @stanford.edu email address and tap Continue.
    enter your @stanford.edu email address
  4. If you didn't enter a valid email address, the next screen  prompts you for a server and group ID. If this screen displays, enter the following and then tap Enroll Device.
    • Server: mm.stanford.edu
    • Group ID: SU-MDM or SU-Google (depending on where your @stanford.edu email is hosted)
    • Continue without email address: checked
  5. You may be asked to allow the AirWatch Agent to make and manage phone calls. Tap Allow.
    Note: While this capability exists in AirWatch, Stanford University does not access this feature. See the MDM Privacy page for more information.
    allow Agent to manage phone calls
  6. Next, the WebLogin screen displays. Enter your SUNet ID and password and tap Login. You also may have to enter a second factor for two-step authentication.
  7. Select the ownership of the device and then tap Continue.
    select the ownership of the device
  8. Tap Accept to accept Stanford's terms of use. You have completed the authentication.

Secure

  1.  Tap Continue.
    begin part 2 of enrollment to ensure device is compliant
  2. AirWatch informs you that it needs to be the device administrator. Tap Continue.
    grant permissions to AirWatch
  3. Tap Activate to grant permissions to  the AirWatch Agent to manage your device.
    activate AirWatch Agent as device administrator

Install AirWatch enterprise service (not required for all devices)

  1. Depending on your device, you may see a message that says you need to enable installation of enterprise apps not available in the Play Store. Tap Continue.
    enable installation of non-Play store apps
  2. The Settings app opens. Check the Unknown sources box to allow installation of apps from sources other than the Play Store and then tap OK. Then, tap your device's back button to return to the installation.
    allow installation of unknown sources
  3. Tap Continue to install the enterprise service.
    install enterprise service
  4. If you are using a Samsung device:
    • You may be prompted to install the AirWatch Samsung ELM app. If prompted, open with package installer and then tap Install.
    • After the app installs, the Activate device administrator screen displays.Tap Activate.
    • Agree to the Samsung KNOX privacy notice and then tap Confirm.
  5. On some devices, information regarding how the AirWatch Enterprise Service interacts with your device is displayed across several screens. Tap Next to advance to the next screen. On the last screen, tap Install.
  6. If the Activate device administrator screen displays once again, tap Activate.

Set a password and encrypt your device

Note: Encryption can take an hour or more. Start with your battery at least 80% charged and keep your device plugged in until encryption is completed.  If your device is already encrypted you'll skip this section and continue with Configure.

  1. A message saying that a device password is required displays. Tap Device Settings.
    create your device password
  2. Enter a password that consists of at least four characters and tap Continue (some manufacturers require a stronger password).
  3. Confirm your password by entering it again.
  4. Select whether to show or hide sensitive notification content on the lock screen and then tap Done.
  5. If you don't return to the AirWatch screen, open the app. Tap Device Settings to proceed.
    encryption required screen
  6. Confirm that you want to continue with device encryption. You'll be prompted to enter your password.
    start device encryption
  7. Confirm your password when prompted.
  8. Tap Encrypt device. Leave the Fast Encryption box unchecked.
    confirm you want to continue with device encryption
  9. Tap Encrypt device again to confirm that you want to encrypt this device.
  10. Your device will reboot, encrypt, and restart when done. You will need to enter your device password.
  11. Open the Agent app. 
  12. When asked to grant permission to the AirWatch Agent, tap Continue.
    grant AirWatch Agent permissions to various device capabilities

Configure

  1. The next part of enrollment configures enterprise resources for your device. Tap Continue.
    begin configuration part of enabling MDM
  2. Tap Continue to begin setting up your Stanford.
    begin email setup
  3. Enter your @stanford.edu email password and enter it again to confirm. Then, tap OK.
    enter your email password
  4. When the configuration completes, tap Exit.
    exit the setup wizard
  5. Once complete, the MDM device status is displayed. 
    device status

Activate your Stanford mail

To activate your Stanford email account, tap the Email app or navigate to Settings > Accounts > Add Account >Exchange ActiveSync.

Connect to the Stanford VPN (not available on all devices)

See Configure VPN for Android for instructions on how to connect to the Stanford VPN with your Android device.

Manage your mobile device

Once your device is successfully enrolled in Mobile Device Management (MDM), you can manage your device in MyDevices. It can take up to 8 hours before your device appears. See Manage a Mobile Device for more information.

Last modified May 1, 2017