> ## Documentation Index
> Fetch the complete documentation index at: https://firespark.cloud/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enroll a kiosk in MDM

> Attach Spark MDM to a linked tablet, scan the enrollment QR after a factory reset, and unlock private app releases.

Linking a tablet lets it take orders. **Spark MDM** is the extra step that turns that tablet into a managed Android device so you can lock it to your private app and push releases from the dashboard.

This page is for operators who already have a **linked** tablet (`LINKED`) and an active Google Play connection. You do not need to be a developer.

If Play is not connected yet, start with [Connect a Google Play account](https://firespark.cloud/docs/guides/channels/kiosk/connect-google-play.md). If you do not have a kiosk channel yet, start with [Set up kiosks](https://firespark.cloud/docs/guides/channels/kiosk.md).

> [!WARNING]
>
> The enrollment QR is not scanned by the kiosk app. You factory-reset the
> tablet, then scan the QR from Android’s setup wizard while looking at the
> dashboard. The tablet that is taking orders now will be wiped.

## What enrollment unlocks

| Before MDM (`LINKED`) | After MDM (`ENROLLED`) |
| - | - |
| Takes orders with the sideloaded or already-installed app | Stays locked on the private Managed Play app |
| Refresh cache, reload, and unlink from the dashboard | Those commands, plus remote reboot and factory wipe |
| Releases cannot install through Play | **Releases** can publish a private APK and roll it out to enrolled tablets |

A linked tablet does not enroll itself when you connect Play. You attach MDM on that device, then provision Android with the QR.

> [!NOTE]
>
> Android will not let a normal app take over the tablet or factory-reset it
> for you. The QR (or `afw#setup` plus the setup token) is the only way
> Android accepts Spark as device owner.

## What you need before you start

* Dashboard access to the merchant, with permission to manage kiosk devices
* A **kiosk** channel, with at least one tablet already claimed on **Devices** (status `LINKED`)
* An **active** Google Play account on this merchant. See [Connect a Google Play account](https://firespark.cloud/docs/guides/channels/kiosk/connect-google-play.md)
* A **Package name** saved on **Settings** (the Managed Play application id, such as `com.merchant.kiosk`). Attach MDM fails without it
* A second screen (laptop or phone) that can stay on the device page. You will point the wiped tablet at that QR
* About 20 minutes, and a tablet you can take offline while it resets

> [!TIP]
>
> Do not unlink the tablet before you enroll. Fire spark reuses that same
> device row when Android reports enrollment. Unlink deletes the row the QR
> is tied to.

## 1. Confirm Play and the package name

**1. Open the kiosk hub**

In the [dashboard](https://firespark.cloud/dashboard), select the
organization and merchant. Go to **Channels** and open the **Kiosk**
channel.

**2. Confirm Google Play is active**

The connect card at the top of the hub should show **Google Play
account** plus a name or admin email. If it still asks you to connect
Play, finish that guide first.

**3. Save the package name**

Open **Settings**. Under **MDM**, set **Package name** to the private
app id you will publish on **Releases**. Save. You can leave **Kiosk
mode** on **Single app** unless you were told to use a custom launcher.

> [!TIP]
>
> Attach MDM only appears on a device that is `LINKED` and whose merchant
> already has an active Play connection.

## 2. Attach MDM and keep the QR on screen

**1. Open the linked tablet**

Go to **Devices** and open the tablet you want to enroll. The badge
should say `LINKED`.

**2. Click Attach MDM**

Open the actions menu (`⋯`) and click **Attach MDM**. Wait for **MDM
enrollment created**.

**3. Leave this page open**

An **Attach MDM** block appears with a QR and a **Setup token**. Do not
refresh or navigate away. The QR is shown from that action. If you leave
the page, open the device again and click **Attach MDM** to create a new
QR.

The token lasts **24 hours** and works **once**. The six-character pairing code on older pending devices is not the setup token. Use the value labeled **Setup token**.

## 3. Factory-reset the tablet

**1. Take the tablet off the floor**

Customers cannot use it during this step. The current kiosk app and its
local link data will be erased.

**2. Erase all data**

On the tablet go to **Settings → System → Reset options → Erase all
data (factory reset)**. Confirm. Wait until Android restarts on the
welcome screen.

> [!WARNING]
>
> Do not unlink the device in Fire spark while you reset. The dashboard row
> must stay so Android can attach to it after the scan.

## 4. Scan the QR in Android setup

Keep the dashboard QR visible on the second screen. Work on the wiped tablet.

**1. Open the QR scanner**

On the Android welcome screen, tap the welcome text **six times**. The
camera / QR scanner opens. Connect Wi‑Fi if Android asks.

**2. Scan the dashboard QR**

Point the tablet at the **Attach MDM** QR on the dashboard. Do not scan
it with the old kiosk app — that app is gone after the reset.

**3. Finish Android’s prompts**

Android Device Policy installs and becomes device owner. Accept the
work-device screens. Stay on the tablet until setup finishes.

### If the six-tap scanner does not open

**1. Advance to the Google account screen**

Walk through welcome until Android asks for a Google account.

**2. Enter afw#setup**

Type `afw#setup` as the account and continue.

**3. Paste the setup token**

Enter the **Setup token** shown under the QR on the dashboard. This is
not the tablet device code and not the six-character pairing code.

## If the Android setup wizard does not appear

Some kiosk images, especially large panels with no volume buttons, boot straight to the desktop after a factory reset. There is no language picker and no “Hello” screen. The six taps and `afw#setup` exist only inside the Google setup wizard. If that wizard never starts, the Attach MDM QR has nowhere to go.

Play Store can still be installed. That confirms the tablet has Google services. The wizard is a separate system app, and the image can leave setup marked as already finished.

> [!WARNING]
>
> This step is for support, from a computer. A store that receives the
> tablet already on the desktop cannot enroll it themselves. Fully managed
> enrollment happens inside the first-time wizard. For those stores, enroll
> the tablet before you ship it, or leave it `LINKED` and install the app by
> hand. A `LINKED` tablet still takes orders and keeps the printer and
> scanner apps the vendor installed.

**1. Confirm the wizard is installed**

On the tablet open **Settings → Apps → Show system apps** and look for
**Setup Wizard**. If it is missing, this image cannot scan the QR.

**2. Check accounts**

In **Settings → Accounts**, a Google account already on the tablet
blocks Spark from becoming device owner. The wizard has to open with
no accounts on the tablet.

**3. Install adb on the computer**

You need Android platform-tools. On a Mac: `brew install
        android-platform-tools`. Run the commands on the computer, not on the
tablet. The computer and the tablet have to be on the same Wi‑Fi
network.

**4. Turn on developer mode**

On the tablet open **Settings → About device** (sometimes it sits under
**System** and is named **About tablet**). Tap **Build number** seven
times, until Android says you are a developer. If Settings has a
search box, type `build`. A USB mouse helps when the panel is hard to
tap. These units often have no volume buttons, so there is no key
combination for recovery.

**5. Open Developer options**

Go back to **Settings → System → Developer options**. On some tablets
that row is at the bottom of Settings, not under System. If it is
missing, developer mode did not turn on.

**6. Open Wireless debugging**

Find the **Wireless debugging** row and tap it to open its screen. Turn
the switch on. At the top, **IP address & port** is the connection
address, for example `192.168.1.50:41555`. If that row does not exist,
this Android version has no wireless debugging.

**7. Get the pairing code**

On that same screen tap **Pair device with pairing code** and leave the
dialog open. It shows a 6-digit code and a second **IP address &
port**, same IP and a different port, for example `192.168.1.50:37123`.
Closing the dialog changes the port and the code.

**8. Leave Wait for debugger off**

**Wait for debugger** is a different row. Turning it on sticks the
tablet on “waiting for a debugger to attach” and never shows an IP or a
code. Turn it off, and set **Select debug app** to **None**.

**9. Open the wizard again**

On the computer, replace the sample numbers with the ones on the
tablet. `adb pair` uses the port from the pairing dialog and asks for
the 6-digit code. `adb connect` uses the port on the main wireless
debugging screen. These commands do not erase the tablet and do not
uninstall the printer or scanner. They only mark setup as pending, then
reboot.

```bash theme={null}
adb pair 192.168.1.50:37123
adb connect 192.168.1.50:41555
adb shell settings put global device_provisioned 0
adb shell settings put secure user_setup_complete 0
adb reboot
```

After boot, the language screen and then “Hello” should appear. Continue
with the QR scan in the section above.

> [!NOTE]
>
> If the vendor desktop comes back as soon as the tablet reboots, a script
> in that image is completing setup on startup. The QR will not stick on
> that unit. Enroll it before delivery, or leave it `LINKED`.

To close the wizard without enrolling, on the same `adb` connection:

```bash theme={null}
adb shell settings put global device_provisioned 1
adb shell settings put secure user_setup_complete 1
adb reboot
```

The tablet returns to the desktop. The vendor apps stay installed.

> [!WARNING]
>
> Scanning the Attach MDM QR, once the wizard is open, does provision the
> device. Android comes back empty and Spark becomes device owner. Printer
> and scanner utilities the vendor preinstalled are removed. A USB scanner
> that behaves as a keyboard still types into the kiosk app. A USB printer
> prints when that app talks to it directly. In **Single app** mode the
> tablet stays locked to the kiosk package.

## 5. Wait for ENROLLED, then use Releases

**1. Wait for Play to install the kiosk app**

Managed Play installs the package you set on **Settings**. If **Releases**
still shows **Publishing**, wait — Play is checking the file (often about
10 minutes). Do not factory-reset again during that check.

**2. Confirm the device badge**

Back on the device page, the status should change from `LINKED` to
`ENROLLED`. Remote **Reboot** appears in the actions menu. Refresh the
page if the badge has not updated after setup completes.

**3. Publish from Releases**

Open **Releases** in the same hub. Upload the private APK and choose a
normal rollout or an emergency hotfix. Only **enrolled** tablets install
through Managed Play. Updating kiosks cannot take orders until the new
build heartbeats in.

> [!TIP]
>
> Enrollment is done when the device shows `ENROLLED` and the tablet is
> locked on the private kiosk app.

Rollouts move through **Publishing → Ready → Installing → Done**. Offline tablets pick up the version when they reconnect.

## If something goes wrong

> [accordion] Attach MDM is missing
>
> The tablet must be `LINKED`, and this merchant must have an active Play
> connection. Connect Play first. If Play is active and the action is
> still missing, the device may already have an enrollment token — look
> for a QR on the page, or click **Attach MDM** again after a refresh.

> [accordion] The dashboard says to set a kiosk package name
>
> Open **Settings**, fill **Package name**, save, then click **Attach MDM**
> again.

> [accordion] After reset there is no language screen or Hello
>
> The image booted straight to the desktop and the Google setup wizard is
> not running. Follow [If the Android setup wizard does not appear](#if-the-android-setup-wizard-does-not-appear).
> This needs `adb` on a computer. The store cannot do this step.

> [accordion] I refreshed and the QR disappeared
>
> Stay on the device page and click **Attach MDM** again. That creates a
> new one-time QR. The previous token is no longer usable.

> [accordion] The QR expired or Android says it was already used
>
> Tokens last 24 hours and work once. Click **Attach MDM** again, then
> scan the new QR. Do not reuse a screenshot of an old code.

> [accordion] The tablet stayed LINKED after I scanned
>
> Setup did not finish, or Fire spark has not received Android’s
> enrollment event yet. Confirm you scanned this device’s QR (not another
> tablet’s). Wait a minute and refresh the device page. Do not unlink.

> [accordion] After enroll I see the link screen again
>
> The factory reset cleared the old app identity. Check the dashboard
> first: if the device is `ENROLLED`, do not unlink it. Wait for Managed
> Play to install the private app. If the link screen stays after the app
> is installed from Play, contact
> [support](mailto:soporte@trade.ec?subject=Fire%20spark%20MDM%20enroll).

> [accordion] I unlinked before I reset
>
> That device row is gone. Link the tablet again by code after it boots,
> then Attach MDM on the **new** row and scan that QR. Do not scan the old
> one.

## Next

> [card] [Set up kiosks](https://firespark.cloud/docs/guides/channels/kiosk.md)
>
> Hub order: Settings, Devices, Releases, Health

> [card] [Connect a Google Play account](https://firespark.cloud/docs/guides/channels/kiosk/connect-google-play.md)
>
> Required before Attach MDM appears on a linked tablet


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.