Manually Grant Companion Device Owner Rights

For company-owned Android Enterprise devices, the Matrix42 Companion application requires Device Owner privileges to perform advanced device management tasks such as deploying Wi-Fi configurations, installing certificates, managing enterprise applications, enforcing device restrictions, and applying other device-wide policies. Devices enrolled through supported Android Enterprise provisioning methods automatically receive these privileges during the enrollment process.

However, in some scenarios, company-owned devices are enrolled after the Companion application has been installed manually, for example through sideloading or installation from Google Play on an already configured device. Typical scenarios include:

• Devices were initially configured as consumer devices and Companion was installed afterwards.
• Companion was sideloaded on an already operational device, including devices without Google Mobile Services (GMS) where applications are deployed manually.
• Companion was installed from Google Play instead of being provisioned through Android Enterprise.
• Devices were not enrolled through afw#matrix42, QR Enrollment, NFC Bump, Zero-Touch or another Android Enterprise provisioning workflow.

As a result, management actions that require elevated Android Enterprise privileges can fail, leading to configuration errors, pending commands, or incomplete enrollment like the following:

Network SSID: <SSID>
Can't install network.
Caller is not a device owner, profile owner, system app, or privileged app.

This article describes how to verify the current Device Owner status and how to manually grant Device Owner privileges to the Matrix42 Companion application using Android Debug Bridge (ADB). This procedure can be performed by an administrator or provided to end users when access to Developer Options, ADB and USB debugging is permitted within the organization. Once completed, the Companion application will be able to execute Android Enterprise management actions that require Device Owner permissions. 

In addition, the procedure can be performed either before or after enrolling the device in Silverback. In environments where it is already known that the Companion application was installed manually and no Device Owner has been assigned, administrators can enable USB debugging, connect the device through ADB, and execute the Device Owner assignment commands before starting the enrollment process. In such cases, the Device Owner status verification steps described in this article may be skipped and the process can continue directly with the ADB preparation and Device Owner assignment steps.

Review Device Owner Status

If the device is already enrolled in Silverback, verify whether the Matrix42 Companion application is operating as the Device Owner. The status can be reviewed either directly on the device within the Companion application or in the Silverback Management Console. If the Companion application is not configured as the Device Owner, Android Enterprise management features may be limited. In Silverback, this can often be identified by missing device information such as the serial number or IMEI, pending commands, or failed configuration deployments. If the device is not yet enrolled in Silverback, proceed directly to Prepare Android Debug Bridge (ADB) and continue with the Device Owner assignment steps.

Option A: Review Device Owner Status in Companion

• Open the Matrix42 Companion application on the device.
• Open the navigation menu.
• Select About.
• Review the Provision Status field.
• Verify that the status is displayed as:
  • Device Owner (configured correctly)
  • Legacy Mode (Device Owner not configured)

Option B: Review Device Owner Status in Silverback

• Open the Silverback Management Console and sign in.
• Navigate to Devices.
• Select the target Android Enterprise device.
• Review the Device Information section.
• Locate the Device Owner field:
  • Yes indicates that Companion is operating as Device Owner.
  • No indicates that Device Owner privileges are not assigned.
  • Additional indicators that Device Owner provisioning may be missing include:
    • The Serial Number is not displayed.
    • The IMEI is not displayed.

Prerequisites for Assigning Device Owner Rights

Verify that the following minimum requirements are fulfilled. These prerequisites are mandatory for assigning Device Owner privileges using ADB:

• Matrix42 Companion is installed. If the application is not yet installed, download and install the latest available version:
  • Latest Release: https://play.google.com/managed/downloadManagingApp?identifier=matrix42
  • Latest Beta: https://play.google.com/managed/downloadManagingApp?identifier=matrix42beta
• USB Debugging can be enabled.
• A USB cable is available.
• Android Debug Bridge is installed

Depending on your deployment scenario, additional requirements may apply for later sections of this article, such as reviewing the Device Owner status in Silverback or modifying device restrictions. These actions require an enrolled device and administrative access to the Silverback Management Console.

Prepare Android Debug Bridge (ADB)

To manually assign Device Owner privileges, Android Debug Bridge (ADB) is required. ADB is part of the Android SDK Platform-Tools and enables communication between a computer and an Android device over USB. The following sections describe how to install the Platform-Tools package, enable Developer Options and USB debugging, and establish an ADB connection to the device.

Extract and run tool

• Navigate to your downloaded *.zip file
• Extract the archive to your desired location, e.g., C:\Debug\
• Navigate now with the Windows Explorer to C:\Debug\platform-tools
• You should see now inside the folder several files, e.g. adb.exe
• Type now in the address bar cmd and press enter
  

• A new command prompt should be opened, and you should be already in the right location

Enable Developer Options

• On your Android device, open the Settings application
• Search and locate the Build number information
• Press now minimum seven times the build number until and enter your PIN or password if set
• The developer mode should now the enabled
• Search and locate now the Developer options
• Enable USB debugging
• Confirm with OK

After everything is prepared, you need to connect your device to your PC and authorize your device for ADB.

Troubleshoot Developer Options 

If Developer Options cannot be enabled or if Android displays a message indicating that the action is blocked by a work policy, review the effective device restrictions in Silverback. From the device overview, perform the following steps:

• On the Top Right, press Resultant Tags
• Select Restrictions
• Locate Allow Debugging Features entry and check if its enabled or disabled
  • For Samsung Knox devices, also check Allow USB Debugging
• If it is disabled, you need to detach the device from the Tag. From the Resultant Tag, press the Tag Name in the Inherited from Tag column 
  • After opening the Tag, review the Auto Population Setting: 
    • If the Auto Population is not enabled, press Associated devices…, locate your Device ID and press Detach and confirm with OK
    • If the Auto Population is enabled, disable it first and press Save, then press Associated devices…, locate your Device ID and press Detach and confirm with OK. After successfully assigning the Device Owner permissions and completing the procedure described in this article, re-enable Auto Population to ensure that devices continue to be assigned to the tag automatically.
• Perform a sync on your device. 

Connect Device, verify and Assign Device Owner

After preparing Android Debug Bridge (ADB) and enabling USB debugging on the device, the next step is to establish an ADB connection between the device and your computer. Once connected, you can verify the current Device Owner configuration and, if required, assign Device Owner privileges to the Matrix42 Companion application.

Connect and authorize your device

• Connect your device via USB to your PC
• Navigate to your previously opened Command Prompt
• Type adb devices
• Your device will be currently unauthorized
• On your device, enable the Always allow from this computer (optional) checkbox and press Allow (mandatory)
• Type again adb devices and you should see your serial number now without the unauthorized info
  

Verify and Assign Device Owner

• Now enter adb shell dpm list-owners
• Verify that no Device Owner is currently configured on the device. A device without a Device Owner will typically return no owners.

• Now set Companion as the device owner using the following command:
• Important: The assignment only succeeds if no Device Owner is already configured on the device. If dpm list-owners returns an existing owner, the command will fail.

  • adb shell dpm set-device-owner com.silverbackmdm.epic.companion.ss/com.silverbackmdm.epic.DeviceMdmReceiver

  • You should receive the following message:
    • Success: Device owner set to package com.silverbackmdm.epic.companion.ss/com.silverbackmdm.epic.DeviceMdmReceiver
      Active admin set to component com.silverbackmdm.epic.companion.ss/com.silverbackmdm.epic.DeviceMdmReceiver
• Now execute again adb shell dpm list-owners
  • You should receive the following message:
    • 1 owner:
      User  0: admin=com.silverbackmdm.epic.companion.ss/com.silverbackmdm.epic.DeviceMdmReceiver,DeviceOwner,Affiliated

Check Status Changes

After assigning Device Owner privileges, verify that the changes have been applied successfully on both the device and in Silverback. The Companion application should now report a Device Owner provisioning status, and the updated device information should be synchronized with Silverback. The following steps describe how to trigger a synchronization and confirm that the Device Owner status has been updated correctly.

Perform a Sync 

• Open the Companion application on your device
• Expand the Menu on the Top Left
• Navigate to About
• Review the Provision status: It should be set to Device Owner
• Press back
• Wait until a sync is finished

Review Device in Silverback

• Return to the Silverback Management Console.
• Refresh your browser and reopen the Device Overview for the affected device.
• Verify that the Device Owner field is set to Yes.
• Verify that device information such as the Serial Number and IMEI is now displayed.

Result

The Matrix42 Companion application is now configured as the Device Owner of the device. After synchronization, Silverback should reflect the updated status and display additional device information such as the serial number and IMEI. The device is now ready for Android Enterprise management and can receive configurations that require Device Owner privileges.