Pre-requisites
Enterprise Account & Subscriptions
KiwiCloud will complete your enterprise account setup and activate product subscriptions.
Subscribed products must include functionality for managing GMA devices.
Android Enterprise Configuration
Your enterprise must set up an Android Enterprise account.
Navigate to Management > Android Enterprise and follow the on-screen instructions to complete the configuration.
I. System Initialization
Step 1: Log in to the Console
After your account is set up, KiwiCloud will send your Console access URL, username, and password via email.
Open your browser and navigate to the KiwiCloud Platform URL.
Enter your username and password, then click Login.
Step 2: Configure Default Policies (Optional)
Navigation: System Management > System Settings > Default Device Policy > Default GMA Device Policy
Modify policy settings as needed. For example:
Disable screenshots
Disable microphone access
Click Save at the bottom. Changes take effect immediately.
After devices complete enrollment via GMA control, the configured Default GMA Device Policy will automatically deploy and apply to these newly enrolled devices.
Step 3: Configure Compliance Settings (Optional)
Navigation: System Management > System Settings > Compliance Settings
Recommended settings:
Block device access: 0 days (device access will be blocked immediately upon non-compliance)
Factory reset: 3 days (device will be factory reset if it remains non-compliant for more than 3 days)
Click Save at the bottom. Changes take effect immediately.
II. Device Enrollment (GMA Enrollment)
Step 1: Create Enrollment QR Code
Navigate to Enrollment > QR Code Enrollment and click Create Enrollment.
Enter an enrollment name, select a delimiter, and click Save.
In the QR Code Enrollment list, click Details to view the generated QR code.
Print or email the QR code to the device user.
Step 2: Enroll the Device
For devices with camera：
Power on the device and connect it to the internet.
During the initial device setup, When the device displays the "Hi there" screen, quickly tap any area of the screen six times in succession to proceed to the next step.
Scan the provided QR code and follow the on-screen prompts to complete enrollment.
For devices without camera:
1) Power on the device after factory reset and tap [Start]
2) On the “Connect to Wi-Fi” screen, connect to a Wi-Fi network with internet access
3) On the “Google Sign in” screen, enter afw#setup in the “Email or Phone” field
4) On the “Enter the code” screen, input the registration code below the QR code and click [Next] to complete enrollment
⚠️ If the SN cannot be found, please contact your organization admin or the KiwiCloud technical support team.
Step 3: Verify Successful Enrollment (Optional)
In the KiwiCloud UEM Console, navigate to:
Enrollment > Device Enrollment Info > Managed
Search for the device’s Serial Number (SN):
If found: Enrollment is successful.
If not found: Contact your company administrator or the KiwiCloud Technical Support Team.
KiwiCloud App Enrollment
After completing GMS enrollment on your device, install the KiwiCloud App to enable enhanced features such as content policy distribution, scheduled location reporting, announcements, and support ticket submissions.
Enrollment Steps:
1.Open the KCApp and tap Enroll.
2.If the device SN (Serial Number) cannot be retrieved automatically, you will need to enter it manually. Tap Enter SN manually.
3.After entering the SN, tap Enroll to complete the process.
How to Find the Device SN (Serial Number):
Go to Settings > About Device > Model on your device.
Step-by-step:
1️⃣ On the system settings page, tap About Device
2️⃣ On the About Device page, tap Model
3️⃣ Locate the Serial Number under the model information
III. Device Group Management (Optional)
Step 1: Create a Group
Navigation: ☰ Device Management > ☰ Device Groups
Click the Create Group button.
➊ Enter the group name, such as “Singapore.”
➋ Select the devices to be added to this group.
➌ Click Submit to complete the creation of the device group.
IV. Recommended Initial Business Configuration Workflow
4.1 Configure Device Policy
Step 1: Configure and Deploy Device Policy
Navigation: ☰ Device Management > ☰ Device Policies
Create and publish a policy. Click Create Policy → GMA Policy.
2.1 Enter the policy name, such as “Singapore GMA Device Policy” then click Next.
2.2 Configure Device Policy. For example, on the Restrictions > Network & Connectivity tab:
➊ Disable “Bluetooth.”
➋ Click the Next.
2.3 Associate Devices/Device Groups
In 📑 Device Groups,
➊ locate and select the previously created “Singapore” group,
➋ click Save & Publish to complete policy deployment.
Step 2: Verify Policy Deployment Results
Console Verification: Locate the device policy “Singapore GMA Device Policy” you just published, click Details to open the policy details page. Then click Operation Log to view the deployment status.
Device-side Verification Method: Pull down to open the Android OS Notification Panel and check whether Bluetooth has been disabled. If the policy has been applied successfully, tapping the Bluetooth button in the Notification Panel will display “Blocked by work policy.”
4.2 Add Application
Step 1: Create App Category
Navigation: ☰ App Management > ☰ App Category
Click the Create App Category button.
➊ Enter the “Category Name,” ➋ upload the “Category Icon,” ➌ click Save.
Step 2: Add Application
Navigation: App Management > App Library
Click Add Application > Add Managed Google Play Public Apps.
Search for the app to add, such as “Firefox,” and click the 🔍 icon.
➊ Click “Firefox.”
➋ Click Select.
➌ Click Add to complete the application creation.
4.3 Configure Application Release Policy
Step 1: Configure and Deploy Application Update Policy
Navigation: ☰ App Management > ☰ App Release Policies
Click Create App Policy > GMA App Policy.
Create GMA App Policy
➊ Enter the “Policy Name.”
➋ Enable compliance check.
➌ Under Required App, select the app you just added (e.g., Firefox).
➍ Click Next Step.
Application Update Configuration:
➊ Set the “Application Update Mode” to Immediate Update Mode, leaving the other settings unchanged.
➋ Click Next Step.
App Release Scope.
➊ Under App Release Scope, select Targeted Deployment.
➋ In Device Groups, select the device group you just enrolled.
➌ Click Submit.
Step 2: Verify Policy Deployment Results
Console Verification: Locate the app release policy “Singapore GMA Policy” you just published, click Details to open the policy details page. Then click Logs to view the deployment status.
Device-side Verification Method: Check whether the app installation has completed on the device’s home screen (in this example, the Firefox app).
4.4 Application Automatic Compliance Check
Step 1: Install Non-compliant Applications
Install non-required or blacklisted applications on the device (e.g., the YouTube app).
For example: you can download and install YouTube via the browser.
Step 2: Compliance Check
In the KiwiCloud UEM console, you can query the device’s non-compliance records: ☰ Device Management > ☰ Device List. Locate the device by SN or device name, click Details, then click Policy > Device Compliance Status.
V. Daily Business Operations
5.1 Modify Policy
Step 1: Modify Device Policy Configuration
Navigation: ☰ Device Management > ☰ Device Policy
Locate the previously created device policy by name or ID, then click More > Modify.
Modify the device policy configuration as needed. Here, using “Screenshot” as an example: ➊ select “Disable”; ❷ click Next Step, then click Save & Publish.
Step 2: Verify Policy Change Results
Device-side Verification Method: On the device, tap the screenshot function and check whether the toast message “Blocked by work policy” is displayed.
VI. Remote Operations and Troubleshooting
6.1 Remote Operations
Devices under KMA management support the following remote operations:
● Associate Device Policy
● Associate App Policy
● Associate File Distribution Policy
● Fetch Files
● Enable Lost Mode
● Device Location
● Lock Device
● Unlock Device
● Remote Reboot
● Remote Shutdown
● Revoke Configuration
● Restore Default Policy
● Delete Device
● Clear Application Data
Step 1: Perform a Remote Operation on an Online Device (using Lock/Unlock Device as an example)
Navigation: ☰ Device Management > ☰ Device List
Locate the target device by name or serial number. Click More > Lock Device in the actions column.
Enter the lock password and click Submit.
The interface displays the result.
Step 2: Verify the Remote Operation Effect
The device screen will be locked and display the “Enter Password” interface.
Step 3: Unlock Device
In the actions column, click More > Unlock Device.
Enter the reason for operation, then click Confirm to unlock the device.
The interface displays the operation result.
Step 4: Verify Remote Operation Effect
The device screen lock will be lifted, restoring normal device operation.
6.2 Remote Assistance
Navigation: ☰ Device Management > ☰ Device List
Locate the target device by name or serial number(SN). In the actions column, click More > Remote Assistance.
When the device is online and Unattended Mode is enabled, the system will automatically connect to the device and activate the Remote Assistance page.
At this point, you can directly use the mouse on the screen to perform “click” and “press-and-hold swipe” operations.
If the device is offline or Unattended Mode is not enabled, a message will appear:
“Request failed. The device is not authorized for cloud access.”
How to Enable Unattended Mode on the Device? Locate and open the Remote Assistance app.
Click Enable Unattended to activate the feature.
7. Viewing and Exporting Reports
7.1 Report Schedule
The report schedule feature allows device, application, and remote assistance report data to be compiled into document format and sent to specified email addresses on a schedule.
To add a new report schedule, click Create Scheduled Report at the top right.
➊ Enter a Report Name, ➋ Select the Reports to send, then click Next Step at the bottom right.
➊ Select the details for the report schedule (for example, Report Format, Delivery Options, Recipient Email, and Email Subject), then ➋ Once all options are set, click Submit.
In the Report Schedule list, click Details to view the schedule details. Click More, where you can ➊ Select Disable to stop sending report emails, or ➋ Select Run Now to immediately send the report email.
7.2 Device Reports
The Device Reports module provides administrators with comprehensive monitoring and analysis of the operational status of enterprise devices. Through this module, administrators can view devices’ real-time status, online duration, battery level, storage usage, and other information, and generate reports for data analysis and sharing. The module supports multi-dimensional filtering to help administrators quickly obtain the required data.
7.3 App Reports
The Application Reports module is used to generate and view information on the installation and usage of applications on enterprise devices, as well as summary information of blacklisted applications. Administrators can use this module to understand details such as each application’s installation count, version distribution, and device usage, in order to optimize application deployment and management policies. App Reports support multi-dimensional data filtering for convenient analysis.
7.4 Remote Assistance Reports
The Remote Assistance Reports module is used to generate and view records of enterprise remote assistance sessions. Administrators can use this module to see details such as the number of remote sessions, completion rate, unattended status, etc. The reports support multi-dimensional data filtering to facilitate data analysis.
