Device management (MDM)

Manage company Android phones for your fleet from the Merchant Dashboard — with or without a USB cable.

This is not the same as the rider courier app (Mobile apps). MDM is a separate company-phone agent used for inventory, live location of company phones, emergency lock, SMS/call visibility, and remote app install on phones you own.

You have two live maps on purpose:

Map	Who appears
Live Map (existing)	Riders using the Flutter courier app — freelancers or anyone on their own phone (no MDM install)
MDM live map (new)	Company phones with the iDeliver MDM agent installed

Open MDM live map or Device management in the merchant menu at merchant.ideliver.ng . You only see phones enrolled under your merchant — never another merchant’s devices.

What you can do

Feature	Description
MDM live map	See company-phone GPS pins; tap a pin → Device info
Device management	Enroll phones, bind riders, QR, quick lock / lifecycle commands
Device info	Model, IMEI/serial (when available), battery, location trail, SMS / calls / commands with date filters
Enroll phones	Create an enrollment → QR (preferred) or ADB / browser install fallback
Delete unused enrollment	Remove pending / revoked / never-activated enrollments from the list
Inventory	Status, model, last seen, Device Owner flag
Bind rider	Link a phone to a rider UUID on your account
Lock	Immediately lock the phone (emergency)
Messages	Pull / view SMS; send SMS from the phone
Call log	Pull / view recent call history
Push APK	Queue silent install of an app from an HTTPS APK URL (only way to add apps after Device Owner — users cannot install from Play or unknown sources)
Disable / enable agent	Pause or resume MDM ops (phone stays protected)
Uninstall agent	Remove MDM (requires typing `UNINSTALL`)
Wipe	Factory-reset the phone (requires typing `WIPE`)

Download the MDM agent (v1.6.1+)

Direct production APK (also used by enrollment QR):

https://api.ideliver.ng/v1/public/mdm-agent.apk

Also listed on Mobile apps. Package name: com.ideliver.mdmagent.

After enrollment as Device Owner, the phone user cannot:

Install apps from the Play Store or unknown sources (only admin/merchant Push APK / install_apk)
Uninstall or disable apps (including MDM and the courier app) from Settings
Clear app data / force-stop apps from Settings
Factory-reset or use safe mode / network reset to escape management
Turn on airplane mode, change mobile network / mobile data settings, or (Android 13+) toggle Wi‑Fi off
Turn on personal hotspot / tethering

Only you (or platform admin) can disable or uninstall the agent from the web.

Android does not let MDM block deleting individual SMS or call-log rows inside the stock Messaging / Phone apps. Those messages and calls are still synced to your dashboard — deleting them on the phone does not remove the server copy.

Before you start

You have a merchant account at merchant.ideliver.ng (or admin access for platform stock).
You have a company Android phone (new or ready to factory-reset). Personal phones with Google accounts already set up are not suitable until wiped.
Wi‑Fi available for the phone during setup.
Optional: the rider UUID you want to bind (from your riders list).
Optional for fallbacks: a computer with USB and ADB (Android platform tools).

Enroll a company phone

There are three ways to enroll. Use them in this order:

Method	When to use	USB needed?
1. QR (recommended when it works)	Default — no IT skills	No
2. ADB install + Device Owner (recommended fallback)	Play Protect blocks QR or browser install	Yes
3. Browser download only	Rarely works when Play Protect hard-blocks; still needs ADB for Device Owner	Yes for DO

All methods use the same production APK. After Create enrollment, the dashboard shows a short pairing code (e.g. 7K3M-9P2Q) to type in the MDM app — you do not need the long mdm_… token for the ADB path.

Play Protect hard block: On many factory-reset phones (especially without a Google account), there is no “Install anyway” / skip. Browser and QR install both fail with “App blocked to protect your device.”
Use Method 2 (ADB) — adb install installs the APK without that installer UI.

Method 1 — QR (recommended)

No USB. No “USB debugging”. Best when Google Play Protect allows the download.

On the dashboard

Sign in to merchant.ideliver.ng (or admin Fleet devices (MDM)).
Open Device management.
Enter an optional label (e.g. “Rider 3 — Tecno”) and optional Rider ID.
Click Create enrollment.
Keep the Scan this after reset QR on screen (or reopen with Show setup QR on that device).

On the phone

Factory-reset the phone (or use a brand-new phone).
On the first welcome / Hello screen, tap the same spot about 6 times until you see Scan QR code (wording varies by Android brand).
Connect to Wi‑Fi when asked.
Scan the QR from your dashboard.
Wait while the phone downloads iDeliver MDM, becomes Device Owner, and enrolls automatically.
If prompted, allow SMS, Phone / call log, and Location permissions (needed for Messages, Call log, and MDM live map).

When the phone appears in your device list as enrolled (and ideally shows DO = Device Owner), setup is complete. Agent 1.6.1+ is recommended (GPS + more reliable enrollment).

Factory reset erases the phone. Only use company devices. Do not enroll a rider’s personal phone unless your policy and the rider agree and the device can be wiped.

If QR fails

Common on-device messages:

Message	Meaning	What to do
App blocked to protect your device (Google Play Protect)	Play Protect blocked the company MDM APK. On many new / wiped phones with no Google account there is no skip / Install anyway.	Do not keep retrying browser or QR — use Method 2 (ADB install) below
An error occurred + only Reset	Setup Wizard aborted (often the same Play Protect block after “belongs to your organization”)	Tap Reset, then Method 2
Stuck on Downloading…	Wi‑Fi / network cannot reach the APK URL	Try another Wi‑Fi; confirm the APK link opens on another device

Method 2 — ADB install + Device Owner (use this when Play Protect blocks)

This is the supported workaround when:

QR shows App blocked to protect your device, or
Browser download installs fail with the same message and no continue option, especially on a reset phone without Gmail / Google account (Play Protect settings are often unavailable).

Same production APK and dashboard token as Method 1 — only the install path changes.

Why browser install fails without Google email

Play Protect’s hard block is enforced by the system package installer. Without a Google account:

You often cannot open Play Store → Play Protect → turn scanning off
There is no “Install anyway”
Downloading the APK in Chrome and tapping it still fails

adb install does not use that installer UI, so the APK installs. Then ADB sets Device Owner.

Requirements

Computer with Android platform-tools (ADB)
(Windows / Mac / Linux — unzip and use adb from Terminal / PowerShell)
USB cable
Company phone you can factory-reset

Steps

1) Dashboard — create enrollment

merchant.ideliver.ng → Device management (or admin Fleet devices (MDM)).
Create enrollment → note the large pairing code (e.g. 7K3M-9P2Q).
Type that in the MDM app — do not type the long token.

2) Phone — normal setup (no QR)

Factory-reset the phone.
On welcome screens: do not scan the iDeliver QR.
Skip Google account / Gmail if offered (fine for company DO setup).
Connect Wi‑Fi (needed later for enroll API).
Enable USB debugging:
- Settings → About phone → tap Build number 7 times
- Settings → Developer options → USB debugging ON
Plug into the computer → on the phone tap Allow USB debugging.

3) Computer — install APK and set Device Owner

In Terminal (Mac/Linux) or PowerShell (Windows), from a folder you can write to:


# Check the phone is connected (should list a serial)
adb devices
 
# Optional but helps on strict phones: don’t verify ADB installs with Play Protect
adb shell settings put global verifier_verify_adb_installs 0
adb shell settings put global package_verifier_enable 0
 
# Download the same APK QR would use
curl -L -o mdm-agent.apk https://api.ideliver.ng/v1/public/mdm-agent.apk
 
# Install WITHOUT the Play Protect package-installer screen
adb install -r mdm-agent.apk
 
# Make iDeliver MDM the Device Owner (must be a clean single-user device)
adb shell dpm set-device-owner com.ideliver.mdmagent/.IDeliverDeviceAdminReceiver

Windows without curl: download the APK in a browser on the PC, then:


adb install -r C:\path\to\mdm-agent.apk
adb shell dpm set-device-owner com.ideliver.mdmagent/.IDeliverDeviceAdminReceiver

4) Phone — enroll with the pairing code

Open the iDeliver MDM app (app drawer).
API base is usually already https://api.ideliver.ng.
Type the pairing code from the dashboard (e.g. 7K3M-9P2Q) → Enroll phone.
Allow SMS, Phone / call log, and Location if prompted.

Success

App badge shows Enrolled · Device Owner
Dashboard device row: enrolled and DO
Phone appears on MDM live map after location is granted

Common ADB errors

Message	Fix
`adb: no devices/emulators found`	Unlock phone, accept “Allow USB debugging”, try another cable/port; install OEM USB driver on Windows
`adb: command not found`	Install platform-tools and use full path to `adb`
`INSTALL_FAILED_*` / install blocked	Re-run the two `settings put global verifier_…` lines, then `adb install -r` again
`Not allowed to set the device owner because there are already several users on the device`	Factory-reset again; do not add extra users / work profiles before `dpm`
`Trying to set the device owner, but device owner is already set`	Already managed — wipe, or use dashboard uninstall_agent on a previous enroll
`Unknown admin: ComponentInfo{...}`	APK not installed — confirm `adb install -r` printed `Success`
`Performing Streamed Install` then failure	Run `adb install -r -t mdm-agent.apk` once; confirm APK file is not a truncated download

Method 3 — Browser download (only if Play Protect allows)

Use this only if the phone can install unknown APKs (some OEM builds still offer “Install anyway”).
If you already saw a hard block with no skip, skip this method and use Method 2.

Create enrollment and note the pairing code (same as Method 2).
Factory-reset → normal setup → Wi‑Fi.
On the phone browser open:
https://api.ideliver.ng/v1/public/mdm-agent.apk
Install if the system allows.
You still need USB for Device Owner:


adb shell dpm set-device-owner com.ideliver.mdmagent/.IDeliverDeviceAdminReceiver

Open iDeliver MDM → enter pairing code → Enroll phone.

Without a Google account, Method 3 usually cannot turn off Play Protect — Method 2 remains the reliable path.

Delete an unused enrollment

If you created a QR / token you never used (or enrollment failed and stayed pending):

Open Device management.
Find the row with status pending (or revoked / uninstalled).
Click Delete and confirm.

This removes the enrollment from your list and invalidates that token. It does not wipe a physical phone that was never enrolled.

Active enrolled phones cannot be deleted until you run uninstall_agent (or admin revoke). Platform admins may force-delete records for cleanup.

Day-to-day use

MDM live map

Open MDM live map in the sidebar (not the courier Live Map).
Pins refresh about every 15–20 seconds from the MDM agent GPS.
Tap a pin → Open device info for identity, trail, SMS, calls, and command history.

Gray pins mean the last location is older than about five minutes. Phones without agent 1.5.0+ or location permission will not appear until they report GPS.

Find a device

In Device management, use the table: label, rider, status, last seen. Click a row for quick commands, or Open device info for the full page (model, IMEI, date-filtered history).

Bind a rider

Select the device.
Paste the Rider UUID.
Click Bind rider.

The phone stays under your merchant; binding helps ops know who carries it.

Emergency lock

Click Lock on the device row or command list. The agent picks up within about 15–60 seconds while online.

Messages & call log

Select the device → Messages or Call log.
Use Pull SMS / Pull call logs to refresh from the phone.
To send SMS: enter number + body → send (uses the company phone’s SIM).

Push an app (APK)

Select the device → Commands.
Paste an HTTPS URL to a signed APK.
Click Push APK.

Requires Device Owner. Use only apps you are licensed to install on company phones.

Disable, enable, or remove MDM

Action	Effect
disable_agent	Pauses MDM ops; phone user still cannot uninstall the agent
enable_agent	Resumes after disable
uninstall_agent	Clears Device Owner and uninstalls the agent (type `UNINSTALL`)
wipe	Full factory reset — requires pairing code + type `WIPE`. Phone users cannot factory-reset from Settings while Device Owner is active.

Menu	Purpose
Live Map	Flutter courier riders (own phone / freelancers)
MDM live map	Company phones with MDM agent GPS
Device management	Enroll phones, QR / token, lock, APK, agent lifecycle, delete unused
Device info	Opened from map or management — identity + filtered SMS/calls/history
Riders (or fleet riders)	Copy rider UUIDs for bind
Orders / Dispatch	Day-to-day delivery (separate from MDM)

Platform super-admins use Fleet devices (MDM) in the admin portal for all merchants plus platform stock phones. The same QR, browser, and ADB methods apply.

Troubleshooting

Issue	What to try
No “Scan QR” after 6 taps	Wipe again; some OEMs need a different corner of the welcome screen; or use Method 2 / 3
App blocked by Google Play Protect (no Install anyway)	Expected on many wiped phones without Gmail — browser/QR cannot skip. Use Method 2 (ADB install) only
An error occurred + only Reset	Often the same Play Protect block after “belongs to your organization” — wipe, then Method 2
QR scan fails / APK won’t download	Confirm Wi‑Fi; open mdm-agent.apk on another phone; try ADB install
Device stuck pending	Phone never finished enrollment — open the MDM app and tap Enroll with the token, or delete the unused enrollment and create a new one
Lock / SMS not working	Confirm status enrolled and DO; grant SMS/call permissions; wait ~1 minute
Can’t see a phone	It may belong to another merchant, or was never enrolled under your account
Rider uninstalled MDM	Should not be possible after DO enrollment — contact support if it happens
Need to cancel a failed setup	Delete the unused enrollment on the dashboard, then create a fresh one

Why Play Protect blocks install (QR and browser)

Google Play Protect can hard-block company management APKs that:

Are installed from a download URL (not Play Store), and
Need sensitive permissions (SMS / call log) for fleet policy

On a new or factory-reset phone without a Google account:

There is often no “Install anyway”
Play Protect settings require Play Store / account, so you cannot turn scanning off on-device
Browser download and QR setup both hit the same wall

Workaround that works today: Method 2 — adb install → dpm set-device-owner → type the pairing code in the MDM app.
Longer term: Android Enterprise DPC approval so QR works without USB on more devices.

Privacy & policy notes

SMS and call logs are for company phones under your employment / device policy.
Share enrollment QR or tokens only with people setting up your fleet devices.
Wipe and uninstall are destructive — use confirmation prompts carefully.
Temporarily disabling Play Protect is only for company phones under your control during install; re-enable scanning afterward if your policy requires it.

Mobile apps — customer, vendor, driver apps, and MDM agent download
Merchant dashboard — Device management menu
Quick Start — REST API for orders (developers)