# Fully Managed (COSU and COBO, or previously Device Owner) Provisioning using Android Debug Bridge (ADB)

Last updated: August 13, 2026

This page explains how to provision Android devices as Fully Managed (COSU and COBO, or previously Device Owner) using Android Debug Bridge (ADB) — the recommended fallback when NFC-based enrollment is unavailable. Applicable to devices running Android 5.0 or later, including those without Google Services, it walks administrators through enabling USB or wireless debugging, installing the ADB Provisioning Tool, and running the makedeviceowner script to complete enrollment. Troubleshooting tips for common issues such as MIUI optimization conflicts and unauthorized device errors are also covered.

This method is recommended for [Fully Managed (COSU and COBO, or previously Device Owner)](https://www.manageengine.com/mobile-device-management/help/android_for_work/mdm_android_for_work_introduction.html#Device_Owner) provisioning only when the Android device cannot be provisioned using [Near-Field Communication (NFC)](https://www.manageengine.com/mobile-device-management/help/enrollment/enroll_android_devices_using_admin_enrollment_tool.html). This Android provisioning method can also be used for enrolling devices without Google Services as a Fully Managed (COSU and COBO, or previously Device Owner) corporate device. As the name suggests this method uses Android Debug Bridge (or ADB) to provision devices as Fully Managed (COSU and COBO, or previously Device Owner) and is applicable for devices **running 5.0 or later versions**.

**Note:** For a device to be successfully enrolled using ADB enrollment, the device shouldn't have a passcode configured manually. Post enrollment, even if the device had a passcode configured earlier and is now removed or if the device currently has a passcode configured, the inventory actions clear/reset passcode will fail. In this case, wipe the device and enroll the device again.

## Steps for provisioning USB Debugging

These are the steps you should provision in the mobile device to configure ADB enrollment:

1. Ensure you do not have any **Google account logged in** or **syncing any data**. If any google account is logged in then remove the account by following the given steps.
   - On the device, open **Settings->Accounts or Passwords & accounts->Tap the account->Remove account**.
   - You may need to enter the PIN, pattern, or password to confirm the account removal.
2. Go to **Settings** > **About Device**, and tap on the Build Number for **7 times** to enable **Developer mode**.
3. Now, navigate back to Settings and select **Developer Options**. Then enable **USB debugging**.

   ![ADB 1](https://www.manageengine.com/mobile-device-management/help/images/ADB-1.png)

4. Click **Allow** to confirm the USB Debugging pop-up appearing on the device.

   ![ADB 2](https://www.manageengine.com/mobile-device-management/help/images/ADB-2.gif)

5. Again navigate back to **Settings** and select **Security**. Enable Install from unknown sources (only applicable for devices with OS version lesser than or equal to 7.1.1).
6. Now **connect** your device to the Mac machine or Windows machine which is used to configure ADB Enrollment.
7. Enable the option **Transferring files** on the mobile device to which the USB is connected. Then, follow the "ADB (Android Debug Bridge) Provisioning Tool installation steps" to complete the enrollment.

## ADB (Android Debug Bridge) Provisioning Tool Installation Steps

1. Download the [ADB Platform Tools](https://developer.android.com/tools/releases/platform-tools#downloads), [Device Provisioning files](https://workdrive.zohoexternal.in/external/9dae2fec423e85ca661e7bf9fb5cc7e60bc3b3ff48a6350d9e02149d688d9a5d/download?directDownload=true), and the [Android Agent APK](https://mdmdatabase.manageengine.com/latest/MDMAndroidAgent.apk) on the same machine.

   **Note:** The ADB Platform Tools and Android Agent APK should be should be downloaded once every **2 months** to get the updated app. The updated app can be pushed to new devices or be used for future enrollments.

2. After downloading, extract all the files in the zip file to a location on your machine.
3. Now select the **MDMAndroidAgent.apk** and the device provisioning files (**makedeviceowner.bat** and **makedeviceowner.sh**) and move them into the **platform-tools** directory.

   ![Locating the ADB executable inside the platform-tools directory](https://www.manageengine.com/mobile-device-management/help/images/android-adb-platform-tools.png)

4. Now open the Command prompt (for a windows device) or terminal (for a Mac device) within the platform-tools folder and execute the command `makedeviceowner.bat` for windows or `makedeviceowner.sh` for Mac OS.
5. The Self Service app (previously ManageEngine MDM app) will be installed, and the Fully Managed (COSU and COBO, or previously Device Owner) profile will be configured after the successful execution of the command. If the execution is successful, you can see a success message in the command prompt as shown below:
   - **For Windows:**

     ![ADB 3](https://www.manageengine.com/mobile-device-management/help/images/ADB-3.png)

   - **For Mac:**

     ![ADB 4](https://www.manageengine.com/mobile-device-management/help/images/ADB-4.png)

6. Ensure the **Google Play** app running on the device is the latest version. You can also [update the Google Play app to the latest version](https://support.google.com/googleplay/answer/113412#update_google_play_store).
7. Now open the **Self Service app (previously ME MDM app)** in the mobile device and **Scan QR**, by navigating to **Enrollment -> Android -> QR Code Enrollment** in the MDM web console. Once the QR code is scanned, the device will be listed under the EMM token enrollment view. To enroll a device without a camera, refer to our guide on [enrolling Android devices with or without a camera](https://www.manageengine.com/mobile-device-management/how-to/enroll-android-devices-without-camera-and-google-play-services-support.html) and to [enroll Android devices without Google Play Services support](https://www.manageengine.com/mobile-device-management/how-to/enroll-android-devices-without-google-play-services-support.html).
8. You can then assign users to the enrolled devices either individually or in bulk using a CSV file, to complete enrollment.

## Steps for provisioning wireless Debugging on devices without USB Access

If USB debugging is not an option, follow these steps to enable debugging via the Wireless Debugging method:

1. Ensure that both the device and PC are connected to the same Wi-Fi network.
2. Ensure that no Google account is logged in or syncing data on the device. If any google account is logged in then remove the account by following the given steps.
   - On the device, open **Settings->Accounts or Passwords & accounts->Tap the account->Remove account**.
   - You may need to enter the PIN, pattern, or password to confirm the account removal.
3. Navigate to Settings → Developer Options → Enable Wireless Debugging. When prompted with "Allow wireless debugging on this network?", select Allow.
4. Under the **Wireless Debugging** section, you can see the **IP address and port number**. Note this down, as it will be required in the upcoming steps.

   ![ADB port](https://www.manageengine.com/mobile-device-management/help/images/adbport.jpg)

5. Open Command Prompt at the location where ADB is installed.
6. In Command Prompt, enter the following command to connect ADB via the device’s IP address:

   `adb connect <ip_address>:<port>`

7. On the device, go to Pair Device with Pairing Code under the Wireless Debugging option. In Command Prompt, enter the pairing command:

   `adb pair <ip_address>:<port>`

   Enter the pairing code displayed on the device when prompted.

8. Complete the enrollment by following [ADB (Android Debug Bridge) Provisioning Tool Installation Steps](https://www.manageengine.com/mobile-device-management/help/android_for_work/mdm_device_owner_provisioning_adb.html#machine).

By following these steps, you should be able to successfully complete the ADB enrolment process.

## Troubleshooting tips

- **While trying to enroll a Xiaomi device, the command `makedeviceowner.bat` does not get executed and displays an error.**

  Some Xiaomi devices cannot be enrolled using the ADB enrollment method when MIUI optimization is enabled. To enroll these devices, navigate to Developer options and **disable MIUI optimization**. Then, repeat the above steps to successfully enroll the devices.

- **While performing ADB enrolment, you may encounter the message "adb: device unauthorized," indicating that the USB debugging permission was not granted.**

  ![adb: device unauthorized error message in command prompt](https://www.manageengine.com/mobile-device-management/help/images/adbvendor.png)

  ### Steps to Resolve

  **Allow USB Debugging:** When the prompt "Allow USB debugging?" appears on the device, ensure to tap **Allow**.

  ![Allow USB debugging prompt on the device](https://www.manageengine.com/mobile-device-management/help/images/usbdebugging.png)

  **Re-Trigger the USB Debugging Prompt:** If the prompt was missed or the device still shows unauthorized, unplug the device and then plug it back in to trigger the prompt again.

- **If the USB debugging authorization popup still doesn't appear and the device continues to show as unauthorized, even after turning USB debugging off and on multiple times, restart the ADB server on your machine.**

  ### Steps to Resolve

  Run the following commands on the machine to restart ADB and reconnect the device:

  `adb kill-server`

  `adb start-server`

  `adb devices`

  Running `adb devices` should trigger the USB debugging authorization prompt on the device again. Tap **Allow** when it appears.

## Frequently Asked Questions

1. **Does the device need a passcode before starting ADB provisioning?**

   No. The device must not have a manually configured passcode when ADB provisioning begins. If a passcode is set before enrollment, subsequent passcode clear/reset inventory actions performed from the MDM console will fail.

2. **Why does `makedeviceowner.bat` fail to execute on some Xiaomi devices?**

   This typically happens because MIUI optimization is enabled. Navigate to Developer options on the device, disable MIUI optimization, and repeat the provisioning steps.

3. **How often should the ADB (Android Debug Bridge) Provisioning Tool be downloaded again?**

   The tool should be downloaded again every two months to ensure you are using the latest updates before provisioning new devices.

4. **What should I do if the device keeps showing as unauthorized during ADB provisioning?**

   Unplug and reconnect the device to re-trigger the USB debugging authorization prompt, then tap **Allow**. If the issue persists, restart the ADB server on your machine using `adb kill-server`, `adb start-server`, and `adb devices`, then tap **Allow** when the prompt reappears.

5. **Is wireless debugging a valid alternative to USB-based ADB provisioning?**

   Yes. If the device does not have USB access, it can be provisioned using wireless debugging, provided the device and the machine running the provisioning tool are connected to the same Wi-Fi network.