Since September 2026, Google enforces an approval list for device management clients during Android provisioning. A client that is not on that list is blocked at the installation stage of QR-code provisioning, and the tablet shows:
After dismissing the message, the setup wizard ends at Something went wrong and the only option is to reset the device.
Google controls this list from its servers, without prior notice, and it does not depend on the tablet model, the network, or the installation package version. We have submitted a request to be listed, but no review deadline is promised. Until then, use the USB method on this page: it does not go through the installation stage of QR provisioning, so the list does not affect it.
This is not a limitation of our product but a new Google rule. Official documentation: Approved Android Enterprise device policy controllers allowlist. That page states that only device policy controllers verified and approved by Android Enterprise may be installed during enterprise enrollment provisioning; non-approved ones are blocked at the installation stage and show the message above.
Pick the one for your computer. The client app is already inside — unzip it into a folder and you are ready.
No Python, Java or other runtime is needed. The archive holds three files: the provisioning tool, the client app classpad-latest.apk, and a one-page readme.
You also need adb (the Android debug tool). Computers with Android Studio already have it. Otherwise download Google's official platform tools, unzip, and put adb (adb.exe on Windows, along with the .dll files next to it) into the folder you just unzipped.
classpad-latest.apk and adb in its own folder; if either is missing, provisioning will not complete.You need an admin console account with the device-operation permission. The tool asks for the username and password once on first run and never again — the password is not stored, only the session token.
With the tablet connected: on Windows, double-click classpad-provision-windows-amd64.exe; on Mac, open a terminal in that folder and run ./classpad-provision-macos-arm64 (on Intel Macs, -macos-intel).
The program does everything by itself: sign in → list the groups for you to pick one (type the number and press Enter) → register the serial number into that group → install the client → set it as a managed device → verify in the console that it really registered.
One result line per tablet. Already-managed tablets are skipped. When it finishes, connect the tablet to Wi-Fi; the program waits for registration to complete (up to two and a half minutes).
Other usages (command line)
./classpad-provision-macos-arm64 -list # List available groups
./classpad-provision-macos-arm64 -group 1316 # Specify the group directly
./classpad-provision-macos-arm64 -sn A1B2C3D4 # With several connected, do just one
# On Windows, replace ./classpad-provision-macos-arm64 with classpad-provision-windows-amd64.exe./classpad-provision-macos-arm64 -grant-usage (on Windows, the matching .exe).In the console's "Devices" list, the tablet must appear, and in addition:
| Symptom | Cause | What to do |
|---|---|---|
| Cannot set as managed device | A Google account was signed in during the wizard | Factory reset and skip the account this time |
| The computer does not see the tablet | USB debugging off, or not authorised | Redo steps 4 and 5 of chapter 3 |
| Installed, but not in the console | The tablet has no Wi-Fi, registration did not finish | Connect it and wait a minute; if it persists, reboot |
| In the console, but shown offline | The tablet has no Wi-Fi | Connect it and wait a minute |
| Icon on the tablet, but the console gets no response | Registration did not complete | Connect to Wi-Fi and reboot; if it persists, send us the serial number |
We have run this procedure end to end on a factory-reset tablet (2026-09-22), including the step where the tablet finds its own class group.
That depends on Google's review, with no promised deadline. We will notify you once it is restored; you will then be able to go back to the QR method, and the USB method on this page will keep working as well (the two do not conflict).
Appeal route (for developers): Play Protect appeals form. The official reference for QR payload fields is QR Code provisioning, where the download location is listed as "required if a DPC isn't already installed on the device" — which is exactly the basis for the USB method.