com.android.managedprovisioning Copy

The AOSP Managed Provisioning framework: the system component that sets up work profiles and fully managed (device owner) deployments. It runs when a device is enrolled via a QR code, NFC, zero-touch / Knox Mobile Enrolment, an "afw#" account, or a DPC download. Its job ends by installing the chosen Device Policy Controller (DPC) and making it device owner or profile owner; the DPC then enforces policy from that point on. From Android 13 (API 33) the framework can delegate the provisioning flow to a Device Policy Management Role Holder - a separate, system-granted role (android.app.role.DEVICE_POLICY_MANAGEMENT) trusted to run setup and then hand the device to the DPC. AOSP's documentation states that managed provisioning "performs the following activities or delegates them to a device policy management role holder during provisioning". On Google Mobile Services devices that role holder is Android Device Policy (clouddpc, below). Where no role holder is present, managed provisioning performs the steps itself, so this package remains the baseline path. Android 16's "Efficient device setup" streamlines this flow with fewer steps; it builds on the existing role-holder delegation (which dates to Android 13/14) rather than introducing it. It is core to Android Enterprise. Disabling or removing it prevents a device from being enrolled into management at all.

• Implement device management - Android Open Source Project →
• Provision a device - Android Management API →
• DevicePolicyManager (getDevicePolicyManagementRoleHolderPackage, added in API 33) - Android Developers →
• What's new in Android Enterprise: Feature Drop (Efficient device setup, Android 16+) →

• Re-signed by each device maker with its own platform key - 33 different certificates appear across 19 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Its largest observed manifest declares 45 permissions: 1 runtime (user-granted), 30 signature or system-level, 10 install-time and 4 vendor or uncatalogued. The signature/system share marks it as a privileged component, not an ordinary app.
• APK size ranges from 1.3 MB to 8.8 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.