Play Protect blocks Test DPC during QR provisioning: "App blocked to protect your device"

[LAKSHAYNE]

Summary
During QR-code (6-tap) provisioning of Test DPC as device owner on a factory-reset device, Google Play Protect blocks the app with:

App blocked to protect your device — Test DPC
This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud.

Only an "OK" button is shown, so provisioning cannot continue. This started on 2026-09-19; the same flow worked before that date with no changes on our side.

Steps to reproduce

1. Factory-reset an Android device.
2. On the Welcome screen, tap 6 times to open the QR provisioning scanner.
3. Scan a provisioning QR whose payload uses:
   • PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME: com.afwsamples.testdpc/com.afwsamples.testdpc.DeviceAdminReceiver
   • PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION: an HTTPS URL serving the release APK
   • PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM: the APK signing certificate checksum
4. The device shows "Getting ready for work", then the Play Protect "App blocked" dialog.

APK details

• Package: com.afwsamples.testdpc
• Version: 9.0.12 (versionCode 9012), targetSdk 34
• Signer: CN=testdpc, O=Google Inc.
• Signing certificate SHA-256: 8090f6630b4e8962479123249087cb4658feaae36a1b57dbeafd74d109b333dc

Expected
Provisioning completes and Test DPC becomes device owner.

Notes

• The APK is the Google-signed release build, unmodified.
• Other developers report Play Protect now enforcing an approved-DPC allowlist during provisioning (https://support.google.com/work/android/answer/16694822) and blocking DPCs not on it. Is Test DPC on that allowlist, and is there a recommended way to provision it now?

[indresh149]

Confirming this independently on 2026-09-19, with a different Test DPC build.

Same factory-reset QR flow (6-tap → scan). The provisioning payload has been unchanged for months and the APK it points at was last modified 2026-06-04, so nothing changed on the provisioning side.

APK details

Package	com.afwsamples.testdpc
Version	9.0.13 (versionCode 9013) — not 9.0.12 as in the original report
minSdk / targetSdk	21 / 34
compileSdk	36 (Baklava)
Signer DN	CN=testdpc, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Signer cert SHA-256	8090f6630b4e8962479123249087cb4658feaae36a1b57dbeafd74d109b333dc
Signer cert SHA-1	9476412b9e9d0fbcfb68f82d9a17c5a4859f70c6
Signature schemes	v1 ✔ v2 ✔ v3 ✔ (v3.1 ✘, v4 ✘)
SourceStamp	verified, CN=Android, O=Google Inc., ts 2025-04-25 13:06 UTC
APK file SHA-256	10509701cd60e00d06bb85c11068fe2c716f9a5da3906ebd4787dbebf755c85f

The signing certificate is the same 8090f663…b333dc as in the original report, even though the versionCode differs (9013 vs 9012). So this does not appear to be one bad build — it tracks the Test DPC signing identity itself.

Payload shape (unchanged; checksum re-verified against the cert above today)

{
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME":
      "com.afwsamples.testdpc/com.afwsamples.testdpc.DeviceAdminReceiver",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "<https URL serving the release APK>",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM":
      "gJD2YwtOiWJHkSMkkIfLRlj-quNqG1fb6v100QmzM9w=",
  "android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED": true
}

gJD2YwtOiWJHkSMkkIfLRlj-quNqG1fb6v100QmzM9w= is the base64url of the cert SHA-256 above, re-verified with apksigner verify --print-certs. The URL still serves the byte-identical APK over HTTPS at ~9 MB/s, so this is neither a download failure nor a checksum mismatch.

Symptom

After the Play Protect block is dismissed with OK, the setup wizard does not recover — it falls through to the generic managed-provisioning failure screen:

Something went wrong
If you have any questions, contact your IT admin

with only a Reset button and a ⋮ → "Help and feedback" menu. No error code is surfaced anywhere in the UI, so the visible symptom is the generic screen rather than the Play Protect dialog — which makes this difficult to diagnose without a logcat.

[indresh149]

@brandonweeks @jscott1989 @pfmaggi Please look into this issue asap.

[LAKSHAYNE]

Following up, 4 days after the report. Still reproducible for us on Test DPC 9.0.12, and #283 has an independent confirmation on 9.0.13 with the same signing certificate.

Two updates from our side:

• We filed a Play Protect appeal for com.afwsamples.testdpc on 2026-09-19. No reply, as expected.
• On the Android Enterprise community thread (https://www.androidenterprise.community/android-enterprise-general-discussions-3/play-protect-blocks-google-s-test-dpc-9-0-12-during-qr-provisioning-app-blocked-to-protect-your-device-3061), Jason Bayton suggested this may be intentional because Test DPC is a reference app, and that only Google can confirm.

Could a maintainer confirm whether Test DPC is intentionally excluded from the approved-DPC allowlist? If so, what is the supported way to provision it for testing now (e.g. adb set-device-owner), so this can be documented in the README?