> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm/deploy-cortex-xdr-agent-app-for-android-with-zero-touch-installation.md).
# Deploy Cortex XDR Agent App for Android with zero-touch installation
This section outlines the configuration required to facilitate the zero-touch installation of the Cortex XDR agent app on Android devices using the Always-On VPN trigger. Since only one VPN can be active at a time, this configuration must be disabled once the app has successfully registered.
This solution is applicable only for managed devices configurations under MDM solutions; company owned and fully managed or own devices with a work profile.
The zero-touch deployment is for installation only, permissions for notifications must be set per device.
## How to deploy Cortex XDR agent using Workspace One (WS1) zero-touch
1. Create a profile for Android with Custom Settings XML that sets the `EnableAlwaysOnVPN` parameter.
* Set the Permissions policy to Grant all permissions for the Cortex XDR app.
* Assign the profile to the correct Smart groups or devices so that it will be automatically assigned.
2. Set the profile to Auto deployment to install the Cortex XDR app.
The process should start automatically and a VPN connection icon will appear on the device(s).
3. Once the Cortex XDR app is running, disable the VPN by removing the AlwaysOn VPN setting.
* Create a second profile with the same settings as above, but with `EnableAlwaysOnVPN` parameter set to *False*.
* Assign the profile to the same Smart groups or devices so that it will be automatically assigned.
* Set the profile to Auto deployment and the VPN connection icon will disappear on the device(s).
Alternatively, set another VPN app as the always-on VPN, if required.
{% hint style="info" %}
**Note:**
The order of Installation of profiles is important; the last installed profile settings will override the configuration.
{% endhint %}
4. Manually enable malicious application notifications for each device.
See [Configure and View Settings for the Cortex XDR Agent App for Android](/cortex-xdr-agent-android-guide/9.2/configure-and-view-settings-for-the-agent-app-for-android.md) for the required device settings and notifications.
## Creating an automated workflow for zero-touch in WS1
You can create a workflow to handle the Cortex XDR agent installation on device enrollment and trigger the zero-touch installation automatically.
1. In the WS1 console navigate to the Orchestration tab and create a new Freestyle Orchestrator Workflow.
2. Build a New workflow that first installs the Zero-Touch profile, using [Step 1](/cortex-xdr-agent-android-guide/9.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm/deploy-cortex-xdr-agent-app-for-android-with-zero-touch-installation.md) of the procedure above, then check if the App is installed (verifying the specific app version to ensure it supports zero-touch capability) and installs the latest version (if not installed), and finally, installs the Post-Zero-Touch profile [Step 3](/cortex-xdr-agent-android-guide/9.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm/deploy-cortex-xdr-agent-app-for-android-with-zero-touch-installation.md) to disable the VPN functionality.
| [](https://docs-cortex.paloaltonetworks.com/viewer/attachment/uNVtU0OcCUakzj9bgt8Jag/jgb5Cfk96Nb_zTXUT3nphQ-uNVtU0OcCUakzj9bgt8Jag) |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
## How to deploy Cortex XDR agent using Microsoft Intune zero-touch
Intune requires a manual transition between groups to move devices from the activation state to the operational state.
1. In the Intune admin center, navigate to Groups and select New group.
Create two Assigned security groups:
* 0-Touch Enabler: This group includes the devices/users that start the zero-touch registration.
* 0-Touch Disabler: This group includes the devices/users that finish the zero-touch registration.
2. In Devices+Configuration create a New Policy profile for Android Enterprise platform. Select Templates as the profile type and search for the Device restrictions template.
Select the template and click Create
{% hint style="info" %}
**Note:**
There are two options for Device Restrictions in the templates list. Select the one that is relevant for the Device setup (Fully managed/Personally owned).
{% endhint %}
3. Give the profile a name such as `0-touch profile` and click Next.
4. In the Configuration settings tab, expand Connectivity and enable Always-on VPN with Custom VPN client.
Type in the app's package name as Package ID (com.paloaltonetworks.trapsa). Click Next to continue.\
[](https://docs-cortex.paloaltonetworks.com/viewer/attachment/uNVtU0OcCUakzj9bgt8Jag/A~VxfHnA5k3HaL3phT1RLw-uNVtU0OcCUakzj9bgt8Jag)
5. Add an inclusion group in the Assignments tab.
Click Add groups under the Included groups section and add the "0-touch Enabler" group that was defined in step 1.
6. Continue to the final step to review and create the 0-touch profile.
7. Create a second profile with a name such as `Post 0-touch profile`.
Use the same parameters, except for this profile set the Always-on VPN setting to Not configured, or configure it for any other VPN service, if required.
8. Add an inclusion group in the Assignments tab.
Click Add groups under the Included groups section and add the "0-touch Disabler" group.
9. Add an exclusion group.
Click Add groups under the Excluded groups section and add the "0-touch Enabler" group.
10. Continue to the final step to review and create the Post 0-touch profile.
## Intune Zero-Touch activation
Intune does not offer any automatic flow orchestration, so the 0-touch activation and deactivation must be done manually by an administrator.
{% hint style="warning" %}
* The App settings should include Auto-Grant settings for notification permissions.
* Custom MDM settings with distributionId and auto-registration parameters must be set.
* The Cortex XDR agent app in Intune must be assigned to both the 0‑Touch Enabler and the 0‑Touch Disabler groups.
{% endhint %}
1. Setup users/devices to initiate 0-touch registration
[Step 1 to step 5 above](/cortex-xdr-agent-android-guide/9.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm/deploy-cortex-xdr-agent-app-for-android-with-zero-touch-installation.md)
2. When the assigned users/devices are assigned to the 0-Touch Enabler group and are found compliant the Cortex XDR agent app is installed and the 0-touch profile was synced.
This is validated via the tenant - the assigned agents become Connected, confirming that the app was activated, registration completed, and a heartbeat performed.
3. At this stage, admin must move the users/devices to the 0-Touch Disabler group, to disable the always-on VPN setting.
When moving the users to the disabler group, first assign the group and only then remove the users/devices from enabler group [Step 7 to step 10 above](/cortex-xdr-agent-android-guide/9.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm/deploy-cortex-xdr-agent-app-for-android-with-zero-touch-installation.md).
{% hint style="info" %}
**Note:**
Manually enable malicious application notifications for each device.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm/deploy-cortex-xdr-agent-app-for-android-with-zero-touch-installation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.