Skip to main content

Glossary

Factory Reset Protection

Factory Reset Protection (FRP) is an Android anti-theft feature that keeps a device locked after a factory reset until someone signs in with an account that was on it before the wipe. On a managed device, the MDM can define which accounts are allowed, so a stolen or reset company phone stays unusable outside the fleet.

How it works

Google introduced FRP with Android 5.1 in 2015, after phone theft became a political issue in several US cities. The mechanism is simple: when a Google account is added to a device, its identifier is written to a small protected partition that survives a factory reset. After the reset, the setup wizard reads that partition and refuses to continue until a matching account signs in.

A legitimate owner who resets their own phone doesn't notice anything. A thief who wipes it through recovery mode hits the Google account screen and stops there. Since Android 7 the lock also triggers if the device is reset through a cable or fastboot, closing the easy bypasses.

On an Android Enterprise device, the MDM takes over this setting. The admin can turn FRP off entirely, which is common on shared kiosks that get re-provisioned often, or, more usefully, register one or several corporate Google account IDs as the only accounts allowed to unlock the device after a reset. Those accounts don't need to be signed in on the device: FRP checks the list, not the active session.

Samsung adds its own layer on Galaxy devices, and Knox Guard can lock a device remotely on top of FRP for financed or leased hardware.

Why it matters for a fleet

Without FRP configured, a fully managed device that gets reset becomes a clean consumer phone. Whoever holds it can set it up with any account, and your only trace is a device that stopped checking in. With FRP tied to a corporate account, that same phone is a brick to anyone but your IT team.

The risk runs the other way too. If a personal Google account was the last one on a device and the employee has left, nobody can unlock it after a reset. Fleet managers learn this the day 20 devices come back from a subsidiary and half of them ask for a password nobody knows. Setting the allowed accounts before deployment, and documenting them, avoids that.

How Appaloosa handles it

Appaloosa manages Factory Reset Protection on fully managed and dedicated Android devices: you enable or disable it per policy and register the corporate Google accounts allowed to unlock a device after a reset. Combined with remote wipe and a blocked factory reset in the settings menu, it closes the loop on lost or stolen hardware. The rest of the security toolkit is on the Android MDM page.

Explore

See the full platform

Enrollment, apps, security, remote support: all in one place.

Explore Appaloosa →

See Appaloosa run on your fleet Book a demo

Frequently asked questions

Does FRP work if the device has no Google account, only an MDM enrollment?
Yes, when the MDM sets the allowed accounts. Android Enterprise devices are often enrolled without a visible Google account, so FRP would otherwise be inactive. The MDM writes one or more corporate account IDs to the protected partition, and those are the only ones accepted after a reset.
How do I unlock a company device stuck on the FRP screen?
Sign in with one of the accounts the MDM registered as allowed, typically a shared IT Google account whose credentials are kept in your password manager. If the device was never managed and the previous user is gone, only the original account holder or a proof of purchase to the manufacturer can help.
Should I disable FRP on kiosk devices?
Only if they're re-provisioned often and never leave the building. For anything mobile, keep FRP on with a corporate account allowed. The re-provisioning cost is one sign-in, while a disabled FRP means any reset produces a resellable device.