Setting Up RCS/SMS Archiving (Android)

RCS - Rich Communication Services - is the SMS successor on Android, used by carriers like T-Mobile and through Google Messages. RCS adds read receipts, typing indicators, group chats, and rich attachments. Most compliance archive vendors do not support RCS. Comma does - alongside ordinary SMS and MMS, in the same capture.

How RCS/SMS capture works

Comma captures messages with the Comma Compliance Messages Archiver app (com.commacompliance.archiver) running on a fully-managed (device-owner) Android device:

• The phone’s default messaging app (Google Messages) stores each SMS, MMS, and RCS message - 1:1 and group - to the standard Android message store.
• The archiver reads those messages, then encrypts them on-device and ships them to your Comma backend. It reads what the messaging app has already received; it does not intercept anything in transit.
• Coverage includes RCS group chats, attachments, edits, and reactions, ordinary SMS (including long multipart messages), and MMS media.
• While archiving is active, the phone shows a persistent “archiving for compliance” notification naming your organization. Capture is never hidden from the user.

Scope

This channel captures RCS, SMS, and MMS - the messages that flow through the phone’s default messaging app. WhatsApp, Signal, Telegram, and iMessage are separate channels with their own Comma connectors.

Get the app

The archiver is the Comma Compliance Messages Archiver on Google Play. There are two ways to put it on a device:

• Through managed Google Play (recommended for fleets). Comma makes the archiver available to your enterprise’s managed Google Play - you approve the listing in your Admin console, or Comma targets the app privately to your organization. Your MDM then force-installs it on your fully-managed devices with no user action. This is the path the worked example below uses.
• From the public Play Store listing. For one-off or self-serve devices, install the public app directly:

Either way, installing the app is only the first step. Capture also requires that an admin has enabled Android RCS+SMS capture for your team, that the device is fully-managed, and that Google Messages is wired to the archiver with the messages_archival managed-config key (below) - so even a self-serve install relies on your MDM to deliver that key. Getting the app onto the phone is separate from enrolling it (telling the app which organization to archive for); enrollment is the next section.

Prerequisites

In the Comma web app (an administrator does this once, before any device connects):

1. Sign in to the Comma Compliance web app.
2. Go to Account → your team → Android RCS+SMS capture.
3. Turn on “Enable Android RCS+SMS capture for this organization.” A user cannot self-enable this; until it is on, no device can enroll, sign-in is refused, and no message upload is accepted.
4. Set the “Default backfill window (days)” - e.g. 90 (0 = forward-only). Saving this updates your team’s already-connected Android devices; it is not a default that devices connecting later inherit. For reliable per-device history, set the backfill_days managed-config key (below).

On each device:

• A fully-managed (device-owner) Android Enterprise device. Work profile, BYOD, and COPE are not supported.
• Google Messages set as the default SMS/RCS app, with RCS provisioned and a current Google Messages build (an out-of-date build captures nothing).
• The archiver app installed (pushed by your MDM, or installed by the user for the self-serve path).
• Protect both apps from removal. Add com.commacompliance.archiver and com.google.android.apps.messaging to your MDM’s uninstall / user-control restrictions so a user can’t force-stop, disable, or clear them and break capture.

How a device enrolls: three options

Enrollment is how a device proves which team’s archive it belongs to. Pick the option that fits how you provision phones - all three produce the same result: a device that archives to your team’s Android archive.

1. Shared fleet token - one token, many phones (recommended for fleets)

Best for a managed fleet you provision together (company-owned phones via MDM). This is the lowest-touch option: one token enrolls the whole group, with no per-device tokens and no user sign-in.

• A team admin generates one reusable enrollment token in the Comma app (Account → your team → Android RCS+SMS capture). The token is shown once and is not stored in cleartext - copy it when it’s displayed.
• Push the same token to every phone as managed configuration (enrollment_token, below). Each phone enrolls itself on first run and claims a seat - no user interaction.
• Optionally set a seat cap (maximum devices) and a token expiry of 1-90 days (default 7). Both are optional; a fleet token has no fixed device limit.
• The admin sees every connected device in a roster and can revoke any single device, or rotate / revoke the token to stop new enrollments.

For a large organization, you can issue several fleet tokens - one per office, region, or device group - so each group is segmented and can be rotated independently.

The simplest setup

For most teams: generate one fleet token, push it (plus backend_url) OU-wide via managed configuration, and let every phone enroll itself. Where your MDM supports it, also pre-grant the message-access (SMS) permission to the archiver on fully-managed devices so the user isn’t prompted - verify it in your environment, since otherwise the app still asks for message access once on first launch.

2. Single-use device token - one token, one phone

Best for enrolling an individual device.

• Comma issues a one-time token for a single phone.
• On first enrollment it binds to that device and cannot be reused on a different phone.
• The device is managed and revoked individually from the roster.

3. OAuth self-service - the user signs in

Best when a user enrolls their own device.

• The user signs in through OAuth (authorization code + PKCE) and grants the Android archiver permission (scope android_archiver).
• The device is registered under the user’s team membership - chosen by the user, or automatically when they belong to a single team.
• A user can connect multiple devices, each managed from their own account.

This needs no token, but it asks each user to sign in per device, so it’s the heaviest path for a large rollout. For fleets, prefer the shared fleet token above.

Configuration requirements (any MDM)

These are the values your MDM delivers as managed configuration. They apply to any MDM that can push an Android managed-config bundle - Google Workspace Endpoint Management, Microsoft Intune, VMware Workspace ONE, or the Android Management API. The keys are the same everywhere; only the console differs.

On the archiver app (com.commacompliance.archiver):

Key	Type	Required	Value
backend_url	string	Yes (all paths)	Your Comma backend, e.g. https://app.commacompliance.com (must be https)
enrollment_token	string	Token paths only	A shared fleet token (reusable across the OU’s phones) or a single-use device token (one phone). Generated/issued by Comma; optional expiry 1-90 days (default 7). Omit for OAuth self-service.
backfill_days	integer	Optional	Days of existing messages to capture on first run; 0 = forward-only. If omitted, the value returned at enrollment applies.

On Google Messages (com.google.android.apps.messaging):

Key	Type	Required	Value
messages_archival	string	Required (all paths)	com.commacompliance.archiver - tells Google Messages which app to wake on each message event

Auto-discovered - you don’t set these

The OAuth client id (comma-android-messages-archiver), the sign-in and token endpoints, and the device-integrity mode are discovered by the app from your backend at GET /api/v1/android_archiver/config. You never configure them by hand.

The messages_archival key is undocumented

messages_archival is not published in Google Messages’ configuration schema, so a schema-driven managed-config editor - including the Google Admin console’s - may not let you add it. This key is required on every enrollment path (OAuth self-service only removes the enrollment_token, not the Google Messages wiring). To deliver it, use an EMM that supports raw key/value managed configuration (Microsoft Intune, VMware Workspace ONE) or the Android Management API. If your console can’t set it, contact Comma - capture depends on this key.

How enrollment is secured

Every enrollment path - fleet token, single-use token, or OAuth - is protected the same way:

• Signed two-step handshake. The device generates an Ed25519 key pair, the server issues a one-time random challenge, and the device proves possession of its private key by signing the challenge. The private key never leaves the device.
• Device attestation (Google Play Integrity). The server can verify the device and app are genuine before allowing archiving (configurable).
• One-time and time-boxed. Each challenge expires in about five minutes and can be completed only once - no replay.
• Revocable. An admin can revoke a device immediately and it stops archiving at once; rotating or revoking a token prevents any further enrollments with that token.

After enrollment, each device holds its own archiving credential for its team’s Android archive, and uploads are accepted only for enrolled device IDs under that team.

Worked example: Google Workspace Endpoint Management

Using Google’s own MDM (managed Google Play + managed configuration in the Google Admin console):

1. Approve the app in managed Google Play (Apps → Web and mobile apps → Add app). Comma makes the archiver available to your enterprise’s managed Google Play; you approve it. Public Play Store listing: Comma Compliance Messages Archiver. If it doesn’t appear in your console, contact Comma to have it targeted to your organization.
2. Auto-install it to the org unit holding your fully-managed devices (set User access ON + Auto-install), and protect it (and Google Messages) from uninstall.
3. Apply managed configuration to the archiver app: backend_url, plus your shared fleet token as enrollment_token (and optional backfill_days) so every phone in the OU enrolls itself. Add messages_archival = com.commacompliance.archiver to the Google Messages app.
4. Verify on the device (below).

To go fully unattended, also grant the archiver the message-access (SMS) permission through your MDM’s app permission policy where supported, so the user isn’t prompted on first launch (verify in your environment - otherwise the app asks for message access once).

📄 Step-by-step guides (PDF):

• Set Up RCS/SMS Archiving on Android with Google MDM - the complete admin guide: values, configuration, on-device verification, and troubleshooting.
• Google Workspace MDM - Admin Console Walkthrough - the exact admin.google.com screens, clicks, and fields, end to end.

Self-serve connection (OAuth)

If you’d rather have employees connect their own corporate phones, use OAuth self-service - skip the enrollment_token and have each employee do the following. (Self-serve still requires the messages_archival key on Google Messages - it only removes the enrollment token.)

1. Install and open the Comma Compliance Messages Archiver app. On first launch it shows a plain-language summary of what’s captured and, unless message access is already granted by device policy, asks for the message-access (SMS) permission - grant it.
2. Tap “Connect to your organization” and enter the organization URL: https://app.commacompliance.com.
3. Sign in with the usual work account when the secure browser tab opens (OAuth - no password is typed into the app).
4. Tap Authorize.

The device binds to that employee’s own membership and begins archiving. Self-serve works only once an administrator has enabled Android RCS+SMS capture for the team.

Verifying capture

• The device shows a persistent “archiving for compliance” notification, and the app reports it is Connected to your organization.
• The device appears under Account → your team → Messages Archiver devices in the Comma web app, with an Active status and recent “Last seen” / “Last upload” times.
• Send a test SMS and a test RCS message; they appear in your archive under Messages → RCS within a short time.

Backfill

On first run a device can capture messages already on the phone, controlled by the backfill_days window. For managed devices, set backfill_days in the managed config - this is the explicit, reliable per-device control. The team’s Default backfill window updates already-connected devices but is not inherited by devices that connect later. 0 is forward-only; a larger number approximates full history. Backfill controls only what is emitted on first run - later reconciliation never re-emits pre-existing messages as new.

Multi-device per user

A user can enroll more than one device. All enrolled devices feed your team’s Android archive, and each is tracked and revocable by device ID.

What’s next

• iMessage Setup - The Apple side of mobile messaging
• SMS and Text via eSIM permanent numbers - Permanent-identity numbers when phones change
• WhatsApp Setup - The other dominant Android messaging channel