My company has some Android devices that are available for our customers to use. Customers have nearly full access to the devices, and unfortunately a customer recently installed Android Device Manager, added their Play account, registered the device to themselves, and then disabled the phone.
I was able to recover the devices by factory resetting and logging in with one of our existing play accounts, but I'd like to prevent this from happening in future.
Is there a way to prevent device administrators from being added to an Android device? I know I can create an administrator app and set it as Device Owner to ensure it's always an admin, but I don't think this will prevent this scenario from occurring again.