diff --git a/play-services-core/build.gradle b/play-services-core/build.gradle
index 8ee555cb..bc3d697a 100644
--- a/play-services-core/build.gradle
+++ b/play-services-core/build.gradle
@@ -61,6 +61,7 @@ dependencies {
     implementation "androidx.navigation:navigation-fragment-ktx:$navigationVersion"
     implementation "androidx.navigation:navigation-ui-ktx:$navigationVersion"
 
+    implementation "androidx.lifecycle:lifecycle-service:$lifecycleVersion"
     implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlinVersion"
 }
 
@@ -75,8 +76,6 @@ android {
         minSdkVersion androidMinSdk
         targetSdkVersion androidTargetSdk
 
-//        buildConfigField "boolean", "USE_MAPBOX", "${useMapbox()}"
-
         multiDexEnabled true
 
         ndk {
diff --git a/play-services-core/src/main/AndroidManifest.xml b/play-services-core/src/main/AndroidManifest.xml
index 6b58afd7..74fbd245 100644
--- a/play-services-core/src/main/AndroidManifest.xml
+++ b/play-services-core/src/main/AndroidManifest.xml
@@ -64,6 +64,11 @@
         android:name="org.microg.gms.EXTENDED_ACCESS"
         android:label="@string/perm_extended_access_label"
         android:protectionLevel="dangerous" />
+    <permission
+        android:name="org.microg.gms.PROVISION"
+        android:description="@string/perm_provision_description"
+        android:label="@string/perm_provision_label"
+        android:protectionLevel="privileged|signature" />
 
     <uses-permission android:name="android.permission.FAKE_PACKAGE_SIGNATURE" />
 
@@ -112,6 +117,13 @@
             android:name="fake-signature"
             android:value="@string/fake_signature" />
 
+        <!-- Provision -->
+
+        <service
+            android:name="org.microg.gms.provision.ProvisionService"
+            android:exported="true"
+            android:permission="org.microg.gms.PROVISION" />
+
         <!-- Location -->
 
         <activity android:name="org.microg.nlp.ui.BackendSettingsActivity" />
diff --git a/play-services-core/src/main/java/org/microg/gms/checkin/CheckinPrefs.java b/play-services-core/src/main/java/org/microg/gms/checkin/CheckinPrefs.java
index d18914b6..f090c97e 100644
--- a/play-services-core/src/main/java/org/microg/gms/checkin/CheckinPrefs.java
+++ b/play-services-core/src/main/java/org/microg/gms/checkin/CheckinPrefs.java
@@ -6,6 +6,7 @@
 package org.microg.gms.checkin;
 
 import android.content.Context;
+import android.content.Intent;
 import android.content.SharedPreferences;
 import android.preference.PreferenceManager;
 
@@ -44,4 +45,11 @@ public class CheckinPrefs implements SharedPreferences.OnSharedPreferenceChangeL
     public boolean isEnabled() {
         return checkinEnabled;
     }
+
+    public static void setEnabled(Context context, boolean newStatus) {
+        PreferenceManager.getDefaultSharedPreferences(context).edit().putBoolean(PREF_ENABLE_CHECKIN, newStatus).commit();
+        if (newStatus) {
+            context.sendOrderedBroadcast(new Intent(context, TriggerReceiver.class), null);
+        }
+    }
 }
diff --git a/play-services-core/src/main/java/org/microg/gms/gcm/GcmPrefs.java b/play-services-core/src/main/java/org/microg/gms/gcm/GcmPrefs.java
index 30a95703..e4051f47 100644
--- a/play-services-core/src/main/java/org/microg/gms/gcm/GcmPrefs.java
+++ b/play-services-core/src/main/java/org/microg/gms/gcm/GcmPrefs.java
@@ -17,6 +17,7 @@
 package org.microg.gms.gcm;
 
 import android.content.Context;
+import android.content.Intent;
 import android.content.SharedPreferences;
 import android.net.ConnectivityManager;
 import android.net.NetworkInfo;
@@ -197,6 +198,15 @@ public class GcmPrefs implements SharedPreferences.OnSharedPreferenceChangeListe
         return isEnabled() && info != null && getHeartbeatMsFor(info) >= 0;
     }
 
+    public static void setEnabled(Context context, boolean newStatus) {
+        PreferenceManager.getDefaultSharedPreferences(context).edit().putBoolean(GcmPrefs.PREF_ENABLE_GCM, newStatus).commit();
+        if (!newStatus) {
+            McsService.stop(context);
+        } else {
+            context.sendBroadcast(new Intent(TriggerReceiver.FORCE_TRY_RECONNECT, null, context, TriggerReceiver.class));
+        }
+    }
+
     public boolean isGcmLogEnabled() {
         return gcmLogEnabled;
     }
diff --git a/play-services-core/src/main/kotlin/org/microg/gms/provision/ProvisionService.kt b/play-services-core/src/main/kotlin/org/microg/gms/provision/ProvisionService.kt
new file mode 100644
index 00000000..9cfd43c1
--- /dev/null
+++ b/play-services-core/src/main/kotlin/org/microg/gms/provision/ProvisionService.kt
@@ -0,0 +1,46 @@
+/*
+ * SPDX-FileCopyrightText: 2020, microG Project Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package org.microg.gms.provision
+
+import android.app.Service
+import android.content.Intent
+import android.os.Bundle
+import android.util.Log
+import androidx.lifecycle.LifecycleService
+import androidx.lifecycle.lifecycleScope
+import kotlinx.coroutines.delay
+import org.microg.gms.checkin.CheckinPrefs
+import org.microg.gms.gcm.GcmPrefs
+import org.microg.gms.snet.SafetyNetPrefs
+
+class ProvisionService : LifecycleService() {
+    private fun Bundle.getBooleanOrNull(key: String): Boolean? {
+        return if (containsKey(key)) getBoolean(key) else null
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        super.onStartCommand(intent, flags, startId)
+        lifecycleScope.launchWhenStarted {
+            intent?.extras?.let {
+                val s = it.keySet().map { key -> "$key = ${it[key]}" }.joinToString(", ")
+                Log.d(TAG, "Provisioning: $s")
+            }
+
+            intent?.extras?.getBooleanOrNull("checkin_enabled")?.let { CheckinPrefs.setEnabled(this@ProvisionService, it) }
+            intent?.extras?.getBooleanOrNull("gcm_enabled")?.let { GcmPrefs.setEnabled(this@ProvisionService, it) }
+            intent?.extras?.getBooleanOrNull("safetynet_enabled")?.let { SafetyNetPrefs.get(this@ProvisionService).isEnabled = it }
+            // What else?
+
+            delay(2 * 1000) // Wait 2 seconds to give provisioning some extra time
+            stopSelfResult(startId)
+        }
+        return Service.START_NOT_STICKY
+    }
+
+    companion object {
+        private const val TAG = "GmsProvision"
+    }
+}
diff --git a/play-services-core/src/main/kotlin/org/microg/gms/ui/DeviceRegistrationFragment.kt b/play-services-core/src/main/kotlin/org/microg/gms/ui/DeviceRegistrationFragment.kt
index 68f30f72..721774f0 100644
--- a/play-services-core/src/main/kotlin/org/microg/gms/ui/DeviceRegistrationFragment.kt
+++ b/play-services-core/src/main/kotlin/org/microg/gms/ui/DeviceRegistrationFragment.kt
@@ -26,10 +26,7 @@ class DeviceRegistrationFragment : Fragment(R.layout.device_registration_fragmen
         binding = DeviceRegistrationFragmentBinding.inflate(inflater, container, false)
         binding.switchBarCallback = object : PreferenceSwitchBarCallback {
             override fun onChecked(newStatus: Boolean) {
-                PreferenceManager.getDefaultSharedPreferences(context).edit().putBoolean(PREF_ENABLE_CHECKIN, newStatus).commit()
-                if (newStatus) {
-                    requireContext().sendOrderedBroadcast(Intent(requireContext(), TriggerReceiver::class.java), null)
-                }
+                CheckinPrefs.setEnabled(context, newStatus)
                 binding.checkinEnabled = newStatus
             }
         }
diff --git a/play-services-core/src/main/kotlin/org/microg/gms/ui/PushNotificationFragment.kt b/play-services-core/src/main/kotlin/org/microg/gms/ui/PushNotificationFragment.kt
index fcdc6965..ad699e22 100644
--- a/play-services-core/src/main/kotlin/org/microg/gms/ui/PushNotificationFragment.kt
+++ b/play-services-core/src/main/kotlin/org/microg/gms/ui/PushNotificationFragment.kt
@@ -25,12 +25,7 @@ class PushNotificationFragment : Fragment(R.layout.push_notification_fragment) {
         binding = PushNotificationFragmentBinding.inflate(inflater, container, false)
         binding.switchBarCallback = object : PreferenceSwitchBarCallback {
             override fun onChecked(newStatus: Boolean) {
-                PreferenceManager.getDefaultSharedPreferences(context).edit().putBoolean(GcmPrefs.PREF_ENABLE_GCM, newStatus).apply()
-                if (!newStatus) {
-                    McsService.stop(context)
-                } else {
-                    requireContext().sendBroadcast(Intent(TriggerReceiver.FORCE_TRY_RECONNECT, null, context, TriggerReceiver::class.java))
-                }
+                GcmPrefs.setEnabled(context, newStatus)
                 binding.gcmEnabled = newStatus
             }
         }
diff --git a/play-services-core/src/main/res/values/strings.xml b/play-services-core/src/main/res/values/strings.xml
index cfc7fd85..faafbdc0 100644
--- a/play-services-core/src/main/res/values/strings.xml
+++ b/play-services-core/src/main/res/values/strings.xml
@@ -52,6 +52,8 @@ This can take a couple of minutes."</string>
     <string name="perm_c2dm_send_label">send C2DM messages to other apps</string>
     <string name="perm_gtalk_svc_label">exchange messages and receive sync notifications from Google servers</string>
     <string name="perm_extended_access_label">Extended access to Google services</string>
+    <string name="perm_provision_label">provision microG services</string>
+    <string name="perm_provision_description">Allows the app to configure microG services without user interaction</string>
 
     <string name="service_name_checkin">Google device registration</string>
     <string name="service_name_mcs">Google Cloud Messaging</string>