Can a phone configure a device that is switched off?
Yes, when the device carries a tag the phone can power: the phone writes the configuration into the tag, and the firmware reads it from the same memory when the device is first switched on. Some transponders go further and run their own microcontroller from the field alone.
Why it works at all
A tag takes its power from the reader, which the powering page explains: the phone's field is what makes the chip run, so the device around it can be unplugged, flat or still sealed in its box. Nothing in the exchange needs the product to be alive.
What makes this useful rather than curious is the wired side of a dynamic tag. The phone writes into memory the microcontroller can read later, so a configuration crosses from one to the other without either being powered at the same moment.
Writing before the first start
The pattern has three steps. The phone writes the configuration as an NDEF message, or in the chip's own memory, while the device is off. The device is switched on for the first time, its firmware reads the tag over I2C or SPI, and applies what it finds. The tag keeps the bytes, so a factory reset can return to them rather than to defaults nobody chose.
On a production line this is what pays: a device configured in its packaging, with no cable, no screen and no case to open, which the preparation page describes for tags in general.
Running from the field
Some chips do more than keep bytes. TI's RF430FRL15xH datasheet describes an ISO/IEC 15693 transponder with an MSP430 core, non volatile memory, an analog to digital converter and a temperature sensor, whose power supply system runs from a battery or from the 13.56 MHz field.
A phone can therefore trigger a measurement on a device with no battery at all, and read the result in the same tap. The limit is the energy in the field: what runs is what the harvested power can drive, and the datasheet, not the ambition, decides what that is.
What the firmware has to plan for
Validate what it reads. The configuration was written by something the firmware never saw, possibly by a phone that is not yours, so it is input: check the structure, check the ranges, and keep a fallback configuration for the day the tag holds nonsense.
Protect what matters. Anyone with a phone can write an unprotected tag, so a configuration that must not change needs the chip's own protection, which the configuration options page lists and the authentication page covers from the code side.
And write in an order that survives an interruption. A phone moved away mid write leaves the tag in whatever state it reached, which the interrupted writes page handles by writing the length last.
Frequently asked questions
Does the device need a battery for this?
No. The tag runs on the phone field, so the configuration can be written with the device off, flat or still in its box.
How does the firmware get the configuration?
It reads the same memory over the wired interface of the tag, I2C or SPI, when the device is first powered.
Can a phone take a measurement from an unpowered device?
On chips built for it, yes. The RF430FRL15xH datasheet describes a transponder with a microcontroller and sensors running from the field.
What stops someone else writing the configuration?
Nothing, unless the chip protects it. Use the protection the chip offers, and validate what the firmware reads in any case.