New onboarding flow to managing Android Enterprise devices with Microsoft Intune

Hi, any update on the migration plan for current tenants please?

Curious if there is any news on migrating from our existing Gmail account that won’t interrupt how these devices are managed.

Jessica-Yang If I understand correctly, then the following scenario would be possible:

Within Intune, the Admin A had set up the Managed Google Play with his personalized admin account (which has no mailbox. Hence, it is not monitored).

There is also Intune Admin B, but his account was never connected with Managed Play. Now Admin A leaves the company and according to good practice, his personalized admin account is deleted following the offboarding process. 30 days pass. Admin B took over the Android Enterprise admin responsibility. As he is Intune Admin, he can still get into the Managed Google Play and connect with his admin account there, without any impact on existing Android Enterprise devices or Apps. Is that correct?

Additionally, If Admin B would get a mailbox, would he receive notification mails from the Managed Google Play?

Rbb74

This is not a strategy or process issue at all, but a user-related issue.

Sure I am aware of having a good account strategy is crucial. But even with the best practices set up, the creation of the Managed Google Play connection stays an individual task: You cannot do anything about it, if the responsible admin is using their personalized admin account instead of a service account and thus not complies with the strategy. The offboarding process usually handles admin accounts differently than service accounts. So from a process-view, a deletion could be totally reasonable.  As Adria_Solana said, customers are calling-in, once it's too late already.

Intune_Support_Team we really need to understand, how the Managed Google Play connection behaves in case of a deletion of the connected account, especially when the account was the "master account" that created the connection. that's why I described the scenario above to verify my understanding. 

Finally, according to this article I can promise you, there will be huge amount of customers that is going to create the connection with their personalized (admin) account instead of some service account, as it is not mentioned at all in the article. The "normal admin" would very likely not be aware of the implications of the account used for the connection.

If nothing happens on deletion of the account, fine. But until now, if you had deleted a Google Account that was used to create the connection, this wiped all your Android Enterprise Corporate Managed Devices and the Apps. Before implementing this new feature, which is certainly great (don't get me wrong), we need to be aware of the full picture of consequences. As SteffenSchwerdtfeger said, sometimes it could be a much better idea, to use shared mailboxes.

Jessica-Yang I'm thinking if a service account wouldn't be the better option here? Or create a shared mailbox and enable sign-in temporarily?
I guess most customers created a Google account with an email address linked to a shared mailbox as paddy_braun also said. This made it flexible because you had no problems if admins were changing. Also, important mails from Google can be monitored via this mailbox.

Jessica-Yang Thank you for your response. Although it is important to have it all documented and procedural, there are customers who do not follow good practices or call you when it is too late and it is important to know how it works in order to help them deploy the environment as best as possible.

Thank you for everything.

Adria_Solana paddy_braun: Rbb74 has some good advice on managing service accounts like this. With this feature, you'll also be able to specify multiple Entra accounts as Managed Google Play admins. For example if you set this up initially with admin1@example.com and then the person associated with admin1 leaves, you can still access the Google console since you control the example.com tenant. You can then add admin2 to the Managed Google Play account as the new administrator, and remove admin1. Just a suggestion. Hope this helps.

This is a great advancement but we need a way for older tenants to get migrated. The whole idea of having to use a consumer Gmail account to use Intune is bad for multiple reasons.

The issue with an account that is deleted should never happen if you have implemented a solid strategy for service accounts (or whatever you want to call , this is crucial for any IT-deparment. As always with these kind of connection accounts, never use a personal account or a account that can be deleted by mistake. If it happens , you will can always recover the account within 30 days.

If you do not discover the accidental deletion in less then 30 days, you have a whole other issue to solve……(i.e.your processes, security etc) 😕

This is a great advancement in making the Intune admins setup and management of third party solutions so much easier. The fewer accounts to manage, the better! 😎

Great work , keep it up Intune_Support_Team ! 👌

Adria_Solana has an important point! 

Plus, will it still be possible to use Gmail Accounts? Most customers have strict separation between normal user accounts and admin accounts in Entra ID. The Admin Accounts often don't have a mailbox and never get one. They are usually using a shared mailbox as their Google Account to ensure the incoming notification mails can be accessed by the whole team.

Nice, no more Google accounts for Intune! But what will happen if the user with which I made the onboarding is deleted?