New onboarding flow to managing Android Enterprise devices with Microsoft Intune

I can see the Migration for current Intune tenants' section was updated today. But can someone from Microsoft confirm that this does not break existing app deployment or any other Android management functionality.

Already tried "Upgrade your Google Play accounts enterprise to a managed Google domain and unlock more features." in an existing tenant:

After login with Google account it results in error: "ERR_BLOCKED_BY_RESPONSE" (also tested via Google Chrome, too):

​ This is a much more secure flow so I'm supportive of this change - however was I supposed to create this connection with a service account? The instructions stated I can use my "Microsoft Entra credentials" so I've just used my administrative login. If the integration or link is not tied to my specific account then that's great.

Great update! Please post any documentation links that we can go through. It is important to not break any of our apps or Android management during the migration.

This is great that we can now migrate! Can you assure us that when migrating we will not break our apps or devices registered in Intune? Will we need to re-register our devices or redeploy apps.

Hi, any update on the migration plan for current tenants please?

Curious if there is any news on migrating from our existing Gmail account that won’t interrupt how these devices are managed.

Jessica-Yang If I understand correctly, then the following scenario would be possible:

Within Intune, the Admin A had set up the Managed Google Play with his personalized admin account (which has no mailbox. Hence, it is not monitored).

There is also Intune Admin B, but his account was never connected with Managed Play. Now Admin A leaves the company and according to good practice, his personalized admin account is deleted following the offboarding process. 30 days pass. Admin B took over the Android Enterprise admin responsibility. As he is Intune Admin, he can still get into the Managed Google Play and connect with his admin account there, without any impact on existing Android Enterprise devices or Apps. Is that correct?

Additionally, If Admin B would get a mailbox, would he receive notification mails from the Managed Google Play?

Rbb74

This is not a strategy or process issue at all, but a user-related issue.

Sure I am aware of having a good account strategy is crucial. But even with the best practices set up, the creation of the Managed Google Play connection stays an individual task: You cannot do anything about it, if the responsible admin is using their personalized admin account instead of a service account and thus not complies with the strategy. The offboarding process usually handles admin accounts differently than service accounts. So from a process-view, a deletion could be totally reasonable.  As Adria_Solana said, customers are calling-in, once it's too late already.

Intune_Support_Team we really need to understand, how the Managed Google Play connection behaves in case of a deletion of the connected account, especially when the account was the "master account" that created the connection. that's why I described the scenario above to verify my understanding. 

Finally, according to this article I can promise you, there will be huge amount of customers that is going to create the connection with their personalized (admin) account instead of some service account, as it is not mentioned at all in the article. The "normal admin" would very likely not be aware of the implications of the account used for the connection.

If nothing happens on deletion of the account, fine. But until now, if you had deleted a Google Account that was used to create the connection, this wiped all your Android Enterprise Corporate Managed Devices and the Apps. Before implementing this new feature, which is certainly great (don't get me wrong), we need to be aware of the full picture of consequences. As SteffenSchwerdtfeger said, sometimes it could be a much better idea, to use shared mailboxes.

Jessica-Yang I'm thinking if a service account wouldn't be the better option here? Or create a shared mailbox and enable sign-in temporarily?
I guess most customers created a Google account with an email address linked to a shared mailbox as paddy_braun also said. This made it flexible because you had no problems if admins were changing. Also, important mails from Google can be monitored via this mailbox.

Jessica-Yang Thank you for your response. Although it is important to have it all documented and procedural, there are customers who do not follow good practices or call you when it is too late and it is important to know how it works in order to help them deploy the environment as best as possible.

Thank you for everything.