Require Google Workspace authentication on Android Enterprise devices with Microsoft Intune

By: Samuel Vara, Software Engineer & Mayur Jadhav, Product Manager | Microsoft Intune

We’re excited to announce that organizations using Android Enterprise can now require users on managed devices to authenticate with a managed Google Account. This capability is generally available in Microsoft Intune and helps organizations use their Google Workspace identities as the primary management identity on supported Android Enterprise devices.

The new policy supports organizations that have upgraded their Managed Google Play enterprise to a managed Google domain enterprise.

Use managed Google Accounts on enrolled devices

 Android Enterprise has traditionally used managed Google Play accounts solely to enroll and manage devices and distribute corporate apps, rather than as user identities for accessing Google services outside the managed device.  With this policy, admins can now require users to enroll and authenticate with their organization’s managed Google Workspace Account instead of using the device’s managed Google Play account. This gives users access to Google apps and services with their organizational identity. This feature doesn‘t impact the Microsoft Entra account associated with the managed device.

This capability supports the following Android Enterprise enrollment types:

• Corporate-owned, fully managed devices
• Corporate-owned devices with a work profile

Prepare your environment

Before you configure the policy, complete these prerequisites:

• Verify your organization's Google Workspace domain.
• Admins can verify an organization's domain on the Google Admin console by following the instructions from Verify your domain for Google Workspace | Domain management | Google Workspace Help
• Upgrade the Managed Google Play enterprise to a managed Google domain enterprise, if required, using the Upgrade button on the Intune admin center.
• Customers can follow the instructions in the blog  New onboarding flow to managing Android Enterprise devices with Microsoft Intune to upgrade or onboard their tenant.
• Note that the admin performing the upgrade must have "Super Admin" rolein Google Workspace during the upgrade process. More instruction on how to assign such permission to a user can be found in Prebuilt administrator roles | User management | Google Workspace Help
• If users don't already have managed Google Accounts created in the enterprise's Google Workspace domain, create them following the instructions in the "Domain verified" section of Add an account for a new user | User management | Google Workspace Help
• Use an account with at least the Policy and Profile Manager role in  Intune for the above oprations within the Intune admin center.

Configure the policy in Microsoft Intune

In the Intune admin center, Create a policy using settings catalog in Microsoft Intune or follow the instructions below:

1. Go to Devices > Manage devices > Configuration > Create > New policy.
2. For Platform, select Android Enterprise.
3. For Profile type, select Settings catalog.
4. In Configuration settings, open Device restrictions > Users and Accounts.
5. Add Require users to authenticate with a Google Workspace account and set it to True.
6. ssign the policy to groups containing users that want to use the managed Google accounts for authentication and enrollment on their Intune managed Android devices.
7. Review and create the policy.

You can assign the policy before enrollment or to devices that are already enrolled. If you assign it before enrollment, the authentication prompt appears after enrollment. On an enrolled device, the prompt appears after the device receives the policy.

What users experience

1. After the policy reaches the device, the user receives a Sign in with your work account prompt on the device.
2. The user clicks on the prompt and adds a managed Google Account from the organization's enterprise domain and completes authentication.
   1. Until the user completes the prompt and authenticates with the Google Account, the policy setting reports an "Error" state, and the Gmail app, if present on the device, is disabled.
   2. This policy's non-compliance doesn't change the device's overall compliance state.
   3. Once a Google Account is chosen the user completes authentication, the managed Google Play account is replaced on the device by the chosen Google Account.
      
      Figure 01: Android phone lock screen showing a Device Policy notification prompting the user to "Sign in with a work account".

Verify deployment

Administrators can monitor the policy from Devices > Manage devices > Configuration > Policies in the Intune admin center. Select the policy to review device and user check-in status, device assignment status, and per-setting status.

After the user completes authentication, confirm that the managed Google Account is available on the device.

Conclusion

This new Intune capability gives organizations greater control over how users access Google apps and services on supported corporate-owned Android Enterprise devices. By requiring authentication with a managed Google Account from the organization’s Google Workspace domain, admins can provide a consistent organizational identity and give users access to the Google Workspace resources and services assigned to that account, while retaining Microsoft Entra as the device’s management identity. Review the prerequisites, configure the settings catalog policy, and monitor deployment to bring this experience to your users.