Best practice for the managed Google Play Account in Intune/MEM

[SRPfr]

Hi All,

I'm looking for some advice on the best practice for setting the first step of Android enrollment in Microsoft Intune/MEM.

What is the best practice for security and management, when we choose the managed Google Play account for Intune/MEM ?
Using an AzureAD account (with or without exchange online licence), a Google account, or other external account ?
Does this account need to have access to a mailbox and MFA can be used with this account ?

Thanks !

[#2]

I mostly create a general Google account that is shared across the organization and can be linked with Intune.
The managed Google Account is not that important, if you would ever loose access. You can link it again and re-add your apps.
In comparison, if you loose access to your Apple account, you need to re enroll your device

[#3]

I agree with @Thijs Lecomte, the Google account is usually a generic account created only for this purpose. This account is usually something that is only used for this link with most of my customers. 

Usually owned and stored by the team operating Intune since they are the ones who need this account. 

Most of my customers are using a [random-name-chosen-by-customer]@gmail.com or such for this. 

[#4]

@Thijs LecomteThanks for your answer !

This gmail account doesn't receive any email we need to check for MEM/InTune or Google Play ?

Can we change the password and add MFA for this account without breaking InTune integration ?

I have read that if we loose access to the Google Play account in InTune, to change this account with a new one, we need first retire all enrolled Android device and then enroll all devices. This will have a big impact for user, or there is a easier way to do this?

Thanks,

[#5]

Hi

You don't really need the check emails, except if you would require approval for app updates maybe.

I haven't personally tried enabling MFA on the account. It's something to try out I guess.

[#6]

@Thijs Lecomte When we want to use Android Zero-Touch, do we need to use the same account (Intune Google Play Account) or this can be 2 different account ?

Apparently Google is asking to use a professionnal account to access to Zero-Touch portal.

If we use a professional account, this account need also to have an Exchange Online licence always activated with an enabled mailbox ?

Thanks !

[#7]

Yeah, you can use a different account. They are essentially two different things

[#8]

@Thijs Lecomte 

Thanks, but what will be the best practice for you, with Android Zero-Touch and Intune Google Play Account :

- Two Professional Accounts.

- Two Gmail Accounts (Apparently not recommended by Google : is asking to use a professionnal account to access to Zero-Touch portal).

- Two Accounts (1 Gmail & 1 Pro) : 1 gmail Account for Intune Google Play Account & 1 Professional Accounts for Android Zero-Touch

- One unique Professional Account. So only one ExO licence and one account to secure. Any disadvantage ?

If we use a professional account, this account need also to have an Exchange Online licence always activated with an enabled mailbox or we don't need a mailbox ?

Do you know if we use also iOS and Samsung Knox : Best practice will be to use one different account for each or the same for all ? (Google Play, iOS AppStore, Android Zero-Touch, Knox) 

Thanks,

[#9 · Accepted solution]

@SRPfr 

There isn't a real, outlined best practices here.

You don't need a Exchange license per say, you could use this solution - https://msendpointmgr.com/2020/08/08/2-for-1-mail-enable-unlicensed-admin-accounts/

I would use one Professional account if possible, will be the easiest way

[#10]

@Thijs LecomteThanks,

An a very usefull article !

[#11]

Hello,

Sorry I refresh an old post. ;)

But it's the one that I find for my research.

Is it a good thing to use the same account for managed Google Play and for the factory reset protection please?
I ask this because when I trie to connect to my Managed Google play account, it ask me to verify my account with phones that I don't have anymore. I think it's phones where the account was used to do a factory reset.

So I think it's better to have 2 differents accounts but I need your advice on this. ;)

And other question that was not answer here 2 years ago but now maybe. Is there an impact of adding an MFA method to the Managed Google play account? To avoid this problem of verification with phones that I don't have.
I thinks there is no problem but I need to be sure. If I remember correctly it's not possible to have no more MFA configuration in gmail if we had one previously.