Require Managed Google Accounts on Android Enterprise Devices

Require a Managed Google Account for Android Enterprise Devices with Microsoft Intune

A practical deployment guide | Microsoft Intune, Android Enterprise & Google Workspace

Microsoft Intune now supports a policy that requires users on supported, corporate-owned Android Enterprise devices to authenticate with a managed Google Workspace account.

This capability helps organizations standardize the identity used to access Google services while retaining Microsoft Intune and Microsoft Entra ID for device management.

In this guide, we'll cover the architecture, prerequisites, policy configuration, end-user experience, deployment validation, and troubleshooting considerations.

---

1. Understanding the Architecture

Android Enterprise environments can involve two distinct identity systems.

Microsoft Entra ID and Intune

• Manage device configuration and security policies.
• Control application deployment and device compliance.
• Provide the Microsoft identity used for organizational resources.

Google Workspace

• Provides the managed Google account used to access Google services.
• Enables access to organizational Google applications and resources, subject to assigned permissions and licensing.
• Allows administrators to manage Google identities through Google Workspace.

The new policy requires users to authenticate with their organization's managed Google account rather than relying solely on the managed Google Play account.

Important: This does not replace the Microsoft Entra identity associated with the device.

2. Why Use This Policy?

Organizations using both Microsoft 365 and Google Workspace may benefit from:

• Consistent identity: Users authenticate with their organizational Google account.
• Google service access: Users can access authorized Google Workspace services using their managed identity.
• Centralized administration: Google Workspace administrators retain control over Google accounts and associated access.
• Clear separation of responsibilities: Intune manages the device, while Google Workspace manages the Google identity.

This is an identity-integration capability, not a replacement for Conditional Access, Intune compliance policies, or Microsoft Entra ID.

3. Supported Enrollment Types

The announced policy supports these Android Enterprise enrollment types:

Enrollment type	Supported
Corporate-owned, fully managed	✅ Yes
Corporate-owned with a work profile	✅ Yes
Corporate-owned dedicated devices (kiosk)	❌ No

Dedicated devices are excluded because they are not associated with an individual end user in the same way as the supported enrollment types.

4. Prerequisites

Before creating the policy, verify the following requirements.

Google Workspace

1. Verify your organization's domain in the Google Admin console.
2. Confirm that your Android Enterprise integration has been upgraded to a managed Google domain enterprise, if required.
3. Ensure that each targeted user has a managed Google Workspace account.

4. Verify that the required Google services are enabled and appropriately licensed.

If an upgrade is required, the administrator performing it must have the Google Workspace Super Admin role.

Microsoft Intune

• The Intune tenant must be connected to Managed Google Play.
• Target devices must use a supported, corporate-owned Android Enterprise enrollment type.
• The administrator configuring the policy needs at least the Policy and Profile Manager role in Intune.

Official references:

• Connect Intune to Managed Google Play
• Verify a Google Workspace domain

5. Configure the Policy in Microsoft Intune

1Open the Intune admin center

Navigate to the Microsoft Intune admin center, then go to:

Devices → Manage devices → Configuration → Create → New policy

2Select the platform and profile

Configure the policy as follows:

• Platform: Android Enterprise
• Profile type: Settings catalog

Continue to Configuration settings.

3Add the required setting

Open: Device restrictions → Users and Accounts

Search for and add: Require users to authenticate with a Google Workspace account

Set the value to: True

This setting instructs the supported device to require authentication with an organization's managed Google Workspace account.

4Assign the policy

Assign the policy to an appropriate test group containing users with supported Android Enterprise devices. For the initial rollout, use a small pilot group rather than assigning it to all users immediately.

Before deployment, verify that every targeted user has a valid managed Google account and that the organization's Google Workspace configuration is ready.

5Review and create

Review the following:

• Platform and profile type.
• Configured setting and its value.
• Included and excluded groups.
• Expected user experience and deployment scope.

Select Review + create to complete the configuration.

The policy can be assigned before enrollment or to already-enrolled supported devices. When assigned before enrollment, the authentication prompt appears after enrollment. On an already-enrolled device, it appears after the policy is received.

6. What Does the User Experience Look Like?

Once the policy reaches the device, the user receives a prompt to sign in with their work account. The expected flow is:

1. Policy delivery: The device receives the configuration from Intune.
2. Authentication prompt: The user is prompted to sign in with their organization's managed Google account.
3. Account authentication: The user selects or adds the appropriate account and completes authentication.
4. Account replacement: After successful authentication, the selected managed Google account replaces the device's managed Google Play account.

The device continues to be managed through Intune.

Important user impact

Until the user completes authentication:

• The policy setting may report an Error state.
• Gmail, if present on the device, may be disabled.
• The policy's error state does not automatically change the device's overall Intune compliance state.

Communicate these effects before rollout to avoid unnecessary support requests.

7. Verify Deployment

After assigning the policy, open: Devices → Manage devices → Configuration → Policies

Select the policy and review the available device and user reporting. Check the following:

• Assignment status: Confirm that the policy is assigned to the intended group and that the target user or device is in scope.
• Device check-in: Confirm that the device has checked in and received the policy.
• Per-setting status: Review the status of Require users to authenticate with a Google Workspace account.
• Account verification: After the user completes authentication, confirm that the expected managed Google account is available on the device.

Do not treat a successful policy assignment as proof that the user has completed Google authentication. Validate the setting status and the resulting user experience as well.

8. Troubleshooting

The setting reports Error

Possible cause: The user has not completed the Google Workspace authentication prompt.

Recommended action: Ask the user to complete the sign-in flow, then allow the device to synchronize with Intune and check the policy status again.

The user cannot authenticate

Possible causes:

• The Google account does not exist in the managed domain.
• The organization has not completed domain verification or the required enterprise upgrade.
• Google Workspace authentication or the required services are not configured correctly.

Recommended action: Verify the account in Google Admin Console, confirm the domain and enterprise setup, and review the applicable Google Workspace authentication requirements.

The policy does not appear on the device

Possible causes:

• The device is not included in the assigned group.
• The device has not checked in.
• The enrollment type is unsupported.
• The device has not received the configuration.

Recommended action: Check group membership, assignment status, enrollment type, and the device's latest Intune check-in.

Gmail is unavailable

If the user has not completed the required authentication, Gmail may be disabled by this policy. Confirm the user's authentication status before investigating this as an unrelated application deployment issue.

9. Recommended Deployment Strategy

For production environments, use a controlled rollout:

1. Verify the Google Workspace domain and Managed Google Play integration.
2. Confirm the required managed Google accounts exist.
3. Create a dedicated pilot group.
4. Assign the policy to the pilot group.
5. Test authentication and access to the required Google services.
6. Review Intune reporting and support incidents.
7. Expand the assignment after the pilot succeeds.

Document the expected sign-in prompt and the potential temporary Gmail impact in your end-user communication.

10. Key Takeaways

This policy bridges an important identity requirement for organizations using Android Enterprise alongside Google Workspace. It provides a way to require a managed Google identity without replacing Microsoft Entra ID as the device's management identity.

My recommendation: Enable this policy only when your organization has a clear requirement for managed Google accounts on corporate-owned Android devices. If your environment relies exclusively on Microsoft 365 and Intune, the policy may provide little additional value.

---

Official documentation

• Microsoft Intune — Android settings catalog
• Microsoft Intune — Android enrollment guide
• Microsoft Intune — Managed Google Play connection and upgrade
• Google Workspace — Managed Google domain Android management

Technical note: Intune portal labels and reporting may change over time. Validate the exact setting and supported enrollment types in your tenant before deploying to production.