Microsoft Intune Adds New Google Workspace Authentication Policy for Managed Android Phones

Microsoft Intune now allows organizations require employees to sign in with managed Google Workspace accounts on supported corporate Android devices. The new capability is generally available and gives IT administrators more control over how employees access Google apps and services.

Microsoft Intune adds Google Workspace authentication policy

Previously, Android Enterprise used managed Google Play accounts primarily for device enrollment, management, and corporate app distribution. The new policy allows organizations to require users to authenticate with their organization’s managed Google Account instead.

Microsoft says the capability supports corporate-owned, fully managed devices and corporate-owned devices with a work profile. Dedicated corporate devices are excluded because they aren’t associated with individual users.

The change also leaves the device’s Microsoft Entra account untouched. Organizations can therefore continue using Microsoft Entra for device management while providing employees with their managed Google Workspace identities.

However, organizations must first verify their Google Workspace domain. They may also need to upgrade their Managed Google Play enterprise to a managed Google domain enterprise before configuring the policy.

Here’s how administrators can enable the new Intune policy

IT administrators can configure the requirement through the Microsoft Intune admin center. Navigate to Devices > Manage devices > Configuration > Create > New policy, then select Android Enterprise and Settings catalog.

Under Device restrictions > Users and Accounts, add Require users to authenticate with a Google Workspace account and set it to True. Administrators can then assign the policy to the appropriate user groups.

The policy can be assigned before enrollment or to devices already enrolled in Intune. Users will receive a prompt asking them to sign in with their work Google account after the policy reaches their device.

Until authentication is completed, the setting reports an error state and Gmail is disabled if installed. However, this policy’s non-compliance does not change the device’s overall compliance status.

Administrators can monitor deployment

Administrators can check device assignments, user check-ins, and individual setting statuses through Intune’s configuration policies page. They should also confirm that the managed Google Account appears on the device after authentication. Moreover, Microsoft says the capability helps organizations provide consistent access to assigned Google Workspace resources while retaining Microsoft Entra as the device management identity.