Intune Can Require Google Workspace Sign-In on Corporate Android Devices

What Microsoft shipped​

In its Intune Customer Success blog, Microsoft says organizations using Android Enterprise can now require users on managed devices to authenticate with a managed Google Account. The company adds that this capability is generally available in Microsoft Intune. That means it is a production feature, not a preview.

There is one important prerequisite: the new policy supports organizations that have upgraded their Managed Google Play enterprise to a managed Google domain enterprise.

Windows Report covered the release the same day. It described the change as giving IT administrators more control over how employees reach Google apps and services on supported corporate Android devices.

Why this matters: two Google accounts with different jobs​

Most Intune administrators have never had to think much about the Google account on an Android Enterprise device. It works in the background and nobody signs in with it. Microsoft explains that Android Enterprise has traditionally used managed Google Play accounts solely to enroll and manage devices and distribute corporate apps, rather than as user identities for accessing Google services outside the managed device.

The new policy changes that. According to Microsoft, admins can now require users to enroll and authenticate with their organization's managed Google Workspace Account instead of using the device's managed Google Play account. The result is that this gives users access to Google apps and services with their organizational identity.

The Microsoft side of the device is not affected. This feature doesn't impact the Microsoft Entra account associated with the managed device.

A wording issue to watch. The announcement says the feature helps organizations use Google Workspace identities "as the primary management identity." Its conclusion then says Microsoft Entra is retained as the device's management identity. The specific statements about the Entra account point to the practical reading: the Google Workspace account replaces the background Managed Google Play account for Google services, and Entra stays in charge of Intune management. Organizations that depend on Entra-based compliance and Conditional Access should still test this in a pilot before relying on that reading.

Summary: A managed Workspace account replaces the hidden Managed Google Play account on the device. Microsoft says the Entra account is not touched.

Which devices are supported​

The supported enrollment types are limited. Microsoft lists corporate-owned, fully managed devices and corporate-owned devices with a work profile. It also states that corporate-owned dedicated devices aren't supported because they aren't associated with an individual user.

The BYOD row needs a clear warning. Microsoft does not include personally owned work profiles, and some administrators have already had trouble with that setup. In a Microsoft Q&A thread from June 2026, one administrator running Intune with Google Workspace described wanting to use the native Google apps (Drive, Gmail, Chrome) signed in with their Workspace account on personally owned work profiles. They reported that the account could be added but never reaches a working state. The reply in that thread was AI-generated and said the scenario is not documented or guaranteed as a supported scenario. That is one administrator's report, not a formal Microsoft statement. Still, it is a good reason not to expect this new setting to fix BYOD.

Summary: Two corporate-owned enrollment types are supported. Dedicated devices are excluded, and personally owned work profiles are not listed.

Prerequisites​

Check two things before you open the settings catalog:

1. Verify your Google Workspace domain. Microsoft lists this first: verify your organization's Google Workspace domain. Admins can verify an organization's domain on the Google Admin console by following the instructions from Verify your domain for Google Workspace.
2. Upgrade to a managed Google domain enterprise if you have not already done so.

Many tenants connected Managed Google Play years ago using a Gmail account. Microsoft Learn describes the upgrade path for them: if you onboarded to Microsoft Intune with a Gmail account, you can optionally upgrade your Microsoft Entra account to a managed Google domain in the Intune admin center. The steps are:

1. Sign in to the Intune admin center with an Intune Administrator account.
2. Go to Devices > Enrollment and select the Android tab.
3. Under Prerequisites, choose Managed Google Play.
4. Select Upgrade, then select Upgrade again to confirm.
5. In the Google popup, follow the prompts and choose Sign in with Microsoft when it is offered.
6. Select Upgrade and wait for the confirmation message and the admin center notification.

Microsoft Learn notes that after a successful upgrade, the Upgrade button is grayed out. If it is grayed out and you have not upgraded, check your RBAC permissions. If Google reports that the domain is already in use, Microsoft refers you to Google's support article on domains that can't be signed up for a Google service.

Do not click Disconnect on the same page while you are there. Microsoft Learn warns that disconnecting the Intune–Google link disables Android Enterprise device management for the whole tenant.

Tenants that connected after August 2024 may already be in good shape. Microsoft notes that as of August 2024, you can link your Microsoft Entra identity account to a Google account, instead of using an enterprise Gmail account.

How to configure the policy​

You can build the policy through the settings catalog in the Intune admin center:

1. Go to Devices > Manage devices > Configuration > Create > New policy.
2. For Platform, select Android Enterprise.
3. For Profile type, select Settings catalog.
4. In Configuration settings, open Device restrictions > Users and Accounts.
5. Add Require users to authenticate with a Google Workspace account and set it to True.
6. Assign the policy to groups that contain the users who should use managed Google accounts on their Intune-managed Android devices.
7. Review and create the policy.

You can assign it before enrollment or to devices that are already enrolled. With pre-enrollment assignment, the sign-in prompt appears after enrollment finishes. On a device that is already enrolled, the prompt appears once the device receives the policy.

Summary: One setting, set to True, under Device restrictions > Users and Accounts. It can target new or existing devices.

What users see and what can break​

After the policy reaches the device, the user gets a "Sign in with your work account" notification from Device Policy. They tap it, add a managed Google Account from the organization's enterprise domain, and finish authentication. The managed Google Play account on the device is then replaced by the Workspace account they chose.

Until the user completes that step, two things happen:

• The setting reports "Error" in Intune.
• Gmail is disabled if it is installed on the device.

On compliance, Microsoft says this setting's non-compliance does not change the device's overall compliance state. A user who ignores the prompt will not lose access through Conditional Access because of this setting alone. They will lose Gmail until they sign in, which tends to get people to act.

Because of the Gmail lockout, I'd recommend telling users in advance, especially those who rely on Gmail all day. Pilot with a small group first, then expand. Microsoft does not prescribe a rollout order; this is an operational recommendation based on how the policy behaves.

Checking the deployment​

In the Intune admin center, go to Devices > Manage devices > Configuration > Policies and select the policy. You can review:

• Device and user check-in status
• Device assignment status
• Per-setting status, where unfinished sign-ins show up as "Error"

After users authenticate, confirm on a sample device that the managed Google Account is present. Expect the dashboard to show errors early in the rollout. In this case, "Error" usually means the user hasn't completed the sign-in yet.

Analysis: who should use this​

For organizations that use Intune and Entra for device management and Google Workspace for productivity, this closes a long-standing gap on corporate phones. Previously, the Google identity on the device existed only to deliver apps. Now IT can make the Google identity on the device the same one users have in Workspace.

Some limits to keep in mind:

• Only corporate-owned devices are covered. BYOD work profiles, which are common in hybrid environments, are not listed.
• Microsoft's blog post does not cover Workspace licensing or provisioning. The policy requires users to sign in with a managed account. It does not create the account or decide which Workspace services the user is entitled to; those come from the account itself.
• The upgrade is the main prerequisite. Tenants still on a legacy Gmail binding must complete the managed Google domain upgrade first. Because Android management depends on that connection, schedule the upgrade in a maintenance window.

For organizations that run Microsoft 365 end to end, this setting probably doesn't matter. For organizations that split Microsoft and Google services, it is a useful addition, provided users are warned before Gmail stops working on their phones.