Microsoft Intune now lets administrators require users on supported corporate-owned Android Enterprise devices to authenticate with a managed Google Account. The capability reached general availability on October 19, 2026, for organizations using Google Workspace identities on managed Android devices.
The policy is optional and narrowly scoped. Microsoft lists two supported enrollment types: corporate-owned fully managed devices and corporate-owned devices with a work profile. Corporate-owned dedicated devices are not supported because they are not associated with an individual user. The policy does not replace the Microsoft Entra account associated with the device.
What changes for users and administrators
| Area | Microsoft's guidance | What to plan |
|---|---|---|
| Supported devices | Corporate-owned fully managed and corporate-owned work profile | Scope assignments to users on these enrollment types. |
| Not supported | Corporate-owned dedicated devices | Keep kiosk and dedicated-device groups out of scope. |
| Google identity | Users complete the prompt with a managed Google Account from the organization's Workspace domain. | Create required managed accounts and tell users which work account to select. |
| Microsoft Entra identity | The device's associated Entra account is not affected. | Keep Microsoft sign-in and access instructions intact. |
Prepare Google Workspace and Intune
- Verify your Workspace domain in the Google Admin console.
- Check Managed Google Play. If it has not been upgraded to a managed Google domain enterprise, use the Upgrade option in the Intune admin center. The administrator doing the upgrade needs the Google Workspace Super Admin role.
- Create managed Google Accounts for intended users if they do not already exist.
- Use a suitable Intune role. Microsoft lists at least the Policy and Profile Manager role for the documented operations.
- Choose a supported pilot cohort and exclude corporate-owned dedicated devices.
Configure the Settings Catalog policy
- In Intune, go to Devices > Manage devices > Configuration > Create > New policy.
- Choose Android Enterprise as the platform and Settings catalog as the profile type.
- Under Device restrictions > Users and Accounts, add Require users to authenticate with a Google Workspace account and set it to True.
- Assign the policy to groups whose users should use managed Google Accounts for authentication and enrollment. Review the assignment, then create the policy.
You can assign the policy before or after enrollment. If assigned before enrollment, the prompt appears after enrollment. On an enrolled device, the prompt appears after the policy arrives.
Prepare support for the user prompt
After the policy reaches the device, the user gets a Sign in with your work account prompt. Until authentication is complete, the setting can show an Error state and Gmail, if present, is disabled. Microsoft says this setting's error does not change the device's overall compliance state.
After the user chooses a managed Google Account and authenticates, that account replaces the managed Google Play account on the device. Microsoft's source says the device's associated Entra account is unaffected.
Verify the pilot before expanding
- Open Devices > Manage devices > Configuration > Policies in Intune and select the policy.
- Review device and user check-in, assignment, and per-setting status.
- Confirm the user completed the prompt and the managed Google Account is available on the device.
- Check that users can access intended Google services and that Microsoft Entra sign-in and required work apps remain available.
- Update enrollment instructions and help desk steps before assigning the policy to more supported groups.
For exact prerequisites and current policy details, use Microsoft's Intune Customer Success announcement and the Microsoft Learn references below.
Planning an Android Enterprise rollout?
Accred can help map enrollment types, identity prerequisites, and support workflows into a staged Intune deployment.
Plan an Intune Review