How to Add New Google Domain for Android Work Devices in Intune

Hello everyone, we are back with a new and an interesting topic: How to Add New Google Domain for Android Work Devices in Intune Android Enterprise personally-owned devices with a work profile. Intune recently released this feature with the 2305 release of Intune.

Intune currently allows to Add or Remove a Google account to Work Profile. Users can add a Google Domain to their Work Profile when this setting is enabled. By default, users cannot add any additional account to their Work Profile.

In Our previous blogs, we have learned how to integrate Android Enterprise to Intune, Enroll devices to Android for Work, create Compliance policies for Android for Work devices, and create Configuration policies. In this article, we will enable users to add the new Google Domains to Work Profile using the same device Configuration profile.

Create a Device Configuration Policy to Add New Google Domain for Android

Intune allows admins to configure device configuration profiles that control the behavior of the device. Using these configuration policies, we can define certain restrictions like allowing or blocking device features on Work Profile. Let’s see how we can create a new configuration profile.

Patch My PC
  • Sign in to Microsoft Intune Admin Center 
  • Click on Devices > Android > Configuration profiles
  • Click on Create Profile
  • Select Andoird Enterprise under Platform
  • Select the profile type as Device Restrictions under Personally-Owned Work Profile and click on Create.
How to Add New Google Domain for Android Work Devices in Intune Fig: 1
How to Add New Google Domain for Android Work Devices in Intune Fig: 1

Now on the Basics page, provide the Name for Profile and the Description for the Profile. Click Next to the Configuration Settings page. Now on the Configuration Settings page, click Work Profile settings. This will expand various device restrictions to configure for Work Profile.

Using these controls, we can manage the Data Transfer between the Work Profile and the Personal Profile of the device, App notifications for the work profile, copy and paste data between the Work and Personal Profile, and many more.

As we are discussing how to add a new Google domain, let’s see what options are provided to Intune Admins by Intune. Under Work Profile Settings, scroll down to Add and Remove Accounts, this setting will define whether to Allow or Block adding new accounts.

By default, the value is set to “Allow all account types, except for Google Accounts.” Click on the settings and choose Allow all Accounts. This will enable users to add any Domain accounts to their Work Profile. When we select the option, Intune allows admins to control further, which Google Domains can be allowed. Admin can view “Google domain allow-list” enabled.

Adaptiva
How to Add New Google Domain for Android Work Devices in Intune Fig: 2
How to Add New Google Domain for Android Work Devices in Intune Fig: 2

If you want to restrict users to certain Google Domains, we can define the domains under the Google domain allow-list. We can add the domains manually or import the .csv file with all the allowed Google domains. While preparing a .csv file with Domains, the first row will be treated as Header, and Intune will not consider it as Domain and will leave the first row. So define Domains from the second row of the sheet.

How to Add New Google Domain for Android Work Devices in Intune Fig: 3
How to Add New Google Domain for Android Work Devices in Intune Fig: 3

The domains should be defined in contoso.com format. If Admins leave the fields blank, Intune will allow all Google Domains to be configured on Work Profile. These Google accounts are blocked from Installing apps from Managed Play Store. Intune also allows Admins to Block all kinds of Accounts.

Let’s see below table the of available settings.

Settings NameSettings Allowed
Allow all account types except Google accounts This is the default value, and Intune will not change the device settings, by default, the device OS might allow adding accounts in Work Profile.
Allo All Account typeThis setting will allow users to configure All Accounts, including Google accounts
Block All AccountsThis restriction will block users from adding or removing Google accounts from their Work Profile
How to Add New Google Domain in Intune for Android for Work Devices table: 1

Now that we have defined the restriction click Next and assign to Scope tags, if you have any, and click Next to the Assignment page and Assign the profiles to required groups. Click Next Review and Create the Profile.

End User Experience

Let’s see the end-user experience of how the devices behave when the profile is not assigned to users and after assigning the profile to the users. Users can Enroll their devices in Android For Work, once the devices are enrolled. Click on Managed PlayStore and click on Add an account in the top left corner and click on Manage your Google Account.

How to Add New Google Domain for Android Work Devices in Intune Fig: 4
How to Add New Google Domain for Android Work Devices in Intune Fig: 4

Now click on Add account; users will get an error stating “Action not allowed“, as shown in the below screenshot.

How to Add New Google Domain for Android Work Devices in Intune Fig: 5
How to Add New Google Domain for Android Work Devices in Intune Fig: 5

Now, let’s see the behavior once the device profile is assigned to users. In the same way above, try to add a Google account, and users can add an account.

How to Add New Google Domain for Android Work Devices in Intune Fig: 6
How to Add New Google Domain for Android Work Devices in Intune Fig: 6

This is how we can add a New Google Domain to Intune for Android for Work devices in Intune. I hope you like the article, and we will be back soon. Stay tuned for more interesting topics we will share with you in the future.

Author

About AuthorNarendra Kumar Malepati (Naren) has 11+ years of experience in IT, working on different MDM tools. Over the last seven years, Naren has been working on various features of Intune, including migration from different MDMs to Intune. Naren mainly focuses on Android, iOS, and MacOS.

1 thought on “How to Add New Google Domain for Android Work Devices in Intune”

  1. I would like to know how to create a configuration profile in Intune that excludes the Google Maps application from the restriction of adding new Google accounts or personal accounts.

    Also, about the option to create an application configuration policy for Google Maps, we would like to know how to be able to specify the Google accounts or credentials allowed for use in the application.

    Reply

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.