Integrating Google Accounts with Intune

[cooper]

Our school mainly uses Google Workspace, but we've recently introduced Intune and Office for some Office users. We're exploring the possibility of allowing Windows login with Google accounts.

 

Do you have experience with this integration? Any challenges, best practices, or tips to share?

 

I know this does not work with GCPW unless you have a onprem ad.

 

Thanks

[ZeroHour]

With Windows 11 you can actually sign in to windows with a google account now using web sign in but I cant remember where I saw the steps for doing this.

[TwistedHelixis]

With Windows 11 you can actually sign in to windows with a google account now using web sign

ohhh, something to read up on when I have some time :-)

[Millgate_Victoria]

heya, not sure but I saw this youtube video about enrolling google play into microsoft intune if it helps ,

- it seemed to be actioned through the microsoft intune admin center

 

hope this helps

[dhicks]

With Windows 11 you can actually sign in to windows with a google account now using web sign in but I cant remember where I saw the steps for doing this.

 

A quick Google search for "Windows 11 web sign in" suggests this page:

 

https://learn.microsoft.com/en-us/windows/security/identity-protection/web-sign-in/?tabs=intune

 

That's seems to be a pretty good explanation - I see examples there pointing at Clever badges for login, I'm guessing Wonde and others would work in the same way.

 

Has anyone tried Web Sign In with USB 2FA keys? That was the issue we found with GCPW, it's walled off from USB access so it can't work with USB-based authentication, although mobile or other device authentication worked okay. A couple of previous threads discussing the issue:

 

https://www.edugeek.net/forums/cloud-services/232324-migrate-100-google-3.html#post2024282

 

We've wound up using pGina, pointing at Google's LDAP login server:

 

pGina - Open source Windows authentication

 

We also point the Macs in our ICT Room at the Google LDAP server, so this solution works for us accross Windows, Mac and ChromeOS. For our remote desktop server we're using Cloudflare's Zero Trust platform for authentication (using user's Google accounts), that can also handle logins (via SSH or VNC) for Raspberry Pis.

[TheHyperTechie]

You can use GCPW to authenticate windows with a Google account. This is what I use for about ~40+ windows devices running on Windows 11. Works very well, also uses SSO so users don't need to sign in separately to Gmail, or Google Drive.

 

I can't comment on any possible issues running it with an Intune setup though, as we use Google Windows Device Management (Basically their equivalent to Intune)

[TheHyperTechie]

A quick Google search for "Windows 11 web sign in" suggests this page:

 

https://learn.microsoft.com/en-us/windows/security/identity-protection/web-sign-in/?tabs=intune

 

That's seems to be a pretty good explanation - I see examples there pointing at Clever badges for login, I'm guessing Wonde and others would work in the same way.

 

Has anyone tried Web Sign In with USB 2FA keys? That was the issue we found with GCPW, it's walled off from USB access so it can't work with USB-based authentication, although mobile or other device authentication worked okay. A couple of previous threads discussing the issue:

 

https://www.edugeek.net/forums/cloud-services/232324-migrate-100-google-3.html#post2024282

 

We've wound up using pGina, pointing at Google's LDAP login server:

 

pGina - Open source Windows authentication

 

We also point the Macs in our ICT Room at the Google LDAP server, so this solution works for us accross Windows, Mac and ChromeOS. For our remote desktop server we're using Cloudflare's Zero Trust platform for authentication (using user's Google accounts), that can also handle logins (via SSH or VNC) for Raspberry Pis.

 

I would say this is one the biggest features they need to add for GCPW. Physical security keys... I would like to buy our staff a set of them, but having looked everywhere GCPW just doesn't seem to have this ability/feature. Standard 2FA works fine though, which I suppose is the main thing

[RLR]

We are mainly a Google School so I federated our Entra logins with Google. This means we can sign into Entra/Office using our Google accounts. This works well for signing into services on the web but has caused a few issues now that we are trying to move to InTune/Windows 11 that usually uses Entra to login with (we want to avoid going down the hybrid route).

 

I have setup Web Sign In for our Windows 11 devices that point to Google's Sign-in page to sign in which is working. I think Web Sign-in is still relativley new and sometimes doesn't sign-in - screen goes black as if it's about to sign in then goes back to the sign in page. I thought this might be something to do with Firewall or Google Sign-in but I get the same behaviour on hotspot and also signing in directly using an Entra only account.

 

The gPina option mentioned seems interesting. Does this work with MFA?

 

Edit: Just tested USB keys with web sign in and it doesn't work.

Edited April 26, 2024 by RLR

[dhicks]

The gPina option mentioned seems interesting. Does this work with MFA?

 

It authenticates against the Google LDAP server, skipping any 2FA step. We're using this on on-site, school-managed devices only, so similar to how many schools would have Entra ID Conditional Access set up to skip 2FA on managed devices. Unlike GCPW, pGina can't pass on any login cookies to Chrome, so the user then has to authenticate again (complete with any required 2FA step) when they are logged in to Windows and load up their web browser. In practice we've found that this works okay, users just have to authenticate twice when they first log in to a new PC.

 

Just tested USB keys with web sign in and it doesn't work.

 

I'm guessing (I think I read it somewhere) that Web Sign In uses the same login provider mechanism as GCPW, so it would have the same limitations.

[cooper]

Thanks for all the reply's, so it looks like this is not possible with GCPW.

 

Would Azure AD federation with Google Workspace be the best way to mange this?

 

If so does anyone here do this and have advise how to go about it.

[RLR]

Thanks for all the reply's, so it looks like this is not possible with GCPW.

 

Would Azure AD federation with Google Workspace be the best way to mange this?

 

If so does anyone here do this and have advise how to go about it.

 

I currently have this setup. It's a bit of a mission to get setup but does work. It's still a bit early for me to decide whether I recommend it or not. I used a mixture of these resources to get it setup:

https://support.google.com/a/answer/6363817

https://www.goldyarora.com/g-suite-to-office-365-sso/

https://docs.google.com/document/d/1wOND3TchK125QIFiFL19WaknVJ40WH0G8QpD91U9-0w/edit#

[dhicks]

I know this does not work with GCPW unless you have a onprem ad.

 

GCPW is a Windows Credentials Provider that uses Google logins to authenticate. It shouldn't need an on-premises Active Directory server to operate - kind of the point of it is that it uses Google's server for authentication, not a local server. If you have a large number of PCs to install GCPW on you might use a Group Policy to distribute GCPW, but other solutuions to that problem exist.

 

The limitation we found with GCPW was that it couldn't support 2FA via USB dongle. Otherwise, it worked very well on a variety of devices, both domain-joined and not.

[cooper]

GCPW is a Windows Credentials Provider that uses Google logins to authenticate. It shouldn't need an on-premises Active Directory server to operate - kind of the point of it is that it uses Google's server for authentication, not a local server. If you have a large number of PCs to install GCPW on you might use a Group Policy to distribute GCPW, but other solutuions to that problem exist.

 

The limitation we found with GCPW was that it couldn't support 2FA via USB dongle. Otherwise, it worked very well on a variety of devices, both domain-joined and not.

 

I agree, GCPW can function independently for signing in to Windows devices with a Google Workspace account. But, it has limited capabilities even with the paid version.

 

While GCPW allows logins on domain-joined devices, I have not been able to get this working with intune managed devices.

[XiJ]

My experience of web sign in for windows is it’s awful. Particularly with google accounts. We were looking at doing this very thing but abandoned it. It won’t remember 2FA on google accounts and unless you’re in a higher tier workspace education you can’t use ‘conditional access’.

 

Ultimately we want to move the school to Chromebooks for teachers (pupils are all Chromebook) but we’ve got to get over the hurdle of no smart notebook first. (And to a less extent MS office).

 

If we’d used 365 as the IDp and federated to google it would have worked okay. But for various (good) reasons the school didn’t want to go that route

 

It may work better when web sign in matures a bit. But in my opinion google and windows will never play too nice together.

[Primus]

My experience of web sign in for windows is it’s awful. Particularly with google accounts. We were looking at doing this very thing but abandoned it. It won’t remember 2FA on google accounts and unless you’re in a higher tier workspace education you can’t use ‘conditional access’.

 

Ultimately we want to move the school to Chromebooks for teachers (pupils are all Chromebook) but we’ve got to get over the hurdle of no smart notebook first. (And to a less extent MS office).

 

If we’d used 365 as the IDp and federated to google it would have worked okay. But for various (good) reasons the school didn’t want to go that route

 

It may work better when web sign in matures a bit. But in my opinion google and windows will never play too nice together.

 

If you can afford it, Lumio (Smart's online version of Notebook) works pretty well.