Manage android phone

[steveg]

We have a few staff android phones that I want to fully manage through our google admin portal. (Very new to google admin)

 

I am trying to import them as company owned devices but when I try and import I only get the option of Mac, Windows, Desktop Chrome OS or Linux as device type, not android? Have I missed something somewhere?

 

I can sort of get them managed by using a managed google account on them, but this still gives too much freedom on the device.

 

[Oaktech]

We have a few staff android phones that I want to fully manage through our google admin portal. (Very new to google admin)

 

I am trying to import them as company owned devices but when I try and import I only get the option of Mac, Windows, Desktop Chrome OS or Linux as device type, not android? Have I missed something somewhere?

 

I can sort of get them managed by using a managed google account on them, but this still gives too much freedom on the device.

 

[ATTACH=CONFIG]67885[/ATTACH]

 

I believe a Google partner has to add them to company inventory, you have to purchase through them to do it, and pay a premium for it. We just have heavilly restricted accounts with a restricted play store and remove the ability to add other accounts.

[Arthur]

I am trying to import them as company owned devices but when I try and import I only get the option of Mac, Windows, Desktop Chrome OS or Linux as device type, not android? Have I missed something somewhere?

Which version of Google Workspace do you have? You need one of the following to be able to manage Android devices.

 

https://support.google.com/a/answer/7129612

 

Supported editions for this feature: Business Plus; Enterprise; Education Standard and Education Plus; G Suite Business; Cloud Identity Premium.

 

 

Edited January 27, 2023 by Arthur

[Arthur]

I believe a Google partner has to add them to company inventory, you have to purchase through them to do it, and pay a premium for it.

I get the option to import Android devices via a CSV containing just the serial number and an optional asset tag.

[Oaktech]

I'm told by my Chromebook reseller that if you don't have a paid for Workspace, buying through a partner is the workaround for importing Android devices.

[TwistedHelixis]

We have the free educational fundamentals and can control (import) the Android devices using the advanced MDM in Workspace.

 

Not at my computer, but from memory....

 

I have device approvals set to always on. If someone logs in on an android device I get a request to allow this process to proceed. When allowed, the device gets added to our work devices list and the work profile is added.

 

You can also create a work apps list and remove the full Google Apps store, its under the apps section in Google workspace.

 

This is all stuff I have discovered over the past few days.

Edited January 27, 2023 by TwistedHelixis

[steveg]

We have the free educational fundamentals and can control (import) the Android devices using the advanced MDM in Workspace.

 

Not at my computer, but from memory....

 

I have device approvals set to always on. If someone logs in on an android device I get a request to allow this process to proceed. When allowed, the device gets added to our work devices list and the work profile is added.

 

You can also create a work apps list and remove the full Google Apps store, its under the apps section in Google workspace.

 

This is all stuff I have discovered over the past few days.

 

This sounds sort of like what happens here. I get the device to show in Mobile and Endpoints, Devices when I have logged into a google managed account on them and can push some things out to it, but I cannot make it a company owned device. From what others have said it seems like I need a paid subscription to make them company owned (or buy them through an approved reseller, which is a bit late now!)

[Frazer]

I have just been through this process, however we are using Microsoft's InTune as the MDM rather than Google's MDM - the process should be adaptable for Google's MDM.

You will probably want to go through the "zero touch" solution as this gives you a fairly automated setup from factory reset and a fully managed device. Similar to Apple's school manager solution.

 

1. Zero Touch Setup

If this is your first purchase/registration, ask your reseller to create a Android zero-touch account and add the recently purchases devices to this account - this is a free service that lets you allocate the devices to your chosen paid MDM.

You can use a personalised (non-shared) G Suite/Workspace accounts to manage this portal in the future, however they must have the 'Partner Dash' service enabled for their OU or security group in the Google admin portal.

https://partner.android.com/zerotouch - only available for you to access after the reseller as created your account.

 

2. Zero Touch Deployment

Part of the InTune setup documentation takes you through creating a new zero touch configuration profile (on the zero touch portal) depending on the type of device you will use and which MDM you want to assign them to.

You then assign this configuration profile to each device - corporate owned shared use, corporate owned single user, personal owned with corporate apps etc.

 

3. App management

For InTune MDM to manage apps from Google Play Work you have to create a user that is not attached to Google Workspace. Some MDM's are able to bypass this restriction using service accounts, Google's own MDM may integrate better.

We use Office 365 for email and have @school.county.sch.uk and @school.onmicrosoft.com available for email addresses. @school.county.sch.uk is used with Workspace, so we created a [email protected] shared mailbox and added it to our mailboxes.

At the InTune Android enrollment page, I clicked the link to connect to Google Play Work store and as part of the connection process, created a new Google account using the shared mailbox email address.

This becomes the account that will approve free apps in the Google Play Work store and also be used to synchronise those free apps into InTune.

Currently, Paid apps need to be obtained from the developer and uploaded as a custom app.