This guide applies to Android devices
Prerequisites
Before you begin, ensure you have:- Company-owned devices in factory reset state for enrollment
- Android 14 and higher
If the integration is connected with an individual Google account, you can upgrade it to a managed Google domain later without re-enrolling devices.
Enable Third-Party Android Mobile Management in Google Workspace
Complete these steps when you use your organization’s managed Google domain.1
Sign in to Google Admin console
In a web browser, use your organization’s super administrator account to sign in to your organization’s Google Admin console at admin.google.com.
2
Open Third-party integrations
Go to Devices → Mobile & endpoints → Settings → Third-party integrations.
3
Select organization unit and Android EMM
Select the related organization unit, then select the Android EMM block.
4
Enable and save
Check the box for Enable third-party Android mobile management, then select SAVE.
Enable Android Platform
Turn on Android on the Endpoint tab of the Organization page. Only the Account Owner can change platforms. You can turn on Windows at the same time. See Windows Setup.Configure Android Enterprise
Only the Account Owner can configure Android Enterprise. See Team Member Role Permissions for roles and permissions.
1
Open Integrations
In the sidebar, select the Account Menu Button, then select Integrations.
2
Select Android
Under Platform integrations, select Android.
3
Configure Android Enterprise
Select Configure Android Enterprise.
4
Enter integration name
Enter a name for your Android Enterprise integration.
5
Sign in with Google
Select Continue with Google and sign in. We recommend using a super administrator account on your organization’s managed Google domain. You can complete the initial setup with an individual Google account and upgrade the integration to a managed Google domain later. Select Next when prompted. Your Iru Endpoint admin email may be pre-filled.
6
Allow device management
Select Allow to allow Iru Endpoint to manage your Android devices.
7
Configure work profile sign-in
Choose how users sign in to the work profile. Select Enable to allow users to sign in with their managed Google Account during enrollment. Users can skip that step. Select Skip to set up the work profile without that sign-in.A device without a managed Google Account uses an anonymous managed Google Play account. To require sign-in after enrollment, use Require sign-in with managed Google Account in the Android Restrictions Library Item.
8
Return to Integrations page
You will be redirected back to the Integrations → Platform integrations → Android page.
9
Verify integration
Verify that the Android Enterprise integration is active and configured.
If you signed in with your organization’s managed Google domain, keep a note of the Enterprise ID. You use it when you select the EMM provider in Set EMM in Google Workspace. If you signed in with an individual Google account, skip that section.
Set EMM in Google Workspace
Complete this section when the integration uses your organization’s managed Google domain. Return to Google Workspace and select the EMM that matches the Enterprise ID shown in Iru. This links your Google organization to the Iru Endpoint Android integration. If you connected the integration with an individual Google account, skip this section. You can upgrade to a managed Google domain later, then return here to select the EMM.1
Sign in to Google Admin console
In a web browser, use your organization’s super administrator account to sign in to your organization’s Google Admin console at admin.google.com.
2
Open Third-party integrations
Go to Devices → Mobile & endpoints → Settings → Third-party integrations.
3
Select organization unit and Android EMM
Select the related organization unit, then select the Android EMM block.
4
Select the EMM that matches Iru
Enable third-party Android mobile management if not already enabled, then select the EMM that matches the Enterprise ID from your Iru Endpoint Android integration.
5
Save
Select SAVE.
Upgrade to a Managed Google Domain
The Android Enterprise integration page shows one tag next to the connection name: Managed Google Play account or Managed Google domain. Managed Google Play account means the integration was set up with an individual Google account, such as a Gmail address. Android management depends on that one person’s sign-in. Managed Google domain means the integration belongs to your organization’s managed Google domain. If the tag is Managed Google Play account, upgrade the integration to your organization’s managed Google domain. The Enterprise ID does not change, so enrolled devices, policies, and Blueprint assignments stay in place. Devices do not need to re-enroll, and the connection name does not change. The upgrade is permanent. Google does not provide a way to switch the integration back to a Managed Google Play account. While the integration can be upgraded, a banner appears on the Enrollment, Integrations, and Android integration pages. You can dismiss the banner on the Enrollment page, and that dismissal is permanent. The other banners stay until the upgrade finishes. Upgrade to managed Google domain stays on the Android Enterprise card even after you dismiss the Enrollment banner. This upgrade changes who owns the integration. To require users to sign in to a managed Google Account on their devices, see Require sign-in with managed Google Account.Only a role that can set up the Android Enterprise integration can see or start the upgrade. See Team Member Role Permissions.
1
Open the upgrade
Select the upgrade banner, or go to Integrations → Platform integrations → Android and select Upgrade to managed Google domain.
2
Enter the super admin email
In Enter information, enter the email of a super administrator on the managed Google domain. The domain of this email is the only domain the upgrade can complete in. For example,
admin@corp.acme.com upgrades into corp.acme.com. Personal email domains such as gmail.com are not accepted.Iru uses this email to pre-fill Google’s sign-in form. Iru does not record it as the person who performed the upgrade. If the address is mistyped, Google blocks the upgrade. You can try again with the corrected address.If your organization does not have a managed Google domain yet, you can create one during Google’s upgrade flow. See Upgrade to a managed Google domain.3
Continue with Google
Select Continue with Google. Google’s upgrade page opens in a new tab. Sign in and complete the upgrade there.The integration page shows Upgrading to your managed Google domain while the upgrade is in progress. If the page still shows that status after you finish on Google, select Check status.
4
Confirm the result
When Google confirms the upgrade, Iru updates the integration page and removes the banners and Upgrade to managed Google domain.If the upgrade does not finish, the integration is unchanged and enrolled devices stay managed. Select Try again.
Domain shown after the upgrade
After the upgrade, the tag shows the domain from the email you entered in Iru. Iru can also detect an upgrade you start from Google’s managed Google Play iframe, and updates the integration page the same way. In that case, and when the integration used a managed Google domain from the start, the tag shows Managed Google domain without a domain. You can record the domain once on the Android Enterprise integration page. You confirm it twice before it saves. After that, it cannot be changed, and Iru does not verify it with Google.Disconnecting Android Enterprise
Disconnect the Android Enterprise integration from Iru Endpoint. Iru coordinates the EMM binding cleanup with Google when you disconnect.1
Delete Android device records (if applicable)
If you are removing management from enrolled devices, delete each Android device record from Iru Endpoint first. See Deleting a Device Record and Uninstalling Iru Endpoint.
2
Open Integrations
In the sidebar, select the Account Menu Button, then select Integrations.
3
Select Android
Under Platform integrations, select Android.
4
Disconnect Android Enterprise
Select Disconnect.
Only the Account Owner can disconnect the Android Enterprise integration. See Team Member Role Permissions.
Android Management Requirements
Before enrolling Android devices, ensure you have completed the Prerequisites above and have:- Android Enterprise configured in Iru Endpoint (completed in this guide).
- Blueprint configured for Android devices.
- (Recommended) Single sign-on (SSO) configured for secure authentication.
Android Management Capabilities
Iru Endpoint provides the following Android management features:- Work profile management for company-owned devices.
- Application deployment and management.
- Policy enforcement and compliance monitoring.
- Security configuration and updates.
- Device inventory and reporting.
Considerations
- Account Owner required: Only the Account Owner can configure Android Enterprise.
- Google Admin access: You need access to the Google Admin console when the integration uses a managed Google domain.
- Factory reset required: Devices must be in factory reset state for enrollment.
- Work profile only: Iru Endpoint supports company-owned work profile management.
- Disconnect through Iru: Select Disconnect on the Android Enterprise integration in Iru Endpoint, not in Google Admin. See Disconnecting Android Enterprise.
- Managed Google Play account: An integration connected with an individual Google account can be moved to a managed Google domain without re-enrolling devices. See Upgrade to a Managed Google Domain.
Next Steps
After configuring Android Enterprise:1
Configure Blueprints and Library
Create and configure Blueprints so policies and apps are ready before enrollment. See Configuring Blueprints and Managing Library.
2
Enable other platforms (optional)
To manage Apple devices or Windows computers as well, see Apple Setup or Windows Setup.
3
Set up enrollment for each platform
Once Blueprints are configured, set up enrollment: Android Enrollment, Apple Enrollment, or Windows Enrollment.