Integration Guide for Google Workspace MDM

Introduction

This document describes how to integrate Google Workspace-managed Android devices with Beyond Identity. 

Prerequisites

Licensing Requirements

• Google Workspace SKUs and Features required:
  • Frontline Standard
  • Business Plus
  • Enterprise (Standard and Plus)
  • Education (Standard and Plus)
  • G Suite Business
  • Cloud Identity Premium

• Beyond Identity SKUs and Features required:
  • Included with Beyond Identity Secure Workforce version 2.93 or greater

Role/Access Requirements

• Google Workspace Role/Access Requirements:
  • Mobile Device Management administrator privilege.
    
    
• Beyond Identity Role/Access Requirements: 
  • User with a minimum role of ‘Integrations Administrators’ for adding and configuring integrations 
  • User with a minimum role of ‘Policy Administrators’ for configuring policy

Supported Operating Systems

This integration supports Android-managed devices only. 

Integrating Google Workspace MDM

Enable the integration in Beyond Identity

1. In the Beyond Identity Admin console, select Integrations. 
2. Click the Endpoint Management tab.
   
3. Click the download icon to the right of Google Workspace to open the following dialog.
   
4. Enter the Google customer ID in the Customer ID field. You can locate this ID at: 
   https://admin.google.com/ac/accountsettings/profile
5. Click Save Changes. A Management ID will be created. 
6. On the Integrations page, click the Edit icon beside Google Workspace. 
7. On the Edit Workspace dialog, copy the generated value for the Management ID. You will use this ID in the next series of steps.
   
   
   

Set up Android apps with managed configurations

1. Open the Google Admin console.
2. Set up advanced mobile management for Android. For more information, see https://support.google.com/a/answer/7396025?sjid=352884471689974985-NA&visit_id=638406830667714017-2452226857&rd=1
3. Add the Beyond Identity app.

   1. Select Apps > Web and mobile apps.
      

   2. Click Add app and select Search for apps.
      

   3. Type "Beyond Identity" in the search and select the user access options.
      

   4. Click Continue and complete the settings.

   5. Click Finish. The following page is displayed. 
      

4. Add the Management ID from the Beyond Identity to the managed configurations. This management ID is read from the device, and if it matches the one stored in Beyond Identity, the device is considered to be managed. 
   1. Under Managed configurations (shown in the image above), click Add managed configuration.
   2. On the Edit managed configuration page that displays, paste the Management ID you copied from the Beyond Identity Admin console in the Google MDM Management ID field. 
      
   3. Click Save. 
5. Assign a managed configuration to an organizational unit or group:
   1. In the Google Admin console, navigate to Apps > Web and mobile apps.
   2. Click Beyond Identity. 
      
   3. Click Settings. 
      
   4. In the left nav bar under Search for organizational units > Beyond Identity, click the organization unit or group to which you want to assign a managed configuration. 
   5. In the right pane, select the managed configuration you want to apply from the drop-down list. 
   6. Click Save. 
6. Push the app to managed Android devices. 
   
   

Add a policy rule for this integration

You can add a policy rule to determine whether Android devices are managed in Google Workspace. 

1. In the Beyond Identity Admin console, select Policy. 
2. Click Edit Policy. 
   
3. Click Add rule. 
4. (Optional) Enter a rule name and description. 
5. Beside Any Integration, click Add attribute.
6. Select Google Workspace from the drop-down and then select either Managed or Not Managed for the Android devices. 
   
7. Click Add. 
8. Click Publish changes.