Page Summary

outlined_flag

• Enterprise resources link an organization to your EMM, and there are two types: managed Google Play Accounts enterprises and managed Google domain enterprises.

• Binding enterprises to a managed Google domain is the recommended and default approach for EMMs using the Android Management API due to enhanced security and manageability benefits for IT admins and simplified user logins.

• Enterprises created with a Gmail account can be upgraded to a managed Google domain enterprise through either an EMM-initiated flow using APIs or an iframe-initiated flow within the managed Google Play iframe.

• EMMs should use Pub/Sub notifications to receive alerts when an enterprise is upgraded, allowing them to update relevant information and remove upgrade messaging in their console.

• Upon successful upgrade, the enterprise type will be MANAGED_GOOGLE_DOMAIN, the enterprise ID remains the same, and the enterpriseDisplayName is updated to reflect the managed Google domain name.

AnEnterprise resource binds an organization to your EMM. Multipleenterprise bindings can be associated with a single organization to facilitatetest and QA EMM environments, or separate regional EMM implementations.

Bindings can be of two different types:

• A managed Google Play Accounts enterprise, which is created by an IT adminusing a Gmail account.
• A managed Google domain enterprise, which is created by an IT admin usingtheir work email (as part of the new recommended signup flow).

Binding enterprises to a managed Google domain is now the default for EMMs usingAndroid Management API and is strongly encouraged.

The benefits of using a managed Google domain for an IT admin include:

• Better security and manageability for the IT admin credentials when logging inusing a work address versus a Gmail account.
• Multiple EMM instances can be bound and managed from the same managed Googledomain.
• Multiple Google products and services can be managed with the same IT adminlogin.
• Account recovery is simpler for both admin and user accounts on a managedGoogle domain.

For users, having enterprises bound to a managed Google domain providesseveral advantages, including:

• Simplifies user login by allowing users to login with their work email onAndroid devices.
• Allows additional services including SSO, Google Workspace andGemini on managed devices.
• Enables cross device experiences including Chrome Sync, sharing files acrossdevices, transferring meetings between devices and more.

This guide describes how to upgrade a managed Google Play Accounts enterprise(created with a Gmail account) to a managed Google domain enterprise.

Types of upgrades

There are two mechanisms with which to upgrade a managed Google Play Accountsenterprise.

• EMM-initiated: EMMs use APIs to query the binding type, and provide a way foran IT admin to start the upgrade for eligible bindings using a button or asimilar UX element directly from their console.
• Managed Google Play iframe-initiated: organization IT admins can start theupgrade process from themanaged Google Play iframe.

Guidance for EMMs

The following steps are highly recommended for EMMs, in order to recognize whenan upgrade happens, support EMM-initiated and iframe-initiated upgrades, andpresent the updated enterprise information to the IT admin.

1. Set up Pub/Sub notifications

It is highly recommended to sign up for Pub/Sub notifications to receive analert when an enterprise is upgraded. Subscribe toEnterpriseUpgradeEvent with the enterprise ID of every bound organizationenterprise to watch for upgrade events. Look forUPGRADE_STATE_SUCCEEDEDto indicate a successful upgrade.

Since upgrades can happen using both the EMM-initiated flow andthe managedGoogle Play iframe, Pub/Sub notifications allow EMMs to monitor both methodsand take actions that could include:

• Updating the contact email in their UI, based onContactInfo from thenewly upgraded enterprise.
• Removing messaging that prompts IT admins to upgrade, once the upgrade iscomplete.

The same Pub/Sub notification is used for EMM-initiated upgrades as well asiframe-initiated upgrades.

2. Upgrade methods

EMM-initiated upgrade flow

EMMs are strongly encouraged to implement the EMM-initiated flow. IT admins thatinitiate an upgrade using this flow (typically from an EMM console) will beredirected to a URL that provides a similar upgrade experience to theiframe-initiated flow, however the IT admin willnot be prompted to login totheir existing Gmail account. This shortens and simplifies the upgrade processand also provides an upgrade option for customers that don't have access to theGmail account originally used to bind the enterprise.

• The first step in the upgrade process is to determine the enterprise type, andwhether that enterprise is eligible for upgrade. To determine the enterprisetype, callenterprises.get, and receive"enterpriseType":enum(EnterpriseType). Enterprises of typeMANAGED_GOOGLE_PLAY_ACCOUNTS_ENTERPRISE are eligible for upgrade.Enterprises of typeMANAGED_GOOGLE_DOMAIN have either been upgraded, orwere created using a work email and thus are not eligible for upgrade.
• For eligible enterprises generate an enterprise upgrade URL usingenterprises.generateEnterpriseUpgradeURL.
• After generating the upgrade URL, implement a button (or similarUI element) that embeds the URL which IT admins will use to initiate theupgrade process. This button or similar element should only be shown forenterprises that are eligible for upgrade.
• It is recommended to provide guidance to the IT admin, explaining theupgrade process and encouraging customers to upgrade. Refer to(or link directly to) thishelp center article for customer facinginformation on upgrades.

# Enterprise nameenterprise_name='enterprises/LC00oi5b1l'# Gets enterprise typeresponse=androidmanagement.enterprises().get(name=enterprise_name,).execute()enterprise_type=response['enterpriseType']# Generates an enterprise upgrade URL if the enterprise is a managed Google Play Accounts enterpriseif(enterprise_type=='MANAGED_GOOGLE_PLAY_ACCOUNTS_ENTERPRISE'):response=androidmanagement.enterprises().generateEnterpriseUpgradeUrl(name=enterprise_name,).execute()print(response['url'])

EMMs should be familiar with the flow that IT admins will encounter wheninitiating an upgrade from themanaged Google Play iframe:

• IT admins will encounter a banner on the top of the iframe for managed GooglePlay enterprises notifying them that they are eligible to upgrade to a managedGoogle domain. The IT admin has the opportunity to initiate the upgrade, orclose the banner to delay the notification. If closed, the banner will reappearafter 30 days.

• If an IT admin elects to begin the upgrade they will be prompted to sign inwith their existingmanaged Google Play Accounts enterprise owner account(typically the Gmail address used to originally bind the enterprise). This stepconfirms the admin has rights to initiate the upgrade for this managedGoogle Play Accounts enterprise binding.

• Upon successful login, the admin will be prompted to provide their workemail. If they are already an admin of a managed Google domain with sufficientprivileges, they will be able to use that account to finish the upgrade steps.If there isn't already a domain verified managed Google Domain for that companyname, the IT admin will be guided to create one.

• Upon successful login, or completion of the steps to create a managed Googledomain admin account, the IT admin will be prompted to confirm their intent toupgrade to a managed Google domain. Completion of this step will result in asuccess screen and the admin can visit ahelp center article or log intothe Googleadmin console.

3. After successful upgrade

Upon receiving a Pub/Sub notification of an enterprise upgrade, you canoptionally callenterprises.get to confirm the binding type to beMANAGED_GOOGLE_DOMAIN. The enterprise ID remains the same as it was priorto the upgrade.

After upgrade, EMMs should remove any messaging shown in their consoleencouraging users to upgrade this enterprise.

Theenterprise fieldenterpriseDisplayName will be changed uponupgrade to reflect the name of the managed Google domain.