Google Workspace account in an Intune-managed Android work profile — "Account action required" loops and Drive won't load. Supported or not?

Question

Google Workspace account in an Intune-managed Android work profile — "Account action required" loops and Drive won't load. Supported or not?

Mike Randall 0

We run Microsoft 365/Intune for device management and Google Workspace (a managed Google domain) for productivity, with Entra as IdP (OIDC SSO into Google). On a personally-owned Android Enterprise work profile enrolled in Intune, we want users to use the native Google apps (Drive, Gmail, Chrome) signed in with their Workspace account.

The account can be added to the work profile (work-profile device restriction "Add and remove accounts = Allow all account types" with a domain allow-list), and sign-in completes via the Microsoft SSO redirect. But the account never reaches a working state:

Google Play services shows a persistent "Account action required" notification (~every 15 min). Tapping it shows "Checking info...", opens the Company Portal, and resolves nothing.
- Chrome shows "verify that it's you" that won't clear.
- Google Drive opens but lists no files.

Already done:

Managed Google Play binding is a managed Google domain; the work profile contains a synthetic managed-Play account plus the Microsoft work account.
Google endpoint management (GEM) set to Unmanaged for the users' OU.
Entra-to-Google OIDC SSO configured and assigned; sign-in correctly redirects to Microsoft.
Google 2-Step Verification turned off.
Deleted all stale Google Mobile-device records, rebooted, re-added the account — this silenced the notification temporarily, but it returns on the next sync.
"Authenticate using Google" is enabled on the Intune EMM binding.

Question: Is using a managed-domain Workspace account natively (Drive/Gmail) inside an Intune (third-party EMM) Android work profile supported? If yes, what is the exact required configuration? If not, is the official guidance to use the browser for Workspace, or to manage these devices with Google's own Advanced management instead?

0 comments

1 answer

Your answer

Answer 1

Using a managed-domain Google Workspace account natively (Drive, Gmail, Chrome) inside an Intune-managed Android Enterprise work profile is not documented or guaranteed as a supported scenario in the provided material.

The available guidance for Android Enterprise work profiles with Intune focuses on:

Separating work and personal data via the Android Enterprise work profile, with Intune managing the work side only.
Requiring a Managed Google Play connection for app and device management.
Using app configuration and app protection policies for supported apps (including email clients like Gmail and Nine Work) when they are managed via Managed Google Play and Intune.

From the context:

Android Enterprise work profile management in Intune requires connecting the Intune tenant to a Managed Google Play account and managing apps through that channel, including email apps such as Gmail and Nine Work that support managed configuration.
The documentation explicitly calls out that Android Enterprise does not provide a default email app or native email profile, and that email must be configured via app configuration for supported apps like Gmail, Nine Work, or Outlook.
The focus is on Intune’s MDM and MAM capabilities (work profiles, app configuration, and app protection policies), not on mixed management scenarios where Google Workspace itself is also trying to manage the same devices or accounts.

The context does not describe or endorse a configuration where:

A Google Workspace managed-domain account is used natively in Google apps inside a work profile that is fully managed by a third-party EMM (Intune),
While Google endpoint management is set to Unmanaged, and
Entra ID is used as IdP for Google via OIDC SSO.

Because this scenario is not covered, there is no documented “exact required configuration” for making such a combination fully supported and reliable. Likewise, there is no explicit statement in the provided content that this is supported.

The documented guidance instead is:

Use Android Enterprise personally-owned work profiles with Intune when MDM activities are required (certificate deployment, app push, etc.).
Use Intune app protection policies (MAM) to protect organizational data within applications, including Office apps, and optionally disable multi-identity behavior via app configuration.
Use Gmail or Nine Work as managed email clients via Intune app configuration when using Exchange ActiveSync or modern-auth apps like Outlook for Android.

Given the available documentation, the supported and recommended patterns in this context are:

Manage Android Enterprise work profiles with Intune and use apps that are deployed and configured via Managed Google Play and Intune app configuration/app protection policies.
For BYOD scenarios where Google services are unavailable or Android Enterprise work profiles are not feasible, rely on Intune app protection policies (MAM) without device enrollment.

The context does not provide official guidance to:

Use Google Workspace native apps with a managed-domain account inside an Intune-managed work profile as a fully supported scenario, or
Prefer Google’s own device management (Advanced management) over Intune in such a mixed environment.

Therefore, based on the provided material, the scenario described (managed-domain Workspace account natively in Google apps inside an Intune-managed work profile, with Entra SSO) cannot be confirmed as supported, and no official configuration steps are available here. The documented and supported approach is to use Intune’s Android Enterprise work profile management and app/MAM capabilities as described, and to select email and productivity apps that are explicitly supported and configurable via Intune.

References: