Upgrade an enterprise

An Enterprise resource binds an organization to your EMM. Multiple enterprise bindings can be associated with a single organization to facilitate test and QA EMM environments, or separate regional EMM implementations.

Bindings can be of two different types:

• A managed Google Play accounts enterprise, which is created by an IT admin using a Gmail account.
• A managed Google domain enterprise, which is created by an IT admin using their work email (as part of the new recommended signup flow).

Binding enterprises to a managed Google domain is now the default for AMAPI EMMs and is strongly encouraged.

The benefits of using a managed Google domain for an IT admin include:

• Better security and manageability for the IT admin credentials when logging in using a work address versus a Gmail account.
• Multiple EMM instances can be bound and managed from the same managed Google domain.
• Multiple Google products and services can be managed with the same IT admin login.
• Account recovery is simpler for both admin and user accounts on a managed Google domain.

For users, having enterprises bound to a managed Google domain provides several advantages, including:

• Simplifies user login by allowing users to login with their work email on Android devices.
• Allows additional services including SSO, Google Workspace and Gemini on managed devices.
• Enables cross device experiences including Chrome Sync, sharing files across devices, transferring meetings between devices and more.

This guide describes how to upgrade a managed Google Play accounts enterprise (created with a Gmail account) to a managed Google domain enterprise.

Types of upgrades

There are two mechanisms with which to upgrade a managed Google Play accounts enterprise.

• Managed Google Play iframe-initiated: Organization IT admins can start the upgrade process from the managed Google Play iframe.
• EMM-initiated: not available yet.

Guidance for EMMs

The following steps are highly recommended for EMMs, in order to recognize when an upgrade happens, and present the updated enterprise information to the IT admin.

1. Set up Pub/Sub notifications

It is highly recommended to sign up for Pub/Sub notifications to receive an alert when an enterprise is upgraded. Since upgrades can happen in the managed Google Play iframe, they can happen independently of actions taken in the EMM console, so EMMs should be prepared that upgrades can happen at any time. The same Pub/Sub notification is used for iframe-initiated upgrades as well as EMM initiated upgrades (which are not yet available).

EMMs should subscribe to EnterpriseUpgradeEvent for upgrade events. See the pub/sub notification setup guideline for more information. Look for UPGRADE_STATE_SUCCEEDED to indicate a successful upgrade.

2. Determine enterprise type

EnterpriseType is changed after an enterprise is upgraded. To determine the enterprise type, call enterprises.get, and receive "enterpriseType": enum(EnterpriseType). The type is MANAGED_GOOGLE_PLAY_ACCOUNTS_ENTERPRISE before the upgrade and is MANAGED_GOOGLE_DOMAIN after the upgrade.

3. Iframe-initiated upgrade flow

EMMs should be familiar with the flow that IT admins will encounter when initiating an upgrade from the managed Google Play iframe:

• IT admins will encounter a banner on the top of the iframe for managed Google Play enterprises notifying them that they are eligible to upgrade to a managed Google domain. The IT admin has the opportunity to initiate the upgrade, or close the banner to delay the notification. If closed, the banner will reappear after 30 days.

• If an IT admin elects to begin the upgrade they will be prompted to sign in with their existing managed Google Play accounts enterprise owner account (typically the Gmail address used to originally bind the enterprise). This step confirms the admin has rights to initiate the upgrade for this managed Google Play accounts enterprise binding.

• Upon successful login, the admin will be prompted to provide their work email. If they are already an admin of a managed Google domain with sufficient privileges, they will be able to use that account to finish the upgrade steps. If there isn't already a domain verified managed Google Domain for that company name, the IT admin will be guided to create one.

Note: The managed Google domain created by this step will be an email-verified team. Later the IT admin will want to verify the domain using DNS in order to unlock the full capabilities of the managed Google domain.

• Upon successful login, or completion of the steps to create a managed Google domain admin account, the IT admin will be prompted to confirm their intent to upgrade to a managed Google domain. Completion of this step will result in a success screen and the admin can visit a help center article or log into the Google admin console.

4. After successful upgrade

Upon receiving a Pub/Sub notification of an enterprise upgrade, you can optionally call enterprises.get to confirm the binding type to be MANAGED_GOOGLE_DOMAIN. The enterprise ID remains the same as it was prior to the upgrade.

After upgrade, EMMs should remove any messaging shown in their console encouraging users to upgrade this enterprise.

The enterprise field enterpriseDisplayName will be changed upon upgrade to reflect the name of the managed Google domain.

Note: The ContactInfo for the previously associated binding (Gmail address, Data Protection Officer, EU Representative, etc) is deleted upon successful upgrade. If the organization wishes to update this information, it must be done in the admin console of the now associated managed Google domain.