Environment: Microsoft Intune manages Android Enterprise personally-owned work profiles. Identity and productivity is Google Workspace on a managed Google domain. Authentication is federated with Microsoft Entra (OIDC SSO).
Goal: users use native Google Drive/Gmail in the work profile, signed in with their Workspace account.
Symptom: the Workspace account can be added to the work profile (device restriction "Add and remove accounts = Allow all account types" + domain allow-list) and sign-in completes via the Entra redirect, but it never becomes functional:
- Google Play services raises a recurring "Account action required" notification that taps through to Company Portal and resolves nothing;
- Chrome "verify that it's you" never clears;
- Google Drive opens but returns no files.
Ruled out: GEM set to Unmanaged for the OU; OIDC SSO assigned and working; Google 2-Step Verification disabled; "Authenticate using Google" enabled on the EMM binding; all stale Google Mobile-device records deleted and the account re-added (silences it only until the next sync); no Context-Aware Access (not on our edition).
Questions:
Is this configuration supported?
If so, what is the required settings to make a managed-domain Workspace account function natively in an Intune-managed work profile?
If it is not supported - i.e. a managed-domain account requires Google's own Android Device Policy (Advanced management) to be the work-profile controller - a citation or authoritative confirmation would be ideal.
I'm trying to determine definitively whether to (a) keep the Intune work profile and access Workspace via browser only, or (b) move these devices to Google's own management.