Set up third-party partner integrations

This feature is available with Cloud Identity Premium edition. Compare editions

As an administrator, you can integrate supported third-party partners (those that are part of the BeyondCorp Alliance) with Google endpoint management in Google Admin console. These integrations allow you to use unified endpoint management (UEM) providers and mobile threat defense services in conjunction with your Google Workspace, Cloud Identity, and Identity-Aware Proxy-protected Google Cloud services. After you create a connection and enable the service for an organizational unit, the third-party service can send details about the devices that you can review in the device inventory and use in Context-Aware Access rules.

Note: Google is not responsible for accuracy of device data generated by third-party partners. Data provided to Google by the third-party partner is stored as-is. Any inaccuracies or personally identifiable information (PII) reported by the third party partner are the sole responsibility of the partner.

When you create a connection to the third-party service, the service is available for all organizational units in your organization. However, the third-party service doesn't apply until you enable it for an organizational unit.

BeyondCorp Alliance Partners

Check Point
CrowdStrike
Jamf
Lookout
Microsoft Intune (desktop devices only)
Omnissa

Requirements

For mobile devices, set up basic mobile management or turn on advanced mobile management. If you're not sure which one to use, ask your third-party partner.
For computers, turn on endpoint verification.

Step 1: Connect to the BeyondCorp Alliance partner

Sign in to your Google Admin console.
Sign in using an account with super administrator privileges (does not end in @gmail.com).
In the Admin console, go to Menu DevicesMobile & endpointsSettingsThird-party integrations.
Click Security and MDM partnersManage.
In the row for the partner you want to connect to, click Open connection.
Complete the connection process in the partner's website when it opens:
- If you already have a subscription with that partner, the partner confirms the connection.
- If you don't have a subscription, you might be directed to set one up.
In your Admin console, close the Manage partner connections dialog to return to the setting page. The connected partner now appears in the list.

Step 2: Enable the partner's services for an organizational unit

Before you begin: If you need to set up a department or team for this setting, go to Add an organizational unit.

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu DevicesMobile & endpointsSettingsThird-party integrations.
Click Security and MDM partners.
(Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
Check the box for the partner whose service you want to enable. You can select more than one.
Click Save. Or, you might click Override for an organizational unit.
To later restore the inherited value, click Inherit.

The partner's service is now applied to accounts in the selected organizational unit.

Changes can take up to 24 hours but typically happen more quickly. Learn more

Step 3. Use service status data in context-aware access levels

Each service sends Google data about devices, which you can use to define context-aware access levels.

Note: For context-aware access levels based on third-party service status to apply to iOS device users, iOS users must be signed in to a Google app other than Chrome Browser (such as YouTube or Gmail) with their work or school account. Learn more

Find out what values the third-party service sends to Google by reviewing the service's documentation.
In the Google Cloud console, set up a custom access level based on the partner values. For instructions, see Creating a custom access level.
For the step when you enter Conditions, you enter a device.vendors attribute that corresponds to a status value. For example, device.vendors["some_vendor"].data["status_value"] == true, where some_vendor is the partner name (Checkpoint or Lookout) and status_value is the status key defined by the partner. For details, refer to the vendors section of this reference table.
Assign Context-Aware access levels to apps.

Troubleshoot a third-party service integration

If the integration doesn't work as expected, go through the following steps to identify the problem.

Expand section | Collapse all & go to top

1. Verify the connection from Google and from the partner

From Google

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu DevicesMobile & endpointsSettingsThird-party integrations.
Click Security and MDM partners.
Next to Partners, click Manage.
In the row for the partner, confirm that the available action is Close connection. If the action is Open connection, click it and follow the instructions in Step 1: Connect to the BeyondCorp Alliance partner.

From the partner

Review the partner's documentation and confirm that the partner service is ready for integration.

2. Make sure the user belongs to an organizational unit with the connection enabled

Make sure the connection is set up for the user. Connections are enabled by organizational unit and work only for users in organizational units that have the connection enabled.

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu DevicesMobile & endpointsSettingsThird-party integrations.
Click Security and MDM partners.
At the left, click the organizational unit the user belongs to.
Next to Security and MDM partners, review the app integrations enabled for that organizational unit.
If the integration isn't listed, click Security and MDM partners and check the box next to the partner. If the partner isn't listed, you must first open the connection. For instructions, see Step 1: Connect to the BeyondCorp Alliance partner.

3. Verify Google is getting the user's device data from the third-party service

Integration partners send data about a user's device to Google. You can confirm that Google is getting that data in your Admin console.

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu DevicesMobile & endpointsDevices.
Find the user's device. To filter the list, enter their email address in the search bar and add a filter by device type.
Click the device to open its details page.
Find the Third party services section. If you can't find it, then the partner connection might not be configured correctly. Review the first two troubleshooting steps.
Find the row for the partner service and confirm that the values for Health score, Managed state, and Compliance state aren't Unspecified. If the values aren't what you expect, contact the partner for support.

4. Verify the custom access level is defined correctly

In the Google Cloud console, go to the Access Context Manager.
Find the custom access level and confirm the following:
1. The conditions use the correct third-party name. This name is specified in the third-party documentation.
2. The conditions use a value that matches the value received from the third-party.

If these aren't correct, review how to use service status data in context-aware access levels.

5. Verify that the custom access level is applied to the correct Google Workspace service or Google Cloud resource

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu SecurityAccess and data controlContext-Aware Access.
Click Assign, then Assign access levels.
You see a list of apps.
Review which apps and services the custom access level is applied to.

(iOS devices only) Remove duplicate device entries caused by using BeyondCorp Alliance for third-party device reporting

In some cases, enrolling devices with a third-party service partner can result in duplicate entries for the same device in the Admin console. This in turn can cause Context-aware access rules to incorrectly block a managed device from accessing Google services.

Follow these steps to remove duplicate devices:

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu DirectoryUsers.
Locate the user of the duplicate device, then click the user name to open the User details page.
On the Security tab, click Connected applications.
Delete all listed applications.

On the user device:

Sign out from and remove all Google accounts.
In Safari, go to the web page for a Google service (for example, gmail.com), and verify that the user is not signed in.
Reinstall and sign in to a Google application, such as Gmail or Drive. (Don’t access a Google application through its web page on Safari.)
Context-aware access rules will block access to the Google app, and display a link to resolve the app blocking.
Click the remediation link, then follow steps to re-enroll the device to the service partner.
Close and reopen the Google service. Access should no longer be blocked.

Change third-party service integration settings