Require admin approval for device access

Supported editions for this feature: Frontline Starter, Frontline Standard, and Frontline Plus; Business Plus; Enterprise Standard and Enterprise Plus; Education Standard, Education Plus, and Endpoint Education Upgrade; Enterprise Essentials and Enterprise Essentials Plus; G Suite Basic and G Suite Business; Cloud Identity Premium. Compare your edition

As an administrator, you can individually review user-owned devices that request access to a work or school account. When a user adds a work or school account to their device, they see a message that an admin needs to review and approve the device. Once you approve a device, the user can access their work account data on the device.

Device requirements

• Android and iOS devices—advanced mobile management
• Computers and laptops—any one of the following:
  • Endpoint verification
  • Fundamental management with Chrome signals sharing turned on
  • Google Drive for desktop

Important device approval behaviors

• Some company owned devices are automatically approved and aren't blocked when you require admin approval:
  • Company owned devices that are registered by serial number are automatically approved, except Android devices with a work profile. Learn more
  • For devices with Google Drive for desktop, if you restrict Drive for desktop to authorized devices, company-owned devices with Drive for desktop are automatically approved.
• If you set up a Wi-Fi network in the Google Admin console, iPhones and iPads can use that network while approval is pending. For details on setting up or changing your Wi-Fi network, see Set up networks for managed devices (Wi-Fi, Ethernet, VPN).
• For endpoint verification devices, Drive for desktop is blocked while approval is pending. Devices using Drive for desktop without endpoint verification are approved by default. To limit access to work data on unapproved devices, configure access levels using Context-Aware Access, or restrict Drive for desktop to company-owned devices. For details, go to Approve, block, unblock, or delete a managed device.

Turn on admin approval for device access

Before you begin: If you need to set up a department or team for this setting, go to Add an organizational unit.

1. In the Google Admin console, go to Menu Devices Mobile & endpoints Settings Universal.

   Go to Universal

   Requires having the Mobile Device Management administrator privilege.

2. Click Security Device approvals.
3. (Optional) To apply the setting to a department or team, at the side, select an organizational unit.
4. Check the Require admin approval box.

5. Enter an email address to get notifications when users enroll their devices and require approval before they can access their work data.

   Tip: Instead of an individual email address, use a group email address that includes all administrators who can approve devices.

6. Click Save. Or, you might click Override for an organizational unit.

   To later restore the inherited value, click Inherit.

Approve mobile devices

Approve mobile devices for management individually, or set up a rule to automatically approve devices.

Related topic

Approve, block, unblock, or delete a managed device

Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.