Google BeyondCorp Configuration

5 min

Integrate Ivanti EPMM with Google BeyondCorp for conditional access. Ivanti EPMM sends the device compliance status signal to Google BeyondCorp, and this ensures that only compliant devices under Ivanti EPMM can access Google Workspace applications.

Prerequisites

For Ivanti EPMM, you must have an Ivanti Professional Plus or Premium license.

For Google, you must have the BeyondCorp Enterprise, Google Workspace Enterprise, or Cloud Identity Premium license.

Procedure (Google)

Go to Devices > Mobile & Endpoints > Settings > Third-party integrations.

Click Security and MDM partners > Manage.

In the Manage Partner Connections window, select Ivanti On-Prem.

Click Open Connection. You will be redirected to the Ivanti EPMM BeyondCorp Integration pane with a unique Customer ID in the Your Customer ID field.

Click Copy, to copy the unique Customer ID.

Do not tamper with the unique Customer ID.

Procedure (Ivanti EPMM)

In the Ivanti EPMM Admin Portal, go to Settings > Google BeyondCorp Beta > Device Compliance for iOS & Android.

Enter the unique Customer ID in the Google BeyondCorp Customer ID field.

Do not tamper with the unique Customer ID that you have copied or noted.

Click Save.

Install the Google Workspace managed app on the device.

Apply the Google BeyondCorp Policy to the device.

Display a message to inform the user that the selected managed Google Workspace app in the policy must be installed and set up. Until the app installation and setup are complete, the Continue button remains disabled.

After the server confirms that the app and managed app configuration are applied to the device, it sends a flag to enable the Continue button.

The managed app configuration is sent by the server after the managed app is installed.

For users who are already registered with Ivanti Mobile@Work for iOS but have not signed in to the Google Workspace app, the Continue button remains disabled.

According to Google guidelines, you must sign in to the Google Workspace app to which the Managed App Configuration was applied before signing in to Ivanti Mobile@Work for iOS. If you sign in to Ivanti Mobile@Work for iOS first or sign in without the Managed App Configuration, the app displays the prompt: “You need to log into the Google Workspace app. Please log in to your Google Workspace app to continue.”

Upon clicking the button, the Google Docs app launches on the device.

To add a new Google BeyondCorp policy, go to Policies & Configs > Policies > Add New > Google BeyondCorp Policy. The Add New Google BeyondCorp Policy pane appears.

Enter the Name of the policy.

Select one of the following from the Status field:

Active

Inactive

Select one of the following from the Priority field:

Higher than

Lower than

Enter the Description of the policy.

Select one of the following apps from the drop-down list in the Google BeyondCorp Workspace App that supports Google Workspace login:

Gmail (selected by default)

Google Meet

Google Docs

Google Sheets

Google Slides

Select the User Interaction In Client for Google BeyondCorp checkbox to view and confirm the integration of Google BeyondCorp in Ivanti Mobile@Work for iOS.

Select the Report Compliance Status for iOS and Android devices checkbox to make sure that the compliant devices can access Google Workspace applications in Ivanti EPMM.

Click Save.

Syncing the Google BeyondCorp Compliance Status

Administrators can sync the Compliance status of any device(s) from Ivanti EPMM to Google BeyondCorp. For the sync to run, at least one tenant must be connected. Syncing the Device Compliance works only when the device is associated with a Google ID and registered in the Ivanti EPMM.

When the administrator performs a manual sync, a detailed Audit Log is generated for the device(s). Ivanti EPMM will automatically sync devices whenever their state changes, in accordance with the compliance rules. Additionally, Ivanti EPMM will sync the devices when a device with a Google ID reports for the first time.

Procedure

In the Admin Portal, go to Devices & Users > Devices.

Select the device and choose Actions > Sync BeyondCorp Compliance Status.

Ivanti EPMM displays the message "Sync BeyondCorp Compliance Status action submitted successfully".

To view the compliance status of the device, go to the Device Details tab > Google BC Device Compliance Status.