Solved

Hi Google Workspace Community,I'm trying to set up Google Workspace for my UK-based creative and digital marketing business, Three Tapes.Our website is https://threetapes.co.uk, and we're attempting to create our professional business email address: hello@threetapes.co.uk.Initially, we encountered difficulties verifying ownership of our domain. However, when attempting to complete the registration, Google displayed the following error:"Sorry, we can't complete your sign-up."The message explains that Google's automated anti-spam prevention system sometimes rejects legitimate registrations.I want to clarify that: We are a genuine UK-based business. We own and control the domain threetapes.co.uk. We intend to use Google Workspace for legitimate business communication with our clients. We are happy to provide proof of domain ownership and any necessary business verification. Unfortunately, I haven't been able to find a way to contact Google Workspace support directly because our acco

Multiple Chromeboxes are fatally crashing and cannot be restored with Recovery after the last update.Units affected so far are the Asus Chromebox 3 TEEMO D7-A3B-B4Z-S5A-A92 and Acer Chromebox CXI3 D15Q1Stable beta, nothing will bring them back to live. Maybe for a short term but they auto update and die again. Stable even mentions that the mirror image is outdated. I just downloaded a minute ago.Why is Google allowing this?! It started last week.We have a few spare chromebooks and after that it is over. I am so done with this system. They just end production machines at will and do not seem to notice or care at all.Not more ChromeOS for me, I am out. This does not belong in a professional setting!!!!!!

Since 19 Sep 2026, QR (6-tap) provisioning of Test DPC on a factory-reset device fails. After "Getting ready for work", Play Protect shows "App blocked to protect your device - Test DPC" with only an OK button, so provisioning cannot continue. The same flow worked before that date and nothing changed on our side.Setup: provisioning QR with PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME com.afwsamples.testdpc/com.afwsamples.testdpc.DeviceAdminReceiver, an HTTPS download location for the APK, and the signature checksum.APK: com.afwsamples.testdpc 9.0.12 (versionCode 9012), unmodified, signed by CN=testdpc, O=Google Inc. Signing certificate SHA-256: 8090f6630b4e8962479123249087cb4658feaae36a1b57dbeafd74d109b333dc. File SHA-256: aad38c1f608b1c7289405c4e866977f5d231502643ce2e2401a7c305808f9c00 (on VirusTotal, 1/67, a generic AdLibrary heuristic).I found the approved-DPC allowlist page (https://support.google.com/work/android/answer/16694822) and other threads about custom DPCs being blocked, but

We publish an Isolated Web App that is force-installed on managed ChromeOSdevices via the Admin Console for an enterprise customer.Since the Chrome 143 managed-installation allowlist requirement, the app shows"This app is unverified and may not work properly" in the Admin Console, and weexpect updates will no longer reach devices until the Web Bundle ID is on theGoogle-managed allowlist.The documentation says the process starts with "Developer/partner reaches outto their Google contact (Partner Engineering or other point of contact)", andthat if we don't have one we are likely not part of the early IWA program:https://developer.chrome.com/docs/iwa/allowlistThe blink-dev PSA lists contact addresses, but they are masked for signed-outreaders:https://groups.google.com/a/chromium.org/g/blink-dev/c/iTCPaBw6HxUWe do not currently have a Partner Engineering contact, and email attempts havenot reached anyone.Question: what is the correct route for a developer in this position to requestIWA all

Hello,We use QR code provisioning to install our custom Device Policy Controller (DPC) app from a custom download URL (not Google Play).The exact same APK + QR configuration:Works on:Samsung Galaxy S20 — Android 13 / One UI 5.0Blocked on:Samsung Galaxy S21 — Android 14 / One UI 6.1Play Protect stops installation with the message:"App blocked to protect your device. This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud."Provisioning QR:{"android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "<DeviceAdmin component>","android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM": "<Package checksum>","android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "<S3 bucket url>","android.app.extra.PROVISIONING_LOCALE": "en_US","android.app.extra.PROVISIONING_TIME_ZONE": "Europe/Helsinki","android.app.extra.PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED": false,"android.app.extra.PROVISIONING_DEVICE_A

Trying to get our Intune tenant connected so that we can start to purchase organizationally owned Android phones and manage them within Intune, similar to what we have done with Apple.  When I set up the enrollment to connect to Managed Google Play, I foolishly used my Microsoft account to connect them. I thought better of it and thought I’d try to add a different email to our tenant, and connect using this instead. I’ve tried to add this new email by inviting it through Google Admin. I get prompted to log in using my Microsoft account, when I do this, I get the following:  The user I’ve invited, still shows up as “pending” in Google Admin. What else do I need to do so I can use this new account instead of mine?

This blog post says it's now generally available but I'm not seeing it live in my tenant yet: What’s new in Microsoft Intune – MayFor those that don't know, Microsoft has been using Company Portal as their custom DPC but is now transitioning to Google’s Device Policy app to get in line with Google’s mandates. This means (among other things), enrollment will happen at http://aka.ms/enrollymyandroid instead of through the Company Portal app.If they've rolled it out to your tenant, it will look like the first image in this other blog post when you go to Devices > Android > Enrollment > Personally-owned work profile.I am curious if this is live for anyone else. Methinks Microsoft has a weird interpretation of "generally available".

taking forever for students to login both with chromebooks and desktops

Does anyone here have experience of putting a ChromeOS fleet (managed) behind Okta for SSO? We have the basic SSO working as expected, but we have challenges around controlling session lengths in particular.Our idea setup would be; User signs into the device with Okta (IdP) Session token is passed-through to the Chrome Browser The session is valid for 12hrs (matching our Okta Global Session Policy) At the end of the 12hrs the user is logged out of the session and asked to re-authenicate via Okta (IdP) Sleep wakes and Lid-Close & Open wakes are password only within the 12hrsFor some reason we just can’t reach this configuration, there is always one blocker or another no matter what configuration combination we try.The easiest finger to point is that the controls for re-authorising SSO/SAML (SAML Single Sign On Login Frequency) aren’t granular enough, there is no intermediate between 1 day and Always. But we are open to any ideas.We have however tried many things including forcing re

Will Cameyo at some point use IWA (Isolated Web Apps) so that you can pass a Smartcard through to a Cameyo Published App from a Chromebook, PWA will not support Smartcards from my understanding.      

Is it good to have a quote and what is the demand threshold of the EMM Quota

We're experiencing an issue where our custom app's embedded WebView fails to complete authorization callbacks when redirecting to local mobile banking and wallet web services on fully managed devices. The web session drops the authentication token during the handoff.Is there a specific network activity or domain allowlist configuration in Google Play EMM policies required to permit external payment gateway redirects inside managed app containers?

Good morning, Asking here, as i find a lot of different info on the net. We run a hybrid solution of enduser devices, both windows and Chromebooks. Now, the problem is that we have certain apps that is different on Chrome and Windows, like the Citrix workspace. To make it more symmetric, we are thinking about the Citrixc HTML5 as an alternative, that would let veryone use the same app, and remove the confusion that occurs when users log inot windows and get teh Citrix app fir noth chrome and windows on their device. Do anyone have any experience with the HTML version? I read a lot about some serious limitations in certain features like video / audio, support for multiple screens etc? :) 

Hey, I’m trying to better understand this AMAPI release (May 2026), we currently have issues with our corporate owned personally enabled devices where if a users personal gmail account is added to the personal profile of the device if the device is reset via recovery mode the users pin / personal gmail account is required.We started using EFRP admin emails to bypass this so we could get back into our own devices, we’re a large organisation so users generally don’t reset devices before handing them back or hand them back to their manager who is unaware of our process.What I’d like to understand is what the below change did as after testing this it still seems to be the same that when setting the FRP admin emails setting to be not configured a recovery mode wipe still triggers consumer FRP.AMAPI improves Factory Reset Protection (FRP) policy handling on COPE devices by explicitly disabling FRP and clearing account lists when no admin emails are configured, preventing unexpected lockouts

Hello,I am trying to configure managed client certificate support for Chrome on iOS using Chrome Enterprise Core.My environment is: Chrome Enterprise Core is enabled Chrome for iOS version 151.0 “Apply supported user settings to Chrome on iOS” is enabled The user is signed in to Chrome with a managed Google Workspace account I am checking: Devices → Chrome → Settings → User & browser settings According to the Chrome Enterprise policy documentation, ProvisionManagedClientCertificateForUser supports Chrome on iOS and iPadOS starting with version 147.The Chrome Enterprise release notes also state that administrators should configure the following policies: ProvisionManagedClientCertificateForUser ProvisionManagedClientCertificateForBrowser AutoSelectCertificateForUrls However, ProvisionManagedClientCertificateForUser and ProvisionManagedClientCertificateForBrowser do not appear in the Google Admin console. I searched using both the English policy names and the localized po

My Google Pixel is showing “This device is managed” and says Google LLC has configured this device to be fully managed. I am the current owner/user of the device and do not have access to the organization that enrolled it. The device is scheduled to automatically reset. How can I get this device removed from organization/zero-touch enrollment.

Hello,I'm trying to configure a corporate Wi-Fi network with certificate-based authentication.The connection works fine on an Android smartphone enrolled in Intune in COPE mode, but I can't get it to work on a smartphone enrolled in BYOD mode.I have a fleet of Samsung smartphones, both COPE and BYOD.The certificate is installed on the BYOD smartphones via an Intune PKCS profile, and I followed the recommendations (user-type certificate, Subject name = CN={{UserPrincipalName}}, and adding the SAN: User principal name (UPN) = {{UserPrincipalName}}, I published the CA that issued the certificate).The certificate is correctly installed on the BYOD smartphone and visible in the work profile, but the Wi-Fi connection fails.When I check the Wi-Fi configuration on the BYOD smartphone, there's no client certificate, which can explain the connection failure.Has anyone successfully configured a corporate Wi-Fi network with certificate authentication on a smartphone enrolled in BYOD mode on Intune

Hi Google TeamMy name is Fernando from Kueski Pay. We're currently expanding our mobile phone financing business in MexicoIn the past, we used Android DPC for device management. Recently, Springdel approached us with a solution based on the Android Management APIBefore moving forward, we’d like to confirm whether their implementation complies with Google’s policies and licensing requirements for our use case.Thanks in advance for your supportBest regardsFernandoKueski Pay

Allow my device to install other apps and uninstall 

Good to know for some of u!I did raise this question:Several of our clients are reporting an issue on their Chromebooks affecting various Google Sheets. Notably, this does not affect every user, even among those using the exact same Chromebook model.When opening a Sheet, the content appears blurry and unreadable. We have already tried resetting the zoom level to default, disabling hardware acceleration, and verifying the text wrapping settings, but the issue persists.Has anyone encountered this problem before, or could anyone suggest a potential solution? Luckely there is a temp fix for this:Adjust Canvas AccelerationIn the Chrome browser on an affected device, navigate to chrome://flags/#disable-accelerated-2d-canvas Set the flag to Disabled (or toggle to your system's default state). Click Relaunch at the bottom of the screen to restart the browser. Reload Google Sheets to verify that text and numbers render clearlyIf u having this issues, please raise a ticket with Google support to

Hi everyone, I’m trying to enroll a fully managed Android device using the Android Management API. I generate an enrollment token, create the QR code, factory reset the device, and start the QR-based provisioning process. Everything works until the Android Device Policy step, where I get the following error: “Since your organization has reached its usage limits, this device can’t be set up.” I am unable to get past this point. Here is what I have already checked:Listing devices through the API returns an empty list. There are no enrolled devices at all.Billing is active on the cloud project and the Android Management API is enabled.Enterprise creation works, policies return correctly, and I can generate enrollment tokens without any issues.The device is correctly factory reset and the QR scan is working as expected.I tested with both a Workspace-based enterprise and a Gmail-based enterprise. The same limit error appears on both, even though both enterprises have zer

What is the best way to troubleshoot RDP & Native Player connections when the self-hosted server is in AWS We receive the below error message  I think the problem is Cameyo Port Sheild but I am not sure how to troubleshoot this, are there any logs to investigate?Any help would be appreciated

Hi all,I'm giving you a brainteaser about the tablets we manage.The pentest conducted by our red team required us to disable the translation features in Google Chrome.Currently, when the TranslateEnabled policy is set to false, Chrome for Android correctly removes "Translate" from the overflow menu (⋮) and the long-press context menu. However, the Adaptive Toolbar Shortcut (the dynamic button next to the Omnibox) remains active or selectable, allowing users to bypass the restriction.Google Chome Android with Translation button recommandationLogically, if the Toolbar Shortcut was previously set to "Translate" (either manually or via "Based on your usage") before the policy was applied, the button must be hidden or replaced by the default shortcut once the policy is active. Or other behaviour such as should trigger a "Feature disabled by your administrator" message or simply perform no action.Unfortunately, there is no policy for managing the toolbar shortcut. Do you have any idea how to

Hey,Unfortunately there are no settings and/or no chance configure Widgets on COPE in MS Intune. There is specific setting in Intune restrictions config profile to allow/disallow Widgets for BYOD method.Is this problem tied only MS Intune or is this something for Google? Majority of our 10k fleet enrolled as  COPE and it's a big gap not having widgets available for Work Apps.ThanksJarmo 

I tried to create a new account but didn’t finish the process on the first day. When I came back the next day to complete it, I received the error message:ERROR_CREATING_USER – Portal user already exists for contactThis means the system has already linked my contact information to a portal user profile, even though I never fully completed the registration. Because of that, I’m unable to create a new account now. The incomplete registration seems to have locked my contact details, leaving me stuck in the process.