Switch device management before downgrading Google Workspace

As an administrator, you can help users in your organization stay connected and productive when you switch their Google Workspace licenses to licenses that don't support advanced mobile management. To make sure users who enrolled their devices under advanced management don’t lose access to their work data on mobile devices, change their mobile management to basic.

Before you begin: Check if advanced mobile management is turned on

If your organization hasn't turned on advanced mobile management, you're all set and don't need to change your settings before downgrading. Here's how to check if advanced mobile management is turned on:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile & endpointsSettingsUniversal.
3. Click GeneralMobile management.
4. Review the Mobile management options for each organizational unit. Your organization uses advanced mobile management if one of these options is selected:
   • Advanced
   • Custom, with Android, iOS, or Google Sync set to Advanced.

If no mobile management options are set to Advanced, you're all set and can skip the following steps.

If your organization uses advanced mobile management, review the following information and go through the steps below.

If you downgrade without doing the following steps:

• Some admin settings can't be changed. The setting might still show the advanced setting, but the basic or default option is applied to users' devices.
• For iOS devices, managed apps that you set to be removed from the device when the management profile is removed are removed from the device, even if the user also uses them with a personal account.
• Users might need to factory reset their device to use previously blocked system apps, remove their work account, or be able to remotely wipe their device with My Devices.

You should also understand:

• Devices that were under advanced mobile management and blocked or pending approval are automatically approved. Users can immediately use Google apps for work on these devices.
• If you use a third-party Android EMM provider or use Google Sync with iOS devices, users might still need to factory reset devices.
• Devices continue to be managed through the Google Device Policy app or Android Device Policy until the user factory resets their device or, for Android users, removes their work profile. However, only policies supported for basic mobile management are enforced.

Step 1. Revert certain Android settings

Skip if you don't manage Android devices.

You might want to update the following settings, which can’t be updated after you change to basic mobile management:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsAndroid.
3. Go to GeneralUser device wipe. Check the box if it isn't already. Otherwise, users can’t wipe their devices from My Devices (https://mydevices.google.com/) unless they factory reset their device.
4. Click Save.
5. In Android settings, go to Apps and Data sharingSystem apps. Remove any apps from the list of disabled apps. Otherwise, users with work-only devices can’t use these system apps unless they factory reset their device. Even with this step, some users might need to factory reset to use system apps that aren’t available in Google Play.
6. Click Save.
7. In Android settings, go to Users and accountsAccounts. Check the box to allow users to add or remove accounts if it isn't already. Otherwise, users with work-only devices can’t remove accounts unless they factory reset their device.
8. Click Save.

Step 2. Update managed iOS apps

Skip if you don't manage iOS devices or iOS apps.

If you set iOS apps to be removed when the configuration profile is removed, you might want to update app settings to prevent those apps from being removed from the device.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsWeb and mobile apps.

3. (Optional) If you manage many apps and want to show only iOS apps, click Add a filterPlatform, select iOS, and click Apply.
4. Click the app you want to edit.
5. Click Settings.
6. If the app is set to be removed when the configuration profile is removed (set to On), change the setting to Off.
7. Click Save.
8. Ask your users to sync the apps managed through the Google Device Policy app:
   1. Tap Google Device Policy .
   2. Tap Menu Apps.
   3. At the top, click Accept.

If users don't accept the app updates, the apps are removed from their devices when you change to basic mobile management.

Step 3. Switch to basic mobile management

When you’re ready, switch mobile management from advanced to basic:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile & endpointsSettingsUniversal.
3. Click GeneralMobile management.
4. Choose Basic (recommended). Note: The other option, Turn off mobile management, isn't recommended because you can't manage device security at all through Google endpoint management.
5. Click Save.

Step 4: Users may have to factory reset their device

Even with the preceding steps, users might have to factory reset their device in the following situations:

• (Android) If you use a third-party Android EMM provider, users can't access work data because the EMM isn't applied correctly. The fix depends on how you want to manage devices:
  • To use basic mobile management, remove or disable the EMM provider.
  • To use the EMM, users must factory reset their device and install the third-party EMM app.
• (iOS) If you use Google Sync with iOS devices and required a standard or strong password, users must still meet those password requirements. Users can't use a basic password (any screen lock) unless they factory reset their device.

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.}