現有 EMM 指南
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
已使用 Google Play EMM API 的 EMM 可使用 Android Management API 支援下列解決方案組合：
Android Management API 是自給自足的 API，因此您不必自行建立裝置政策控制器 (DPC)。相反地，受管理的裝置會使用 Android Device Policy 強制執行透過 API 傳送的應用程式和裝置管理政策。
驗證方法總覽
您可以選擇下列其中一種驗證方法，呼叫 Android 管理 API 和 Google Play EMM API：
無論是新客戶還是現有客戶，您隨時可以變更驗證方法，而且兩種方法可以同時使用。
使用這種驗證方法時，您可以透過使用 Cloud IAM 向 Cloud 專案註冊的專屬服務帳戶呼叫 API。
優點
- 您可以使用這兩種 API 建立企業繫結。
- 您可以監控及調整 API 配額 (適用於兩種 API)。
限制
- 由於服務帳戶是 EMM 專屬，因此這個方法與內部部署不相容。
- 您無法透過這個方法使用 Play EMM API 通知 (只有少數 EMM 合作夥伴使用通知)。
設定
如要使用這項驗證方法，您必須設定 Cloud 專案和服務帳戶：
設定 Cloud 專案：
選取或建立專案。
前往「Projects」(專案) 頁面
登入 Android Enterprise EMM 供應商社群。您必須是註冊的 EMM，才能存取這個網站。
開啟 EMM 產品修改表單。
輸入必要資訊，包括相關聯的 DPC 身分和 Cloud 專案 ID。
提交表單後，請等候 Google 確認您的專案已註冊。
請按照建立服務帳戶的操作說明操作。只要服務帳戶在透過 Android Enterprise EMM 供應商社群設定的 Cloud 專案中具有Android 管理員使用者角色，您隨時都可以變更服務帳戶。
建立企業繫結
如要在使用透過 Cloud IAM 設定的服務帳戶時建立企業繫結，您可以使用 Android 管理 API 或 Google Play EMM API：
請注意，使用 Android Management API 建立的企業繫結絕不能透過程式碼建立的 ESA 管理，而應一律透過使用 Cloud IAM 設定的服務帳戶管理。使用 Google Play EMM API 建立的企業繫結可透過任何驗證方法管理。
使用以程式輔助方式建立的 ESA
限制
設定
如要使用這項驗證方法，您必須設定 Cloud 專案：
選取或建立專案。
前往「Projects」(專案) 頁面
登入 Android Enterprise EMM 供應商社群。您必須是註冊的 EMM，才能存取這個網站。
開啟 EMM 產品修改表單。
輸入必要資訊，包括相關聯的 DPC 身分和 Cloud 專案 ID。
提交表單後，請等候 Google 確認您的專案已註冊。
使用這個 Cloud 專案設定 Pub/Sub 通知。
建立企業繫結
如要在使用以程式碼建立的 ESA 時建立企業繫結，您必須使用 Google Play EMM API。
請注意，使用 Android Management API 建立的企業繫結，絕對無法透過程式輔助建立的 ESA 進行管理。
從以程式輔助方式建立的 ESA 遷移至 Cloud IAM
如要從使用以程式輔助方式建立的 ESA 改為使用透過 Cloud IAM 設定的服務帳戶，請按照以下順序進行：
請按照操作說明建立及設定服務帳戶。您也可以改用現有的 MSA，而非建立新的服務帳戶。如果您選擇這麼做，請務必先在社群中註冊 Cloud 專案，並將 Android 管理員使用者角色授予 MSA。
請使用這個新服務帳戶呼叫 Play EMM API，而非以程式輔助方式建立的 ESA。
停止透過程式輔助方式為新繫結建立 ESA。也就是說，您不應再呼叫 Google Play EMM API 的 enterprises.getServiceAccount 和 enterprises.setAccount 方法。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-26 (世界標準時間)。
[null,null,["上次更新時間：2025-07-26 (世界標準時間)。"],[[["\u003cp\u003eEMMs can utilize the Android Management API to manage work profiles and fully managed devices without needing a custom DPC.\u003c/p\u003e\n"],["\u003cp\u003eThe API supports authentication via service account (recommended) or programmatically created ESAs, offering flexibility for integration.\u003c/p\u003e\n"],["\u003cp\u003eService account authentication provides advantages like enterprise binding creation and API quota management, but has limitations for on-premise deployments and Play EMM API notifications.\u003c/p\u003e\n"],["\u003cp\u003eProgrammatically created ESAs have limitations regarding API quota management and are incompatible with enterprise binding creation using the Android Management API.\u003c/p\u003e\n"],["\u003cp\u003eMigration from ESAs to service accounts involves setting up a service account, using it for Play EMM API calls, and discontinuing ESA creation for new bindings.\u003c/p\u003e\n"]]],["EMMs using the Google Play EMM API can leverage the Android Management API for work profiles on various devices. Authentication methods include using a service account with Cloud IAM (recommended) or programmatically created ESAs. Service accounts offer advantages like enterprise binding creation with either API and quota monitoring, while ESAs don't offer quota monitoring. Migration from ESAs to Cloud IAM involves setting up a service account and utilizing it with the Play EMM API.\n"],null,["# Guide for existing EMMs\n\nEMMs already using the Google Play EMM API can use the Android\nManagement API to support the following solution sets:\n\n- [Work profile on personally-owned device](/android/work/requirements/work-profile)\n- [Work profile on company-owned device](/android/work/requirements/work-profile-corporate)\n- [Fully managed device](/android/work/requirements/fully-managed-device)\n- [Dedicated device](/android/work/requirements/dedicated-device)\n\nThe Android Management API is a self-contained API that eliminates the need for\nyou to create your own Device Policy Controller (DPC). Instead, managed devices\nuse Android Device Policy to enforce app and device management policies\nsent through the API.\n\nOverview of authentication methods\n----------------------------------\n\nYou can choose one of the following authentication methods for calling the\nAndroid Management API and the Google Play EMM API:\n\n- Service account configured using Cloud IAM (recommended), the same way as\n new partners.\n\n- Programmatically created ESAs, the old approach.\n\nYou can change authentication methods at any time, for both new and existing\ncustomers, and the two methods can be used simultaneously.\n\nUse a service account configured using Cloud IAM (recommended)\n--------------------------------------------------------------\n\nWith this authentication method, you call the APIs with a unique service account\nregistered with your Cloud project using Cloud IAM.\n\n### Advantages\n\n- You can create enterprise bindings using either of the two APIs.\n- You can monitor and adjust API quotas (for both APIs).\n\n### Limitations\n\n- This method is incompatible with on-premise deployments because the service account is unique for the EMM.\n- The [Play EMM API notifications](https://developers.google.com/android/work/play/emm-api/about-notifications) are unavailable with this method (notifications are used by very few EMM partners).\n\n### Setup\n\nTo use this authentication method you need to set up your Cloud project and\nservice account:\n\n1. Set up your Cloud project:\n\n 1. Select or create a project.\n\n [Go to the Projects Page](https://console.cloud.google.com/project)\n 2. Sign into the [Android Enterprise EMM Provider community](https://emm.androidenterprise.dev/s/). You must\n be a registered EMM to have access to this site.\n\n 3. Open the [EMM product modification form](https://emm.androidenterprise.dev/s/emm-product-modification-google-play).\n\n 4. Enter the required information, including your associated DPC identity\n and Cloud Project ID.\n\n 5. Submit the form and wait for confirmation from Google that your project\n has been registered.\n\n2. Follow the instructions for [creating a service account](https://developers.google.com/android/management/service-account). You can change\n your service account at any time as long as it has the role\n **Android Management User** on the Cloud project configured through the\n Android Enterprise EMM Provider community.\n\n### Create an enterprise binding\n\nTo create an enterprise binding when using a service account configured using\nCloud IAM, you can use either the Android Management API or the Google Play EMM\nAPI:\n\n- If using the Android Management API, call `enterprises.create` and specify\n the Cloud project configured earlier.\n\n- If using the Google Play EMM API, **use your MSA** (which may be the same\n service account as the one configured above) to call\n `enterprises.generateSignupUrl` and `enterprises.completeSignup`.\n\nNote that enterprise bindings created using the Android Management API can never\nbe managed using a programmatically created ESA, and should always be managed\nusing a service account configured using Cloud IAM. Enterprise bindings created\nusing the Google Play EMM API can be managed using any authentication methods.\n\nUse programmatically created ESAs\n---------------------------------\n\n### Limitations\n\n- You cannot monitor and adjust API quotas.\n\n### Setup\n\nTo use this authentication method you need to set up your Cloud project:\n\n1. Select or create a project.\n\n [Go to the Projects Page](https://console.cloud.google.com/project)\n2. Sign into the [Android Enterprise EMM Provider community](https://emm.androidenterprise.dev/s/). You must be a\n registered EMM to have access to this site.\n\n3. Open the\n [EMM product modification form](https://emm.androidenterprise.dev/s/emm-product-modification-google-play).\n\n4. Enter the required information, including your associated DPC identity and\n Cloud Project ID.\n\n5. Submit the form and wait for confirmation from Google that your project has\n been registered.\n\nUse this Cloud project to [set up Pub/Sub notifications](https://developers.google.com/android/management/notifications#2_create_a_topic).\n\n### Create an enterprise binding\n\nTo create an enterprise binding when using programmatically created ESAs, you\nneed to use the Google Play EMM API.\n\nNote that enterprise bindings created using the Android Management API can never\nbe managed with a programmatically created ESA.\n\nMigrate from programmatically created ESAs to Cloud IAM\n-------------------------------------------------------\n\nTo migrate from using programmatically created ESAs to using a service account\nconfigured using Cloud IAM, proceed in the following order:\n\n1. Follow the instructions to\n [create and set up your service account](#cloud-iam-setup). You can\n alternatively reuse your existing MSA instead of creating a new service\n account, if doing so ensure that you have registered your Cloud project in\n the community and granted the role **Android Management User** to your MSA.\n\n2. Use this new service account to call the Play EMM API instead of the\n programmatically created ESAs.\n\n3. Stop programmatically creating ESAs for new bindings. This means you should\n no longer call the methods `enterprises.getServiceAccount` and\n `enterprises.setAccount` of the Google Play EMM API."]]
