# Guide for existing EMMs

EMMs already using the Google Play EMM API can use the Android
Management API to support the following solution sets:

- [Work profile on personally-owned device](https://developers.google.com/android/work/requirements/work-profile)
- [Work profile on company-owned device](https://developers.google.com/android/work/requirements/work-profile-corporate)
- [Fully managed device](https://developers.google.com/android/work/requirements/fully-managed-device)
- [Dedicated device](https://developers.google.com/android/work/requirements/dedicated-device)

The Android Management API is a self-contained API that eliminates the need for
you to create your own Device Policy Controller (DPC). Instead, managed devices
use Android Device Policy to enforce app and device management policies
sent through the API.

## Overview of authentication methods

You can choose one of the following authentication methods for calling the
Android Management API and the Google Play EMM API:

- Service account configured using Cloud IAM (recommended), the same way as
  new partners.

- Programmatically created ESAs, the old approach.

You can change authentication methods at any time, for both new and existing
customers, and the two methods can be used simultaneously.

## Use a service account configured using Cloud IAM (recommended)

With this authentication method, you call the APIs with a unique service account
registered with your Cloud project using Cloud IAM.

### Advantages

- You can create enterprise bindings using either of the two APIs.
- You can monitor and adjust API quotas (for both APIs).

### Limitations

- This method is incompatible with on-premise deployments because the service account is unique for the EMM.
- The [Play EMM API notifications](https://developers.google.com/android/work/play/emm-api/about-notifications) are unavailable with this method (notifications are used by very few EMM partners).

### Setup

To use this authentication method you need to set up your Cloud project and
service account:

1. Set up your Cloud project:

   1. Select or create a project.

      [Go to the Projects Page](https://console.cloud.google.com/project)
   2. Sign into the [Android Enterprise EMM Provider community](https://emm.androidenterprise.dev/s/). You must
      be a registered EMM to have access to this site.

   3. Open the [EMM product modification form](https://emm.androidenterprise.dev/s/emm-product-modification-google-play).

   4. Enter the required information, including your associated DPC identity
      and Cloud Project ID.

   5. Submit the form and wait for confirmation from Google that your project
      has been registered.

2. Follow the instructions for [creating a service account](https://developers.google.com/android/management/service-account). You can change
   your service account at any time as long as it has the role
   **Android Management User** on the Cloud project configured through the
   Android Enterprise EMM Provider community.

### Create an enterprise binding

To create an enterprise binding when using a service account configured using
Cloud IAM, you can use either the Android Management API or the Google Play EMM
API:

- If using the Android Management API, call `enterprises.create` and specify
  the Cloud project configured earlier.

- If using the Google Play EMM API, **use your MSA** (which may be the same
  service account as the one configured above) to call
  `enterprises.generateSignupUrl` and `enterprises.completeSignup`.

Note that enterprise bindings created using the Android Management API can never
be managed using a programmatically created ESA, and should always be managed
using a service account configured using Cloud IAM. Enterprise bindings created
using the Google Play EMM API can be managed using any authentication methods.

## Use programmatically created ESAs

### Limitations

- You cannot monitor and adjust API quotas.

### Setup

To use this authentication method you need to set up your Cloud project:

1. Select or create a project.

   [Go to the Projects Page](https://console.cloud.google.com/project)
2. Sign into the [Android Enterprise EMM Provider community](https://emm.androidenterprise.dev/s/). You must be a
   registered EMM to have access to this site.

3. Open the
   [EMM product modification form](https://emm.androidenterprise.dev/s/emm-product-modification-google-play).

4. Enter the required information, including your associated DPC identity and
   Cloud Project ID.

5. Submit the form and wait for confirmation from Google that your project has
   been registered.

Use this Cloud project to [set up Pub/Sub notifications](https://developers.google.com/android/management/notifications#2_create_a_topic).

### Create an enterprise binding

To create an enterprise binding when using programmatically created ESAs, you
need to use the Google Play EMM API.

Note that enterprise bindings created using the Android Management API can never
be managed with a programmatically created ESA.

## Migrate from programmatically created ESAs to Cloud IAM

To migrate from using programmatically created ESAs to using a service account
configured using Cloud IAM, proceed in the following order:

1. Follow the instructions to
   [create and set up your service account](https://developers.google.com/android/management/existing-emms#cloud-iam-setup). You can
   alternatively reuse your existing MSA instead of creating a new service
   account, if doing so ensure that you have registered your Cloud project in
   the community and granted the role **Android Management User** to your MSA.

2. Use this new service account to call the Play EMM API instead of the
   programmatically created ESAs.

3. Stop programmatically creating ESAs for new bindings. This means you should
   no longer call the methods `enterprises.getServiceAccount` and
   `enterprises.setAccount` of the Google Play EMM API.