The Google Service Account is a special Google account that is used by applications to access Google APIs. You should create this account after you generate your EMM token so you can upload all information at one time.


  1. Navigate to the Google Cloud Platform- Google Developers Console.
  2. Sign in with your Google credentials.
    The Google Admin credentials do not have to be associated with your business domain. Consider creating a Google account specifically for Android for your organization to use so as not to conflict with any existing Google accounts.
    Note: Consider adding additional accounts so that if one account expires becaue of inactivity, you will have additional accounts to log in and access your Google Service Account.
  3. Use the drop-down menu from the Select a project menu and select New project.
  4. Enter a Project Name to create your API project in the New project window. Consider using Android EMM-CompanyName as the naming convention.
  5. Agree to the terms and conditions and select Create.
    Your project generates and the Google Developer Console redirects you to the API Manager page.
  6. Select Enable APIS and Services for Android from the APIs & Services Dashboard.
  7. Search and enable the following APIs: Google Play EMM API and Admin SDK.
    After creating your project and enabling APIs, create your service account in the Google Developer's Console.
  8. Navigate to APIs & Services > Credentials > Create Credentials > Service Account Key > New Service Account.
  9. Define the Service Account name for your service account. Consider following the Android naming convention and be sure to note the name you choose as you will need it in further steps.
  10. Use the drop-down menu to select the Role > Project as Owner.
  11. Select the Key Type as P12.
  12. Select Create. The identity certificate gets automatically created and downloaded to your local drive. Be sure to save your identity certificate and password for when you upload the certificate into the Workspace ONE UEM console.
  13. Select Manage service accounts from the Service Account Keys list which opens the Service Accounts page.
  14. Select the menu button (three vertical dots) beside your service account and select Edit.
  15. Select Enable G Suite Domain-wide Delegation.
  16. Enter a Product name in order change settings for G Suite Domain. Consider using AndroidEMM-CompanyName as the naming convention.
  17. Select Save.
  18. Select View Client ID under the Domain Wide Delegation field. The details of your service account displays. From here, you will leave the Developer Console and input your credentials into the Google Admin Console.
    Be sure to save your client ID before navigating away from the Developer's Console. You will also use these credentials in the Workspace ONE UEM console when you upload your EMM token. For more information, see Upload EMM Token

What to do next

For steps to configure the Google Admin Console, see Setup Google Admin Console