> For the complete documentation index, see [llms.txt](https://docs.cubilock.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cubilock.com/switching-from-another-emm.md).

# Switching from Another EMM

How to bind your existing Google Workspace account to CubiLock's EMM when migrating from another provider

If you already manage devices with another EMM (Enterprise Mobility Management) platform — such as Samsung Knox Manage, Microsoft Intune, SOTI MobiControl, or Ivanti/MobileIron — and you want to start managing devices with CubiLock, there's one constraint you need to plan around first.

### Can you run CubiLock alongside your current EMM?

It depends on how your existing Android Enterprise is set up. Google now lets you bind more than one EMM provider to the same managed Google domain — the Google Workspace or Cloud Identity domain your organisation uses to sign in. When that's the case, you can add CubiLock as a second EMM binding and keep your current EMM active at the same time; each EMM gets its own Enterprise ID and can be assigned to different organisational units (OUs) or users. This only works if your enterprise was created with a work email and tied to that managed Google domain. If your current EMM instead set things up with a plain Gmail-based "managed Google Play Accounts" enterprise — never upgraded to a managed Google domain — side-by-side binding isn't available, and you'll need one of the two fallback options further down this page.

### Your options

There are three ways to bind your Google Workspace account to CubiLock's EMM:

#### Recommended: Add CubiLock as a second EMM provider (side-by-side)

For most customers already on a Google Workspace or Cloud Identity managed domain, this is the simplest and safest path: zero disruption to your existing EMM and its enrolled devices.

1. In the Google Admin console, go to Devices > Mobile & endpoints > Settings > Third-party integrations > Android EMM > Manage EMM providers.
2. Confirm your enterprise is bound to a managed Google domain rather than a standalone Gmail-based enterprise (the paragraph below shows where to check).
3. Start CubiLock's enrolment flow and choose to bind to your existing managed Google domain instead of creating a new enterprise, following CubiLock's binding instructions.
4. Assign the organisational units (OUs) or users you want CubiLock to manage; your existing EMM keeps managing everyone else, untouched.
5. Enrol new devices into CubiLock's OUs using Zero-Touch or QR code enrolment, and migrate existing devices over at your own pace by moving them into a CubiLock-assigned OU.

{% hint style="info" %}
Once a second EMM is bound, managed Google Play is accessed through each EMM's own console (its "EMM iframe"), not directly via play.google.com/work.
{% endhint %}

{% hint style="warning" %}
This option is only available if your existing Android Enterprise is already tied to a managed Google domain (Workspace or Cloud Identity, created with a work email). Standalone "managed Google Play Accounts" enterprises, created with a personal Gmail address, can't add a second EMM binding — use Option 1 or Option 2 below instead.
{% endhint %}

#### Option 1: Create a new Google enterprise for CubiLock

The safest way to switch is to bind CubiLock to a brand-new Android Enterprise, separate from your current EMM's binding. This leaves your existing EMM and its enrolled devices completely untouched, and lets you migrate devices to CubiLock at your own pace.

1. Start CubiLock's enrolment flow and sign in with a Google account that hasn't already been used to bind an Android Enterprise, or create a new managed Google Play Enterprise when prompted.
2. Follow our Getting Started Guide to set up profiles, apps, and configurations in CubiLock.
3. Enrol new (or factory-reset) devices into CubiLock using Zero-Touch or QR code enrolment.
4. When you're ready to move an existing device over, retire/unenrol it from your old EMM first, factory reset it, then enrol it into CubiLock the same way.

{% hint style="info" %}
A single Android device can only be actively managed by one EMM at a time. Migrating a device means retiring it from your old EMM before re-provisioning it under CubiLock — you can't manage the same device from both at once.
{% endhint %}

#### Option 2: Unbind your existing EMM, then bind to CubiLock

{% hint style="danger" %}
This is irreversible. Deleting your Android Enterprise binding immediately unenrols every device under it, makes private/managed apps inaccessible, and permanently deletes enterprise data that cannot be recovered. Only choose this option if you're fully retiring your previous EMM and don't need it running alongside CubiLock.
{% endhint %}

Use this option only if you don't need your old EMM running in parallel with CubiLock.

1. Preferably unbind from within your current EMM's own console — most platforms (Knox Manage, Intune, SOTI, Workspace ONE, and others) provide a built-in "remove" or "unbind enterprise" action. Check your EMM vendor's documentation for the exact steps.
2. If that's not possible, unbind directly through Google:
   1. Go to play.google.com/work/adminsettings
   2. Find your organisation in the list
   3. Click the ⋮ menu next to it and select Delete organisation
   4. Confirm the deletion
3. Google won't let you delete the enterprise while multiple admins are present on it — remove any additional admins first.
4. Once the old binding is deleted, bind your Google Workspace account to CubiLock's EMM through the normal enrolment flow.

You can check which EMM providers are currently bound to your domain from the Google Admin console: Devices > Mobile & endpoints > Settings > Third-party integrations > Android EMM. The Bound EMM Providers list and the Manage EMM providers link (shown below) let you review or remove existing bindings.

<figure><img src="https://1920795617-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MAzePNJAKsgL6R-VtV2%2Fuploads%2F70TpDQaaVi7CMMZa24Y2%2Fimage.png?alt=media&amp;token=7247f934-8b5e-4032-a772-274f7cca52b4" alt=""><figcaption></figcaption></figure>

### Which option should I choose?

Choose the Recommended side-by-side option if your current EMM's enterprise is already on a managed Google domain — it's zero-downtime, keeps your existing EMM completely untouched, and is the easiest path for almost anyone evaluating or switching to CubiLock. Choose Option 1 if side-by-side binding isn't available (your enterprise hasn't been upgraded to a managed Google domain) and you still want zero downtime — this creates a fresh enterprise for CubiLock and lets you migrate devices gradually. Choose Option 2 only if you're fully done with your previous EMM and want a clean, one-time cutover; plan for a maintenance window, since every device under the old binding will need to be re-enrolled.

### References

* [Android Enterprise FAQ: Binding AE with multiple EMMs](https://bayton.org/android/android-enterprise-faq/bind-ae-with-multiple-emms/)
* [Android Enterprise FAQ: Deleting the AE bind](https://bayton.org/android/android-enterprise-faq/delete-the-ae-bind/)
* [Google Admin Help: Android Enterprise administration in the Google Admin conso](https://support.google.com/work/android/answer/14319210?hl=en)l[e](https://support.google.com/work/android/answer/14319210?hl=en)
* [Google Developers: Upgrade an enterprise to a managed Google domain](https://developers.google.com/android/management/upgrade-an-enterprise)