Connect Android to Google

This page ties your organization to Google. Until both statuses are Configured and Linked, you cannot create a QR code.

When to open thisBefore the first Android device, and when Enrollment says you must link an enterprise.

Settings → Android → Service settings. The page title is Android service settings.

Two steps on this page

Service account. Get a .json key file from Google Cloud, for an account that can use the Android Management API. Drop it on Choose a file, then click Upload service account. Status becomes Configured. Validate appears once a key is present — use it when you suspect the key no longer works. To change the key, click Replace service account.
Managed Google Play enterprise. While Status is still Not linked, click Start signup. Google opens the signup page. When you return, Status is Linked and the enterprise has a name. If Google does not bring you back, open Finish signup manually, paste the enterpriseToken from the callback address, then Complete signup. Re-open signup opens Google’s page again when you have not finished.

Without a key file, the enterprise block only shows Upload a service account first. Do not look for a QR code on this page.

The Device discovery block appears. A new device enters the Devices list when Google reports it, or when you click Sync devices now.

Live updates is On when instant notices are enabled. While it is Off, fill in the Pub/Sub topic and push authentication email, or click Use suggested topic to insert the defaults. Sync devices now and Enable live updates do not send a request while those fields are empty.
Enable live updates creates the Pub/Sub topic from the values you entered. The service account also needs Pub/Sub Admin. After Live updates is On, a manual sync does not need those fields again.
Push endpoint is the address Google sends notices to. Do not give this address to the person holding the phone.
Reset Android settings clears the service account, the enterprise, and the Pub/Sub topic this page created. Enrolled and enrolling devices become unenrolled, and open Android commands are canceled. They do not follow the new enterprise until you factory-reset them and scan a new QR code.

The Android tab already has apps, but this page is still Not linked?: The Apps catalog can still hold apps from an earlier link. A QR code and a new policy still need Status Linked on this page.
What is Callback URL for?: Google must be able to call that address when you click Start signup. It is not a link an employee opens on the phone.