Gemini Enterprise mobile app is now generally available for third-party identity providers
Organisations using Microsoft Entra ID, Okta, or AD FS can now deploy the Gemini Enterprise iOS and Android app without allowlist approval.
If your organisation manages employee identities through Microsoft Entra ID, Okta, or Active Directory Federation Services, you can now deploy the Gemini Enterprise iOS and Android app to your workforce without any special arrangement with Google. As of 16 July 2026, the app has reached general availability (GA) for organisations using third-party identity providers, with no allowlist required.
What changed, and why it matters
When Google launched the Gemini Enterprise mobile app earlier in 2026, general availability was limited to organisations using Google Identity. Organisations running third-party identity providers could access the app, but only if they had been added to an allowlist, a gating process that added friction and uncertainty for IT teams trying to plan a rollout.
That restriction is now gone. The feature, officially labelled in Google’s release notes as “Gemini Enterprise: Bring Your Own Identity (BYOID) for mobile apps (GA)”, means any eligible organisation can configure and deploy the app without waiting for approval from Google.
Who this applies to
The change affects organisations that use Workforce Identity Federation to connect their identity provider to Google Cloud. Supported providers include any that implement OIDC or SAML 2.0, which covers Microsoft Entra ID, AD FS, Okta, and others in that family.
If your organisation already uses one of these providers to authenticate employees into other Google Cloud services, you are well placed to extend that configuration to the Gemini Enterprise mobile app.
Organisations using Google Identity are unaffected by this change; the app has been GA for them since launch.
How the configuration works
The mobile app is distributed and configured through a mobile device management (MDM) solution, such as Google Endpoint Management or Microsoft Intune. The process is straightforward in principle: an administrator retrieves a deeplink URL from the Gemini Enterprise admin panel, extracts the parameters from that URL, and maps them to AppConfig keys in the MDM console.
For Google Identity setups, the deeplink contains two parameters: a configuration ID and a location. For third-party identity providers, additional parameters are required, including the identity provider path, tenant ID, client ID, and project ID. These map directly to AppConfig keys that the MDM pushes to enrolled devices.
One practical note from the documentation: Gemini Enterprise search with Workforce Identity Federation is case-insensitive, normalising both ingested data and search queries to lowercase. Google recommends appending lowerAscii() to attribute mapping configurations in Workforce Identity Federation to keep things consistent.
The app requires iOS 16.0 or later on Apple devices, and employees need an active Gemini Enterprise account provisioned by their organisation.
What Gemini Enterprise on mobile actually gives you
For employees, the app provides access to the same enterprise-grade capabilities available on desktop: first-party agents for Data Insights and Science, third-party partner agents, and a visual builder for creating agents, a feature that moved over from Google Agentspace. The experience is designed to feel familiar to anyone who has used the standard Gemini app, with the additional depth that comes from Gemini Enterprise’s connected data sources and access controls.
The identity provider configuration is central to how that data access works. Gemini Enterprise uses the identity provider to identify the user making a request and verify whether they have access to the documents and data sources being queried. Connecting the mobile app through the same identity provider your organisation already uses means those access policies travel with employees to their phones, without requiring a separate permissions model.
A couple of other things in the same release
Two related updates shipped alongside the BYOID mobile GA on 16 July 2026, worth noting briefly.
Organisations using Okta as their external identity provider with Workforce Identity Federation can now configure SCIM (System for Cross-domain Identity Management). This enables autocomplete when sharing Gemini Notebook Enterprise notebooks and agents, so users can search for colleagues or groups by name rather than typing full email addresses. That feature is also now generally available.
You may also notice the product previously called NotebookLM Enterprise has been renamed to Gemini Notebook Enterprise. The underlying functionality and APIs are unchanged; it is a rebrand rather than a rebuild.
What this means for you
If you are an IT administrator at an organisation that has been waiting out the allowlist requirement, the path to deploying the Gemini Enterprise mobile app is now open. The configuration process follows a standard MDM-based AppConfig approach, so if you have deployed other enterprise apps this way, the mechanics will be familiar.
If you are evaluating Gemini Enterprise and your organisation runs Entra ID or Okta, the mobile app is now a full part of what is on offer rather than a conditional one. That is worth factoring into any comparison or pilot planning.
The full configuration guide is available in Google’s documentation, including the specific AppConfig parameter mappings for different identity provider types.