This explains step by step how to link a Google account to FocusMDM and this is used to enroll your devices in DO mode.
...
Why do you need a AFW setup?
It's like creating a workspace for your organization with Google to use the special Google Android APIs. Part of the provisioning process (of the DO mode) is creating a Managed Google Play Account on the device itself.
In order to do so, our server is making a call to a Google API endpoint, to obtain a token, and then this security token (the user authentication token generated by the Google Play EMM API) is being forwarded to the device (to finish the provisioning process by installing a Managed Play Store account).