10 Chrome managed-profile policy baseline

Caveats

• These are user/profile-scoped policies, not device-scoped¹

Setup steps

1. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/browser_signin_category_item · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Browser sign-in settings ↗

   Select the target OU (organizational unit) and force browser sign-in, so work browsing happens in a profile you control.

   Browser sign-in settings

   Force users to sign in to use the browser

   Force users to sign in to Chrome browser (user policies only) ↗

2. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/restrict_signin_to_pattern_category_item · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Restrict sign-in to pattern ↗

   Restrict which accounts may sign in to the browser, so a personal Google account cannot become the profile's primary account.

   Restrict sign-in to pattern

   .*@<your-workspace-domain>\.org

   Force users to sign in to Chrome browser (user policies only) ↗

3. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/cloud_profile_reporting · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Managed profile reporting ↗

   Turn on managed profile reporting, so the fleet's browsers, versions and extensions actually show up in the console — the visibility the rest of this baseline is verified against.

   Managed profile reporting

   Enabled

   Turn on managed profile reporting ↗

4. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/safe_browsing_protection_level_category_item?f=SEARCH.safe%2520browsing · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Safe Browsing Protection ↗

   Force Enhanced Safe Browsing. It sends more browsing data to Google, but the detection it buys is worth it in most cases.

   Safe Browsing Protection

   Safe Browsing is active in the enhanced mode (forced — users cannot override)

5. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/download_restrictions?f=SEARCH.download · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Download restrictions ↗

   Block risky downloads at the browser, before the rendering-distance procedure (№25) even has to apply.

   Download restrictions

   Block malicious downloads, uncommon or unwanted downloads and dangerous file types

   Prevent users from downloading harmful files ↗

6. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/password_manager?f=SEARCH.password%2520protection · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Password manager ↗

   Where the organisation runs a dedicated password manager (1Password, Bitwarden), disable Chrome's built-in one, so credentials live in the audited store rather than in per-profile browser vaults.

   Password manager

   Never allow use of password manager

7. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/relaunch_notification_with_duration?f=SEARCH.relaunch · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Relaunch notification ↗

   Enforce patching with a forced relaunch, so a browser that has downloaded a security fix cannot sit un-restarted for weeks.

   Relaunch notification

   Force relaunch after a period

   Time period

   48 hours

   Initial quiet period

   24 hours

   Notify users to restart to apply pending updates ↗

8. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/cookies?f=SEARCH.cookies · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Cookies ↗

   Shorten the life of third-party session cookies to end on browser restart, to reduce the opportunities of stolen or agent-hijacked sessions on consumer sites. Keep cookies only for the work SaaS you actually need logged in.

   Default cookie setting

   Session only

   Allow cookies for URL patterns

   your corp domains, [*.]google.com, your Slack.

9. Screenshot pending capture — follow the steps below.

   Devices › Chrome › Settings › Users & browsers › Startup pages ↗

   Pin startup to a clean start — session restore reopens the previous session's tabs WITH their cookies, which sidesteps the session-only cookie default of the previous step and lets those cookies persist indefinitely.

   Startup pages

   Open New Tab Page

10. open ↗

    

    https://admin.google.com/ac/chrome/settings/user?f=SEARCH.WebUSB%2520Web%2520Serial · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers ↗

    Close the hardware-API surface: block WebUSB and the Web Serial API by default. Neither is widely enough used to be missed, and each is a large surface if abused (WebUSB has been used to attack security keys).

    WebUSB

    Do not allow sites to request access

    Web Serial API

    Do not allow sites to request access

11. open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/native_messaging_blocked?f=SEARCH.native%2520messaging · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › Native messaging blocked ↗

    Block native messaging by default — it is the bridge from an extension into arbitrary local binaries. * is the only wildcard the list accepts: it denies every host not explicitly allowed in the next step.

    Native messaging blocked hosts

    *

    Chrome policies: Native messaging ↗

12. open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/native_messaging_allowed?f=SEARCH.native%2520messaging · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › Native messaging allowed ↗

    Then allow the specific native-messaging hosts the fleet actually needs — typically the password manager's browser integration and nothing else. Each entry is the host's registered name — reverse-DNS, which is why Google's help calls it a domain name; no wildcards.

    Native messaging allowed hosts

    com.1password.1passwordcom.8bit.bitwarden

    Chrome policies: Native messaging ↗ Native messaging host name format (Chrome for Developers) ↗

13. open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/default_file_system_write_guard_setting_category_item?f=SEARCH.default%2520file%2520system · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › File system write access ↗

    Turn off file system write access for sites, closing the path where a page writes directly to the local disk.

    File system write access

    Do not allow sites to request write access

14. open ↗

    

    https://admin.google.com/ac/chrome/apps/user/settings/details/allow_block_mode_setting · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers › Settings › Allow/block mode ↗

    Move extensions from allow-by-default to allowlist-only, so every extension in the fleet is one someone approved.

    Allow/block mode (Play Store and Chrome Web Store) = Block all apps, admin manages allowlist

    Allow or block apps and extensions ↗

15. open ↗

    

    https://admin.google.com/ac/chrome/apps/user · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers ↗

    Force-install the extensions everyone must run, and add the approved optional ones to the allowlist.

    Force install: password manager, content blocker; allowlisted: the approved optional set

    Automatically install apps and extensions ↗

16. open ↗

    

    https://admin.google.com/ac/chrome/apps/user/settings/details/block_extensions_by_permission · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers › Settings › Block extensions by permission ↗

    Constrain what the allowed extensions may do — an approved extension is still a supply-chain risk, and could extend its permissions on upgrade.

    Blocked permissions (e.g. accessibilityFeatures.modify); ExtensionSettings JSON per extension: runtime_blocked_hosts; pin versions with a cooldown before updates roll

    Set app and extension policies ↗ Prevent Chrome extensions from altering webpages ↗

17. Isolate AI-agent browsing in a separate profile without sync — Gemini, Claude in Chrome and browser-automation extensions reach whatever the profile they run in can reach, and two profiles signed into the same Workspace account are easy to confuse.

    Agent profile's OU: URLBlocklist

    *

    URLAllowlist

    only the sites the agent may touch

Ongoing maintenance

• automatable: AI agent On every Chrome major release: read the enterprise release notes and adjust policies that changed meaning or default.

How to verify

1. On a managed profile, open chrome://policy and confirm the baseline policies are present with status OK and the expected source (Cloud user policy) — no admin access needed.

2. Confirm the browser is actually current.

   chrome://version shows a release ≤ 2 versions behind stable

Further screens

Screen 1 of 1: Devices > Chrome > Settings > Users & browsers

Click to enlarge open ↗