10 Chrome managed-profile policy baseline

Caveats

• Google’s DBSC account-binding is Windows-only as of 2026-07¹
• RestoreOnStartup restores the previous session’s tabs with cookies²
• RestrictSigninToPattern gates only the browser’s profile account³
• These are user/profile-scoped policies, not device-scoped⁴
• AI-agent browsing can also be isolated in a separate profile without sync⁵

Setup steps

1. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/browser_signin_category_item · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Browser sign-in settings ↗

   Select the target OU (organizational unit) and force browser sign-in, so work browsing happens in a profile you control.

   Browser sign-in settings

   Force users to sign in to use the browser

   Force users to sign in to Chrome browser (user policies only) ↗

2. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/restrict_signin_to_pattern_category_item · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Restrict sign-in to pattern ↗

   Restrict which accounts may sign in to the browser, so a personal Google account cannot become the profile's primary account.

   Restrict sign-in to pattern

   .*@<your-domain> (one pattern per Workspace domain)

   Force users to sign in to Chrome browser (user policies only) ↗

3. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/cloud_profile_reporting · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Managed profile reporting ↗

   Turn on managed profile reporting, so the fleet's browsers, versions and extensions actually show up in the console — the visibility the rest of this baseline is verified against.

   Managed profile reporting

   Enabled

   Turn on managed profile reporting ↗

4. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/safe_browsing_protection_level_category_item?f=SEARCH.safe%2520browsing · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Safe Browsing Protection ↗

   Force Enhanced Safe Browsing. It sends more browsing data to Google — a real trade-off, but the detection it buys is worth it in most cases.

   Safe Browsing Protection

   Safe Browsing is active in the enhanced mode (forced — users cannot override)

5. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/download_restrictions?f=SEARCH.download · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Download restrictions ↗

   Block risky downloads at the browser, before the rendering-distance procedure (№25) even has to apply.

   Download restrictions

   Block malicious downloads, uncommon or unwanted downloads and dangerous file types

   Prevent users from downloading harmful files ↗

6. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/password_manager?f=SEARCH.password%2520protection · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Password manager ↗

   Where the organisation runs a dedicated password manager (1Password, Bitwarden), disable Chrome's built-in one, so credentials live in the audited store rather than in per-profile browser vaults.

   Password manager

   Never allow use of password manager

7. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/relaunch_notification_with_duration?f=SEARCH.relaunch · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Relaunch notification ↗

   Enforce patching with a forced relaunch, so a browser that has downloaded a security fix cannot sit un-restarted for weeks.

   Relaunch notification

   Force relaunch after a period

   Time period

   48 hours

   Notify users to restart to apply pending updates ↗

8. open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/cookies?f=SEARCH.cookies · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Cookies ↗

   Shorten the life of third-party session cookies, so a stolen or agent-hijacked session on a consumer site does not survive a browser restart. Keep cookies only for the work SaaS you actually need logged in.

   Default cookie setting

   Keep cookies for the duration of the session

   Allow cookies for URL patterns

   your corp domains, accounts.google.com, mail.google.com, your Slack (or, inverted, session-only for a named list). Do NOT overlap patterns across the allow/block/session-only lists

9. open ↗

   

   https://admin.google.com/ac/chrome/settings/user?f=SEARCH.WebUSB%2520Web%2520Serial · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers ↗

   Close the hardware-API surface: block WebUSB and the Web Serial API by default. Neither is widely enough used to be missed, and each is a large surface if abused (WebUSB has been used to attack security keys).

   WebUSB

   Do not allow sites to request access

   Web Serial API

   Do not allow sites to request access

10. open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/native_messaging_blocked?f=SEARCH.native%2520messaging · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › Native messaging blocked ↗

    Block native messaging by default — it is the bridge from an extension into arbitrary local binaries.

    Native messaging blocked hosts

    *

11. open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/native_messaging_allowed?f=SEARCH.native%2520messaging · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › Native messaging allowed ↗

    Then allow the specific native-messaging hosts the fleet actually needs — typically the password manager's browser integration and nothing else.

    Native messaging allowed hosts

    e.g. com.1password.1password (1Password), com.8bit.bitwarden (Bitwarden)

12. open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/default_file_system_write_guard_setting_category_item?f=SEARCH.default%2520file%2520system · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › File system write access ↗

    Turn off file system write access for sites, closing the path where a page writes directly to the local disk.

    File system write access

    Do not allow sites to request write access

13. open ↗

    

    https://admin.google.com/ac/chrome/apps/user/settings/details/allow_block_mode_setting · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers › Settings › Allow/block mode ↗

    Move extensions from allow-by-default to allowlist-only, so every extension in the fleet is one someone approved.

    Allow/block mode (Play Store and Chrome Web Store) = Block all apps, admin manages allowlist

    Allow or block apps and extensions ↗

14. open ↗

    

    https://admin.google.com/ac/chrome/apps/user · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers ↗

    Force-install the extensions everyone must run, and add the approved optional ones to the allowlist.

    Force install: password manager, content blocker; allowlisted: the approved optional set

    Automatically install apps and extensions ↗

15. open ↗

    

    https://admin.google.com/ac/chrome/apps/user/settings/details/block_extensions_by_permission · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers › Settings › Block extensions by permission ↗

    Constrain what the allowed extensions may do — an approved extension with host access to every site is still a supply-chain risk (65 Apps Script / add-on / AI-agent governance makes the same argument for Workspace add-ons).

    Blocked permissions (e.g. accessibilityFeatures.modify); ExtensionSettings JSON per extension: runtime_blocked_hosts; pin versions with a cooldown before updates roll

    Set app and extension policies ↗ Prevent Chrome extensions from altering webpages ↗

Ongoing maintenance

• automatable: AI agent On every Chrome major release: read the enterprise release notes and adjust policies that changed meaning or default.

How to verify

1. On a managed profile, open chrome://policy and confirm the baseline policies are present with status OK and the expected source (Cloud user policy) — no admin access needed.

2. Confirm the browser is actually current — the forced-update policy only matters if versions move.

   chrome://version shows a release ≤ 2 versions behind stable

Further screens

Screen 1 of 2: Devices > Chrome > Settings > Users & browsers

Click to enlarge open ↗

Screen 2 of 2: Security > Security center > Investigation tool (DBSC binding events — who is actually covered)

Click to enlarge open ↗