# 10 Chrome managed-profile policy baseline

> v0.7.0 · role: Prevent · edition: All (Chrome Ent Core: free) · [policy: #27 · #7](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Forces work browsing into a managed profile (sign-in restricted to your domains), forces Enhanced Safe Browsing, password-reuse warnings, relaunch for updates, makes third-party cookies session-only, removes the WebUSB/Web Serial surface and native messaging (bar an allowlist), and moves extensions from allow-by-default to allowlist-only with per-extension permission and host limits. Chrome Enterprise Core is free, so none of this is licence-gated.

Documentation: [Set Chrome policies for users or browsers](https://support.google.com/chrome/a/answer/2657289) · [Managing Extensions in Your Enterprise](https://support.google.com/chrome/a/answer/9296680)

## Caveats

- These are user/profile-scoped policies, not device-scoped — they follow the managed account onto an unmanaged machine, and they do not constrain a second browser. Pair with device trust (№29) if the threat model includes the endpoint itself.

## Setup steps

1. Select the target OU (organizational unit) and force browser sign-in, so work browsing happens in a profile you control. — `Devices › Chrome › Settings › Users & browsers › Browser sign-in settings`

   - **Browser sign-in settings** = Force users to sign in to use the browser

   docs: [Force users to sign in to Chrome browser (user policies only)](https://support.google.com/chrome/a/answer/7572556)

2. Restrict which accounts may sign in to the browser, so a personal Google account cannot become the profile's primary account. — `Devices › Chrome › Settings › Users & browsers › Restrict sign-in to pattern`

   - **Restrict sign-in to pattern** = .*@<your-workspace-domain>\.org
   Note: This gates only the browser’s profile account. It does nothing about a user opening gmail.com in a tab and signing into a personal account. This just prevents the personal account from becoming the browser profile.

   docs: [Force users to sign in to Chrome browser (user policies only)](https://support.google.com/chrome/a/answer/7572556)

3. Turn on managed profile reporting, so the fleet's browsers, versions and extensions actually show up in the console — the visibility the rest of this baseline is verified against. — `Devices › Chrome › Settings › Users & browsers › Managed profile reporting`

   - **Managed profile reporting** = Enabled

   docs: [Turn on managed profile reporting](https://support.google.com/chrome/a/answer/15669709)

4. Force Enhanced Safe Browsing. It sends more browsing data to Google, but the detection it buys is worth it in most cases. — `Devices › Chrome › Settings › Users & browsers › Safe Browsing Protection`

   - **Safe Browsing Protection** = Safe Browsing is active in the enhanced mode (forced — users cannot override)

5. Block risky downloads at the browser, before the rendering-distance procedure ([№27](rendering-distance-handling.md)) even has to apply. — `Devices › Chrome › Settings › Users & browsers › Download restrictions`

   - **Download restrictions** = Block malicious downloads, uncommon or unwanted downloads and dangerous file types

   docs: [Prevent users from downloading harmful files](https://support.google.com/chrome/a/answer/7579271)

6. Where the organisation runs a dedicated password manager (1Password, Bitwarden), disable Chrome's built-in one, so credentials live in the audited store rather than in per-profile browser vaults. — `Devices › Chrome › Settings › Users & browsers › Password manager`

   - **Password manager** = Never allow use of password manager
   Note: Rolling this out to existing users? Check with them first whether they currently keep credentials in Chrome's built-in password manager, and give them time to migrate their secrets into 1Password before the switch-off.

7. Turn on password alert, so the managed profile's Google password cannot be quietly typed into a phishing page or reused on a consumer site — reuse is what turns one phished credential into the tenant's. — `Devices › Chrome › Settings › Users & browsers › Password alert`

   - **Password alert** = Trigger on password reuse
   - **Login URLs** = https://accounts.google.com (plus the IdP's sign-in URL where SSO is in place)
   - **Change password URL** = the page users actually change it on
   Note: If the broad trigger is too noisy, start with 'Trigger on password reuse on phishing page' and widen once the allowlist of legitimate sign-in pages is complete.

   docs: [Set up active password detection](https://support.google.com/chrome/a/answer/9696707)

8. Enforce patching with a forced relaunch, so a browser that has downloaded a security fix cannot sit un-restarted for weeks. — `Devices › Chrome › Settings › Users & browsers › Relaunch notification`

   - **Relaunch notification** = Force relaunch after a period
   - **Time period** = 48 hours
   - **Initial quiet period** = 24 hours

   docs: [Notify users to restart to apply pending updates](https://support.google.com/chrome/a/answer/7679871)

9. Shorten the life of third-party session cookies to end on browser restart, to reduce the opportunities of stolen or agent-hijacked sessions on consumer sites. Keep cookies only for the work SaaS you actually need logged in. — `Devices › Chrome › Settings › Users & browsers › Cookies`

   - **Default cookie setting** = Session only
   - **Allow cookies for URL patterns** = your corp domains, [*.]google.com, your Slack.
   Note: You can also invert this: session-only for a named list. Do NOT overlap patterns across the allow/block/session-only lists

10. Pin startup to a clean start — session restore reopens the previous session's tabs WITH their cookies, which sidesteps the session-only cookie default of the previous step and lets those cookies persist indefinitely. — `Devices › Chrome › Settings › Users & browsers › Startup pages`

   - **Startup pages** = Open New Tab Page

11. Close the hardware-API surface: block WebUSB and the Web Serial API by default. Neither is widely enough used to be missed, and each is a large surface if abused (WebUSB has been used to attack security keys). — `Devices › Chrome › Settings › Users & browsers`

   - **WebUSB** = Do not allow sites to request access
   - **Web Serial API** = Do not allow sites to request access

12. Block native messaging by default — it is the bridge from an extension into arbitrary local binaries. * is the only wildcard the list accepts: it denies every host not explicitly allowed in the next step. — `Devices › Chrome › Settings › Users & browsers › Native messaging blocked`

   - **Native messaging blocked hosts** = *

   docs: [Chrome policies: Native messaging](https://support.google.com/chrome/a/answer/2657289#native_messaging_blocklist)

13. Then allow the specific native-messaging hosts the fleet actually needs — typically the password manager's browser integration and nothing else. Each entry is the host's registered name — reverse-DNS, which is why Google's help calls it a domain name; no wildcards. — `Devices › Chrome › Settings › Users & browsers › Native messaging allowed`

   - **Native messaging allowed hosts** = com.1password.1password
     com.8bit.bitwarden
   Note: These hosts are how biometric unlock works: the extension asks the desktop app to authenticate (Touch ID, Windows Hello) over native messaging, so blocking them degrades every unlock to master-password entry. Both products register their host at USER level — leave 'Allow user-level Native Messaging hosts' on, or the allowlist entry changes nothing.

   docs: [Chrome policies: Native messaging](https://support.google.com/chrome/a/answer/2657289#native_messaging_blocklist) · [Native messaging host name format (Chrome for Developers)](https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging)

14. Turn off file system write access for sites, closing the path where a page writes directly to the local disk. — `Devices › Chrome › Settings › Users & browsers › File system write access`

   - **File system write access** = Do not allow sites to request write access

15. Move extensions from allow-by-default to allowlist-only, so every extension in the fleet is one someone approved. — `Devices › Chrome › Apps & extensions › Users & browsers › Settings › Allow/block mode`

   Allow/block mode (Play Store and Chrome Web Store) = Block all apps, admin manages allowlist

   docs: [Allow or block apps and extensions](https://support.google.com/chrome/a/answer/6177431)

16. Force-install the extensions everyone must run, and add the approved optional ones to the allowlist. — `Devices › Chrome › Apps & extensions › Users & browsers`

   Force install: password manager, content blocker; allowlisted: the approved optional set

   docs: [Automatically install apps and extensions](https://support.google.com/chrome/a/answer/6306504)

17. Constrain what the allowed extensions may do — an approved extension is still a supply-chain risk, and could extend its permissions on upgrade. — `Devices › Chrome › Apps & extensions › Users & browsers › Settings › Block extensions by permission`

   Blocked permissions (e.g. accessibilityFeatures.modify); ExtensionSettings JSON per extension: runtime_blocked_hosts; pin versions with a cooldown before updates roll
   Note: [67 Apps Script / add-on / AI-agent governance](appsscript-governance.md) makes the same argument for Workspace add-ons

   docs: [Set app and extension policies](https://support.google.com/chrome/a/answer/9039146) · [Prevent Chrome extensions from altering webpages](https://support.google.com/chrome/a/answer/9031935)

18. Isolate AI-agent browsing in a separate profile without sync — Gemini, Claude in Chrome and browser-automation extensions reach whatever the profile they run in can reach, and two profiles signed into the same Workspace account are easy to confuse.

   - **Agent profile's OU: URLBlocklist** = *
   - **URLAllowlist** = only the sites the agent may touch
   Note: The tight allowlist doubles as a tripwire for humans — a user who lands in the agent profile by mistake notices immediately, because their normal sites refuse to load.

## Ongoing maintenance

- **[automatable: AI agent]** On every Chrome major release: read the enterprise release notes and adjust policies that changed meaning or default.

## How to verify

1. On a managed profile, open chrome://policy and confirm the baseline policies are present with status OK and the expected source (Cloud user policy) — no admin access needed.

2. Confirm the browser is actually current.

   chrome://version shows a release ≤ 2 versions behind stable

## Settings screens

- Devices > Chrome > Settings > Users & browsers
  - console: https://admin.google.com/ac/chrome/settings/user
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user.png
- Devices > Chrome > Settings > Users & browsers > Browser sign-in settings
  - console: https://admin.google.com/ac/chrome/settings/user/details/browser_signin_category_item
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/browser_signin_category_item.png
- Devices > Chrome > Settings > Users & browsers > Restrict sign-in to pattern
  - console: https://admin.google.com/ac/chrome/settings/user/details/restrict_signin_to_pattern_category_item
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/restrict_signin_to_pattern_category_item.png
- Devices > Chrome > Settings > Users & browsers > Managed profile reporting
  - console: https://admin.google.com/ac/chrome/settings/user/details/cloud_profile_reporting
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/cloud_profile_reporting.png
- Devices > Chrome > Settings > Users & browsers > Safe Browsing Protection
  - console: https://admin.google.com/ac/chrome/settings/user/details/safe_browsing_protection_level_category_item?f=SEARCH.safe%2520browsing
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/safe_browsing_protection_level_category_item__f-SEARCH.safe-browsing.png
- Devices > Chrome > Settings > Users & browsers > Download restrictions
  - console: https://admin.google.com/ac/chrome/settings/user/details/download_restrictions?f=SEARCH.download
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/download_restrictions__f-SEARCH.download.png
- Devices > Chrome > Settings > Users & browsers > Password manager
  - console: https://admin.google.com/ac/chrome/settings/user/details/password_manager?f=SEARCH.password%2520protection
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/password_manager__f-SEARCH.password-protection.png
- Devices > Chrome > Settings > Users & browsers > Relaunch notification
  - console: https://admin.google.com/ac/chrome/settings/user/details/relaunch_notification_with_duration?f=SEARCH.relaunch
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/relaunch_notification_with_duration__f-SEARCH.relaunch.png
- Devices > Chrome > Settings > Users & browsers > Cookies
  - console: https://admin.google.com/ac/chrome/settings/user/details/cookies?f=SEARCH.cookies
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/cookies__f-SEARCH.cookies.png
- Devices > Chrome > Settings > Users & browsers > Startup pages
  - console: https://admin.google.com/ac/chrome/settings/user/details/startup_pages?f=SEARCH.RestoreOnStartup
- Devices > Chrome > Settings > Users & browsers (filtered to WebUSB / Web Serial)
  - console: https://admin.google.com/ac/chrome/settings/user?f=SEARCH.WebUSB%2520Web%2520Serial
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user__f-SEARCH.WebUSB-Web-Serial.png
- Devices > Chrome > Settings > Users & browsers > Native messaging blocked
  - console: https://admin.google.com/ac/chrome/settings/user/details/native_messaging_blocked?f=SEARCH.native%2520messaging
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/native_messaging_blocked__f-SEARCH.native-messaging.png
- Devices > Chrome > Settings > Users & browsers > Native messaging allowed
  - console: https://admin.google.com/ac/chrome/settings/user/details/native_messaging_allowed?f=SEARCH.native%2520messaging
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/native_messaging_allowed__f-SEARCH.native-messaging.png
- Devices > Chrome > Settings > Users & browsers > File system write access
  - console: https://admin.google.com/ac/chrome/settings/user/details/default_file_system_write_guard_setting_category_item?f=SEARCH.default%2520file%2520system
  - screenshot: ../screenshots/admin.google.com/ac/chrome/settings/user/details/default_file_system_write_guard_setting_category_item__f-SEARCH.default-file-system.png
- Devices > Chrome > Apps & extensions > Users & browsers > Settings > Allow/block mode
  - console: https://admin.google.com/ac/chrome/apps/user/settings/details/allow_block_mode_setting
  - screenshot: ../screenshots/admin.google.com/ac/chrome/apps/user/settings/details/allow_block_mode_setting.png
- Devices > Chrome > Apps & extensions > Users & browsers (force-install + allowlist)
  - console: https://admin.google.com/ac/chrome/apps/user
  - screenshot: ../screenshots/admin.google.com/ac/chrome/apps/user.png
- Devices > Chrome > Apps & extensions > Users & browsers > Settings > Block extensions by permission
  - console: https://admin.google.com/ac/chrome/apps/user/settings/details/block_extensions_by_permission
  - screenshot: ../screenshots/admin.google.com/ac/chrome/apps/user/settings/details/block_extensions_by_permission.png