10 Chrome managed-profile policy baseline

Caveats

• These are user/profile-scoped policies, not device-scoped — they follow the managed account onto an unmanaged machine, and they do not constrain a second browser. Pair with device trust (№29) if the threat model includes the endpoint itself.

Setup steps

1. 1. Select the target OU (organizational unit) and force browser sign-in, so work browsing happens in a profile you control.
   open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/browser_signin_category_item · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Browser sign-in settings

   Browser sign-in settings

   Force users to sign in to use the browser

2. 2. Restrict which accounts may sign in to the browser, so a personal Google account cannot become the profile's primary account.
   open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/restrict_signin_to_pattern_category_item · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Restrict sign-in to pattern

   Restrict sign-in to pattern

   .*@<your-workspace-domain>\.org

3. 3. Turn on managed profile reporting, so the fleet's browsers, versions and extensions actually show up in the console — the visibility the rest of this baseline is verified against.
   open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/cloud_profile_reporting · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Managed profile reporting

   Managed profile reporting

   Enabled

4. 4. Force Enhanced Safe Browsing. It sends more browsing data to Google, but the detection it buys is worth it in most cases.
   open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/safe_browsing_protection_level_category_item?f=SEARCH.safe%2520browsing · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Safe Browsing Protection

   Safe Browsing Protection

   Safe Browsing is active in the enhanced mode (forced — users cannot override)

5. 5. Block risky downloads at the browser, before the rendering-distance procedure (№27) even has to apply.
   open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/download_restrictions?f=SEARCH.download · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Download restrictions

   Download restrictions

   Block malicious downloads, uncommon or unwanted downloads and dangerous file types

6. 6. Where the organisation runs a dedicated password manager (1Password, Bitwarden), disable Chrome's built-in one, so credentials live in the audited store rather than in per-profile browser vaults.
   open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/password_manager?f=SEARCH.password%2520protection · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Password manager

   Password manager

   Never allow use of password manager

7. 7. Turn on password alert, so the managed profile's Google password cannot be quietly typed into a phishing page or reused on a consumer site — reuse is what turns one phished credential into the tenant's.

   Devices › Chrome › Settings › Users & browsers › Password alert

   Password alert

   Trigger on password reuse

   Login URLs

   https://accounts.google.com (plus the IdP's sign-in URL where SSO is in place)

   Change password URL

   the page users actually change it on

8. 8. Enforce patching with a forced relaunch, so a browser that has downloaded a security fix cannot sit un-restarted for weeks.
   open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/relaunch_notification_with_duration?f=SEARCH.relaunch · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Relaunch notification

   Relaunch notification

   Force relaunch after a period

   Time period

   48 hours

   Initial quiet period

   24 hours

9. 9. Shorten the life of third-party session cookies to end on browser restart, to reduce the opportunities of stolen or agent-hijacked sessions on consumer sites. Keep cookies only for the work SaaS you actually need logged in.
   open ↗

   

   https://admin.google.com/ac/chrome/settings/user/details/cookies?f=SEARCH.cookies · captured 2026-07-15

   Devices › Chrome › Settings › Users & browsers › Cookies

   Default cookie setting

   Session only

   Allow cookies for URL patterns

   your corp domains, [*.]google.com, your Slack.

10. 10. Pin startup to a clean start — session restore reopens the previous session's tabs WITH their cookies, which sidesteps the session-only cookie default of the previous step and lets those cookies persist indefinitely.

    Screenshot pending capture — follow the steps below.

    Devices › Chrome › Settings › Users & browsers › Startup pages

    Startup pages

    Open New Tab Page

11. 11. Close the hardware-API surface: block WebUSB and the Web Serial API by default. Neither is widely enough used to be missed, and each is a large surface if abused (WebUSB has been used to attack security keys).
    open ↗

    

    https://admin.google.com/ac/chrome/settings/user?f=SEARCH.WebUSB%2520Web%2520Serial · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers

    WebUSB

    Do not allow sites to request access

    Web Serial API

    Do not allow sites to request access

12. 12. Block native messaging by default — it is the bridge from an extension into arbitrary local binaries. * is the only wildcard the list accepts: it denies every host not explicitly allowed in the next step.
    open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/native_messaging_blocked?f=SEARCH.native%2520messaging · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › Native messaging blocked

    Native messaging blocked hosts

    *

13. 13. Then allow the specific native-messaging hosts the fleet actually needs — typically the password manager's browser integration and nothing else. Each entry is the host's registered name — reverse-DNS, which is why Google's help calls it a domain name; no wildcards.
    open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/native_messaging_allowed?f=SEARCH.native%2520messaging · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › Native messaging allowed

    Native messaging allowed hosts

    com.1password.1passwordcom.8bit.bitwarden

14. 14. Turn off file system write access for sites, closing the path where a page writes directly to the local disk.
    open ↗

    

    https://admin.google.com/ac/chrome/settings/user/details/default_file_system_write_guard_setting_category_item?f=SEARCH.default%2520file%2520system · captured 2026-07-15

    Devices › Chrome › Settings › Users & browsers › File system write access

    File system write access

    Do not allow sites to request write access

15. 15. Move extensions from allow-by-default to allowlist-only, so every extension in the fleet is one someone approved.
    open ↗

    

    https://admin.google.com/ac/chrome/apps/user/settings/details/allow_block_mode_setting · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers › Settings › Allow/block mode

    Allow/block mode (Play Store and Chrome Web Store) = Block all apps, admin manages allowlist

16. 16. Force-install the extensions everyone must run, and add the approved optional ones to the allowlist.
    open ↗

    

    https://admin.google.com/ac/chrome/apps/user · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers

    Force install: password manager, content blocker; allowlisted: the approved optional set

17. 17. Constrain what the allowed extensions may do — an approved extension is still a supply-chain risk, and could extend its permissions on upgrade.
    open ↗

    

    https://admin.google.com/ac/chrome/apps/user/settings/details/block_extensions_by_permission · captured 2026-07-15

    Devices › Chrome › Apps & extensions › Users & browsers › Settings › Block extensions by permission

    Blocked permissions (e.g. accessibilityFeatures.modify); ExtensionSettings JSON per extension: runtime_blocked_hosts; pin versions with a cooldown before updates roll

18. 18. Isolate AI-agent browsing in a separate profile without sync — Gemini, Claude in Chrome and browser-automation extensions reach whatever the profile they run in can reach, and two profiles signed into the same Workspace account are easy to confuse.

    Agent profile's OU: URLBlocklist

    *

    URLAllowlist

    only the sites the agent may touch

Ongoing maintenance

• automatable: AI agent On every Chrome major release: read the enterprise release notes and adjust policies that changed meaning or default.

How to verify

1. On a managed profile, open chrome://policy and confirm the baseline policies are present with status OK and the expected source (Cloud user policy) — no admin access needed.

2. Confirm the browser is actually current.

   chrome://version shows a release ≤ 2 versions behind stable

Further screens

Screen 1 of 1: Devices > Chrome > Settings > Users & browsers

Click to enlarge open ↗