How to Configure Google Workspace Chrome Browser Enterprise Management

The Rogue Browser Problem

If you allow your employees to use Google Chrome on their corporate laptops without central management, you are operating with a massive blind spot. Employees will log into Chrome using their personal @gmail.com accounts, install malicious browser extensions (like unverified PDF converters or coupon clippers), and save corporate passwords directly into their unencrypted personal profiles.

To secure the browser endpoint, you must implement Chrome Browser Cloud Management (CBCM) within Google Workspace. This framework allows IT administrators to take authoritative control of every instance of Google Chrome running on Windows, macOS, or Linux across the entire company. You can forcefully block extensions, dictate the homepage, enforce Safe Browsing, and completely disable Incognito Mode—all from the cloud, without needing a massive Active Directory Group Policy infrastructure.

Step 1: Enrolling the Browsers

You cannot manage a browser until it is cryptographically enrolled into your Google Workspace tenant. You do this by deploying an Enrollment Token.

1. Log into the Google Workspace Admin Console.
2. Navigate to Devices > Chrome > Managed browsers.
3. Click the Enroll button at the top right.
4. Copy the generated Enrollment Token string.

You must now push this token to your fleet of laptops using your MDM (like Intune or Jamf) or via a simple PowerShell script on Windows.

For a Windows machine, you simply inject the token into the registry:

New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Name "CloudManagementEnrollmentToken" -Value "YOUR_TOKEN_HERE"

The next time the user opens Chrome on that Windows machine, the browser will read the registry, reach out to Google’s servers, and permanently bind itself to your IT department.

Step 2: Blocking Malicious Extensions

Once the browsers are enrolled, you can start pushing security policies. The most critical policy is blocking extensions.

1. In the Admin Console, navigate to Devices > Chrome > Apps & extensions > Users & browsers.
2. Select your root Organizational Unit (OU) on the left.
3. Click the Additional Settings gear icon.
4. Change the Allow/Block Mode to Block all apps and extensions.

This is a default-deny posture. Every single extension is now banned.

Step 3: Whitelisting Required Tools

You must now punch holes in the blocklist for the tools your employees actually need (like 1Password or Zoom).

1. Click the yellow + button in the bottom right corner and select Add from Chrome Web Store.
2. Search for “1Password” and click Select.
3. In the installation policy dropdown, change it from “Allow install” to Force install + pin to browser toolbar.

Google Workspace will now reach out to every laptop in your company, forcefully uninstall the malicious coupon clippers, and silently push 1Password to the toolbar so it is ready the next time the employee opens Chrome.

Step 4: Restricting Login to Corporate Accounts

To prevent data leakage, you must stop employees from logging into Chrome with their personal Gmail accounts.

1. Navigate to Devices > Chrome > Settings > Users & browsers.
2. Search for Sign-in restriction.
3. Enter your corporate domain (e.g., *@corp.com).

If an employee tries to log into the browser sync with [email protected], Chrome will instantly block it, ensuring that all corporate bookmarks, history, and passwords remain strictly within your audited Workspace tenant.