How to Enable Chrome Enterprise Enrollment for Kiosk Mode via Google Workspace

The Power of Kiosk Mode

If your organization needs to deploy a fleet of Chromebooks to act as digital signage in the lobby, student testing terminals in a school, or public web-browsing stations in a library, you do not want users logging into the devices with their personal Google accounts. You want the devices locked down, running a single application or website in full-screen mode, with all other operating system features completely disabled.

This is achieved using Chrome Enterprise Kiosk Mode. However, before you can configure the specific Kiosk app, you must first tell Google Workspace that the Chromebook is allowed to be enrolled as a managed device, rather than a consumer device.

Step 1: Verify Enterprise Licensing

Unlike standard Google Workspace user accounts, managing Chrome OS hardware requires specific licenses. You must have either Chrome Enterprise Upgrade or Chrome Education Upgrade licenses available in your billing portal. Without these, the enrollment process will fail.

Step 2: Enable Enrollment Permissions

By default, users cannot simply enroll a device into the corporate domain. A Super Administrator must explicitly grant this permission to a specific Organizational Unit (OU) containing your IT staff.

1. Log into the Google Workspace Admin Console (admin.google.com).
2. Navigate to Devices > Chrome > Settings > Users & browsers.
3. On the left-hand side, select the OU containing your IT technicians (e.g., “IT Support”).
4. Scroll down to the Enrollment Controls section.
5. Change the Device enrollment dropdown to Allow users in this organization to enroll new or deprovisioned devices.
6. Click Save at the top right.

Step 3: Physically Enroll the Device

You must now physically take the brand-new (or factory-reset) Chromebook and interrupt its standard setup process.

1. Power on the Chromebook.
2. Connect it to a Wi-Fi network.
3. When you reach the main “Sign in to your Chromebook” screen, DO NOT enter an email address.
4. Instead, press the key combination: Ctrl + Alt + E.
5. The screen will instantly change to the Enterprise Enrollment screen.
6. Enter the email address and password of an IT technician who resides in the OU you configured in Step 2.
7. Click Enroll enterprise device.

Step 4: Auto-Launch the Kiosk App

Now that the physical hardware is registered to your Google Workspace domain, you can apply the Kiosk policy.

1. Back in the Admin Console, navigate to Devices > Chrome > Apps & extensions > Kiosks.
2. Select the OU where the device now resides (e.g., “Lobby Signs”).
3. Click the yellow + button in the bottom right to add an application. You can add a Chrome Web Store app or simply a specific URL.
4. Once the app is added, click the Auto-launch app dropdown at the top of the list and select your new application.
5. Click Save.

The next time the Chromebook is rebooted, it will automatically connect to the internet, download the policy, and instantly launch the specified application in a locked, full-screen Kiosk mode.