How to Configure Ephemeral Profiles, Managed Bookmarks, and Device Trust Connectors in Google Chrome

Modern enterprise workstation security relies heavily on zero-trust endpoint architectures where sensitive corporate data must never persist on shared, kiosk, or non-corporate hardware. When contractors, frontline staff, or call-centre employees navigate corporate web applications, local browser caching frequently leaves session cookies, cached authentication tokens, and downloaded document remnants on the host filesystem. In Google Chrome Enterprise, configuring Ephemeral Profiles, managed administrative bookmarks, and Device Trust Connectors ensures that browser profiles purge completely upon window closure while maintaining strict corporate navigation boundaries.

Architectural Overview: Ephemeral Profile Sandboxes and Enterprise Device Trust

Understanding how Chrome instantiates profile directories and coordinates cryptographic attestation explains how ephemeral sessions maintain memory-isolated security without disrupting managed browsing policies.

Architecture Component	Operating Mechanism	Storage Lifecycle	Enterprise Security Function
Ephemeral Profile Manager	Instantiates a dynamic user profile directory linked to the active browser process.	Purged atomically from disk (AppData\Local\Google\Chrome\User Data\<Profile>) when the last window closes.	Eliminates forensic residual artefacts, session hijack tokens, and local cache leakage on shared endpoints.
Managed Bookmarks Engine	Enforces read-only JSON bookmark hierarchies deployed via administrative policy.	Persisted in memory via Google Admin Console or local GPO; non-editable by end users.	Guarantees deterministic corporate intranet access and prevents typosquatting navigation.
Device Trust Connector	Mutual TLS (mTLS) handshake verifying endpoint compliance via secure enclave keys.	Cryptographic attestation token generated per session.	Enforces Conditional Access: restricts sensitive cloud resources strictly to compliant, managed hardware.

Configuring Ephemeral Profiles via Windows Group Policy and Registry

Enterprise administrators managing Windows 11 fleets can enforce ephemeral behaviour globally or target specific non-persistent Active Directory user accounts.

1. Enforcing Ephemeral Mode via Group Policy (GPO)

1. Open the Group Policy Management Console (gpmc.msc) on your domain controller.
2. Navigate to Computer Configuration > Administrative Templates > Google > Google Chrome.
3. Locate the policy setting: Set Chrome to ephemeral mode (DeviceEphemeralProfileEnabled).
4. Double-click the setting, select Enabled, and click Apply.

2. Direct Registry Configuration

For standalone kiosks or virtual desktop environments (VDI) without Active Directory, deploy the directive via PowerShell:

# Enforce Ephemeral Mode for all local profiles
New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Name "DeviceEphemeralProfileEnabled" -Value 1 -Type DWord

When users launch Chrome, any newly created session acts as an ephemeral sandbox: upon exiting all browser windows, Chrome unlinks and shreds the associated profile subdirectory.

Deploying Managed Bookmarks and Navigation Whitelists

To provide instant access to approved enterprise portals within ephemeral profiles without relying on cloud sync:

1. Formulating the Managed Bookmarks JSON Schema

Chrome accepts a structured JSON array defining top-level folders and hyperlinked destinations:

[
  {
    "toplevel_name": "Corporate Intranet"
  },
  {
    "name": "ERP Portal",
    "url": "https://erp.corp.example.com"
  },
  {
    "name": "HR Self-Service",
    "url": "https://hr.corp.example.com"
  },
  {
    "name": "Help Desk",
    "children": [
      {
        "name": "Submit Ticket",
        "url": "https://servicedesk.corp.example.com/new"
      },
      {
        "name": "Knowledge Base",
        "url": "https://servicedesk.corp.example.com/kb"
      }
    ]
  }
]

2. Applying the Policy

In Group Policy under Google Chrome, enable Managed Bookmarks (ManagedBookmarks) and paste the minified JSON string into the text box. Managed bookmarks appear automatically in an unmodifiable yellow folder at the left of the bookmarks bar.

Configuring Device Trust Connectors for Context-Aware Access

Device Trust Connectors link Google Chrome Enterprise with Google Workspace Context-Aware Access or third-party Identity Providers (such as Okta or Ping Identity) to verify device health signals before granting entry to corporate web apps.

1. Access Google Admin Console: Log in to admin.google.com as a Super Administrator.
2. Navigate to Device Settings: Go to Devices > Chrome > Settings > Users & browsers.
3. Enable Device Trust: Under the Security category, locate Device Trust Connector. Select Enable Device Trust Connector.
4. Configure Service Provider URL Patterns: Specify the FQDN matching patterns of corporate Identity Providers permitted to query endpoint posture telemetry (e.g., https://identity.corp.example.com/*).
5. Deploy Endpoint Verification Extension: Push the official Google Endpoint Verification extension to all enterprise Chrome instances via the Apps & extensions management panel. The extension interfaces with the local TPM (Trusted Platform Module) to issue cryptographic attestation tokens.

Root-Cause Troubleshooting Matrix

When ephemeral profiles fail to purge or managed bookmarks do not render, consult the diagnostic guide below.

Observed Issue	Underlying Cause	Remediation Procedure
Profile data persists on disk after closing Chrome	Background apps or extensions retaining open process handles in the background.	Disable Continue running background apps when Google Chrome is closed via GPO (BackgroundModeEnabled = 0).
Managed Bookmarks folder missing from interface	Malformed JSON syntax, unescaped quotation marks, or missing toplevel_name key.	Validate JSON string using jq or an online linter; verify policy ingestion at chrome://policy under the ManagedBookmarks entry.
Device Trust handshake fails with 403 Forbidden	Endpoint Verification extension lacks native messaging host permissions or TPM offline.	Check chrome://extensions; ensure Endpoint Verification is enabled with access to corporate URLs; check TPM status in Windows via tpm.msc.
“Managed by your organisation” banner absent	Registry values written to HKCU instead of HKLM, or policy template version mismatch.	Ensure policies reside under HKLM\SOFTWARE\Policies\Google\Chrome; run gpupdate /force and inspect active policies in chrome://policy.

Operational Hardening and Lifecycle Best Practices

To preserve uncompromising privacy and endpoint hygiene across managed Chrome fleets:

• Combine Ephemeral Mode with Incognito Disabling: In kiosk configurations, set IncognitoModeAvailability = 1 (Disabled) to force all browsing through the managed ephemeral profile where security logging and URL filters remain enforceable.
• Enforce Download Directory Purging: Pair ephemeral profiles with DownloadDirectory mapped to a RAM disk or scratch folder configured to wipe automatically on user logoff.
• Lock URL Navigation Rules: Deploy URLBlocklist (*) and URLAllowlist (corporate subdomains) in conjunction with managed bookmarks to convert Chrome into a hardened single-purpose enterprise browser.