Best Practices for

using Chrome Browser

Cloud Management
 Best Practices for using Chrome Browser Cloud 2
Management | August 2023

Table of Contents

Access options for Chrome Browser Cloud Management 04

Getting access to an existing Google Admin console
Using your own domain

Guides 06

Setting up your Organizational Units 08

Setting up Role Based Access Control 09

Setting up integration with 3rd party SAML SSO 10

Rolling out Chrome Browser Cloud Management to production 10

Setting up the console in reporting only mode

Supporting Virtual and Physical Machines 12

Non-persistent VMs
Persistent VMs
Supporting Physical Machines

Viewing the reports in Chrome Browser Cloud Management 14

Applying policies 16

API support for Chrome Browser Cloud Management 16

Troubleshooting issues in Chrome Browser Cloud Management 17

Resources 19
 Best Practices for using Chrome Browser Cloud 3
Management | August 2023

Introduction
Welcome to Chrome Browser Cloud Management.
This guide is meant to be a companion to the Chrome
Browser Cloud Management Deployment Guide.

This document will take you through the process of:

● Getting your Google Admin Console setup.

● Setting up an organizational unit structure to

divide up your machines.

● How to enroll and manage your browsers on

various operating systems, including discussing
any known limitations.

● How policies will work if you have existing

GPOs in place.

● Getting reporting enabled on your devices for

extensions and more.

Step 1 Step 3

Get access to the admin console (admin.google.com) Setup your admin accounts

Options are: (detailed steps here)

● Use existing admin console

● Create a new console via the sign up page

Step 2 Step 4

Setup your organizational units Enroll devices

(detailed steps here) (detailed steps here and additional methods via
various deployment tools located here)
 Best Practices for using Chrome Browser Cloud 4
Management | August 2023

Access options for Chrome

Browser Cloud Management

Following this guide for the setup of Chrome Getting access to an existing
Browser Cloud Management is the best place to Google Admin console
start. It covers all of the initial setup steps. Chrome
Browser Cloud Management itself has no additional Check internally if your company has an existing
cost. Note that there are two options to get access Google Admin account before setting up your own.
to the admin console: Many companies have accounts set up for various
Google services like Chrome OS, Google Workspace
1● Use your own domain (no existing Google or others.
services associated)
● The Super Admin at your company would need
● Provides 10 admins accounts total
to set up your admin account to the console
● Can be associated directly with your where Chrome Browser Cloud Management is
enterprise domain (once you verify your located.
domain)
● They also will be required to add the
2● Use your own domain (Google Services already Chrome Browser Cloud Management
associated) license to the admin console which can be
● Admin console is already set up and verified enabled through going to the Manage
browser section and click the Get started
● Does not have any additional cost or use
button to add the no-cost license to your
any of your Google licenses
Google admin console.
● Number of admins accounts allowed will be
● The console does provide role-based
dependent on associated Google Service
administration so the Super Admin can provide
If it is possible to use your company’s existing you access just to what you need to manage
Google admin console, that is the best option. If the Chrome Browser.
console is already set up, Chrome Browser Cloud
● Note that a Super Admin account is required
Management is already present. You just need to
to generate additional admin accounts.
visit that section in the console and accept the
terms of service. ● Consider asking for a Super Admin account
for your team so you can generate your own
in the future if needed.

● If you can’t find the original owner internally

(like that person has left the company) here
is a link for more information on domain
reclamation.
 Best Practices for using Chrome Browser Cloud 5
Management | August 2023

If your company does have an existing account but you are not the Super Admin,
here is the process of gaining access to Chrome Browser Cloud Management:

11. Have a Super Admin first log 22. Have the Super Admin either 4● Check the box next to
into admin.google.com and create an account with super Organizational Units to give
add the Chrome Browser admin rights and assign it to the following rights:
Cloud Management license you or if they just want to ● Read, Create,
to the admin console which provide access just to Update, Delete.
can be enabled through Chrome Browser
5● Under Chrome Management,
going to the Manage management, then they can
check the Settings box to
browser section and click the provide the following rights
provide all rights to Chrome
Get started button to add the in the admin console:
management.
no-cost license to your
3 ● Under Account>Admin
Google admin console
roles, click the create new
role button and give it a
name like “Chrome Browser
Management”.

Note: if your super admin wants to limit the rights even more on this admin account, they can create
an organizational unit just for Chrome browser management and assign the custom role there.
They can do this via the following steps:

11. In the admin console, go to 33. Select the Chrome browser 4.

4 Once it is assigned you can

Directory>Users and select management custom role that click on the pencil icon on
the user account that you was created in the previous the button that says “All
want to assign the Chrome steps and click on the button organizational units” and
browser management role to. to assign it to the user. select the organizational
unit(s) that you want to give
22. Scroll down and click on the
the admin access to.
Admin roles and privileges
section.

● Once the admin logs in, but will have full rights to do ● You can also view changes
they will not see any other Chrome management and create made in the console for
organizational units aside new Organizational units under auditing purposes. See Admin
from the ones that you the assigned OU. audit log.
have given them access to
 Best Practices for using Chrome Browser Cloud 6
Management | August 2023

Using your own domain

If you want to use your company’s own domain but

do not currently own any Google services, then you
can sign up via this link and Google will provide you
an admin console at no additional cost.

● When the admin console is first launched, the

initial admin will be the Super Admin with full
rights to the console.

● You will have the ability to invite other users

to be admins (who also will be Super Admins)
as well but you will not be able to create
accounts for them, until you verify your
domain. Here is a link for more information on
verifying your domain.

● It is highly recommended to verify your

domain to create custom roles to limit access
to least rights and have the ability to create
user accounts.
● For more information, check out this link about
email-verified vs domain-verified accounts.
 Best Practices for using Chrome Browser Cloud 7
Management | August 2023

Guides

Chrome Browser cloud management has a great section under

Devices>Chrome>Guides that covers many of the sections in this guide, directly in the
admin console with direct links to the relevant sections in the console. It is highly
recommended that you use this guide in the console as it will take you through all of the
steps you need to get started.

Refer to the section below for Chrome Browser Cloud Management.

 Best Practices for using Chrome Browser Cloud 8
Management | August 2023

Setting up your
Organizational Units

Once you have access to the Google admin console, If you are an existing Workspace or Chrome OS
then the next step would be to set up the customer, it is recommended that you create a
Organizational Units that your devices will be separate Organizational Unit structure so there is
managed in. not any conflict in policies that are applied.

● These are the “buckets” that you will separate ● This is to prevent policies originally intended as
your different enrolled devices into so you set user policies inadvertently being applied to
grainlar policy to just those machines. newly enrolled browsers placed into those
organizational units.
● They are set up in a parent-child structure so
anything that is set at the top level will be applied
to the lower OUs.

● Just note that you can override any top level

policy at the sub OU level. To prevent extra
work, it is recommended to only turn on the
cloud reporting policy at the root OU level.

Before you create a complex OU structure, consider

how you are applying Chrome browser policy today.
Do most of your machines receive the same browser
policy?

● If so, then it is recommended as a best practice,

to just have one OU for production and one for
testing. If you need more for a collection of
machines that need a different policy than the
norm, you can always create a new OU at that
point.

● For more information about managing

organizational units, check out this link.
 Best Practices for using Chrome Browser Cloud 9
Management | August 2023

Setting up Role Based

Access Control

Once you have your organizational units setup, then ● This section does have a view reports option,
you can start setting up accounts for your and when coupled with providing only the
administrators. read- only rights of Organizational Units in
step 3, it can provide a read-only
● This way you can delegate access to the
admin role.
various admins that need access.
● This is useful for admins that only need
● You can create admin accounts with just to view reports,
access not set policies.
to Chrome Browser Cloud Management, or to 5.
5 Hit the continue button and then the create role

specific Organizational Units or just provide button to finish.

read- only access.
6.
6 Assign the role to your desired user account in
● For more information about setting up the admin console via Directory>Users>Select
different admin accounts, please refer to the user and scroll down to Admin roles and
this link for more information. privileges.

The Chrome Browser Cloud Management role is a 77. Assign the role that you created in the previous
custom role and to create this you would need to do steps.
the following: ● If you want to limit the scope of this role,
select the pencil icon next to the scope of
11. Go to Account>Admin roles and click on the the role column and limit access to a specific
create new role link. Organizational unit.
● This way your admin will only have the
2.
2 Give the custom role a name like “Chrome
rights assigned above on the
Browser Cloud Management”.
Organizational units that you give them
3.
3 Check the box by Organizational units to give full access to.
rights (read/create/update/delete). ● This is great for shared environments to

● You can only provide read rights, but that will provide least rights to other OUs that

limit the management capabilities of your might have other Google services

browser admin(s). associated with them.

4.
4 Under Chrome Management, check the box next
to “Settings” to give full rights of all of the Chrome
Browser Cloud Management features.
 Best Practices for using Chrome Browser Cloud 10
Management | August 2023

Setting up
integration with
3rd party SAML SSO
You can set up a single sign-on for your Google Admin
console. For more information, please take a look at this
link. Note that super admin users are the only accounts
that are not supported for SAML.

Rolling out Chrome Browser Cloud

Management to production
For more information about enrolling browsers Setting up the console in reporting-only mode
please refer to this link that covers all of the steps
to getting your devices enrolled in the console. Many customers roll out the enrollment in the console
It includes steps for Windows, Mac and Linux, and in a phased approach starting with reporting- only
the various methods and tools that you can use to mode. Chrome Browser Cloud management has great
deploy the token. reporting on Chrome versions and can also provide
in-depth insights on extensions, including where they
● Refer to this link for deploying the enrollment are installed, and what access they have to the
token via various other tools like Jamf, Intune websites that your users are visiting, and/or the
and many more. devices that they are browsing from.

The value of this method is that you can take

advantage of the rich reporting in the console without
having to change your current management method.
It allows your machines to report into the console and
you only need to set a few policies.

Your existing policy for Chrome will not be affected. In

this way, you can take advantage of the reporting
while you decide if you want to manage all of your
policies in the cloud, use the console as a reporting
tool, or a hybrid of both.
 Best Practices for using Chrome Browser Cloud 11
Management | August 2023

To do this: A few things of note for the

enrollment process:
11. Turn on cloud reporting
via this method. ● Chrome will need to be restarted or launched
for policies to
22. Create and set up your organizational units.
be applied from the console.
● No need to over complicate the structure if
● It can take up to 24hrs for an enrolled
your browser policy is flat (where most
browser to show
devices receive the same browser policy).
up in the console.
● One or two OUs is usually sufficient for most
● Changing the enrollment token in the registry
environments: o. One
directly is not a method for moving the
for testing and one
browser from one OU to another. The browser
for production.
needs to be moved directly in the console for
33. Generate an enrollment token from the OU that the change to take effect, or via the API.
you want the browsers to be enrolled into.
● You can invalidate or delete device tokens
4.
4 Deploy the token out to all machines in when you delete browsers from the Admin
production and use the console as a reporting console via the Device Token Management
tool for Chrome versions and installed policy located in the Other settings section in
extensions until you decide if you want to move the admin console.
away from your current management method
into setting everything Chrome- related in the ● It is recommended to change this from the
cloud. default of invalidate token to delete token as it
will allow the enrollment token to remain
behind and if the device was deleted by
mistake, it will re-enroll on next launch of
Chrome.
 Best Practices for using Chrome Browser Cloud 12
Management | August 2023

Supporting Virtual
and Physical Machines
Non-persistent VMs Persistent VMs

The admin console does not The console does support

support non-persistent VMs persistent VMs if each machine
today. You are able to enroll them, has a unique SID (machine GUID).
however, since the machine is This is normally generated by
frequently rebuilt, it will cause running sysprep on the machine
multiple entries in the console, during the imaging process. If you
which will make your reporting are using a system (like Citrix) that
inaccurate. This is because the has the same machine GUID on
machines are marked as unique every machine, then you would
through the machine GUID, which need to run a script (like a run
will change as the machines are once script) to change the
recreated. machine GUID. Doing this will
have the machine show up as a
unique machine.

Here is a workflow of what that might look like (Windows):

11. Close Chrome. 33. Delete Machine-GUID and the new unique
machine guid will be generated as the key
22. Delete Device Token adds itself back in.
located in: ● This key is usually located in:
● HKLM\Software\Google\Chrome\ HKLM\Software\
Enrollment Microsoft\Cryptography\MachineGuid
String value name: dmtoken
44. Restart Chrome.
● Enrollment token can be left
behind unless you want to move
55. Chrome will read the existing enrollment
the device to a new OU location.
token (or new one if you pushed one out)
and will push down a new DMtoke
 Best Practices for using Chrome Browser Cloud 13
Management | August 2023

Supporting Physical Machines

The console fully supports physical machines, managed devices view by the last activity column
however, just note that since the uniqueness of the or click on the “search or add a filter button” and
device is tied to a unique SID (machine GUID), if the select Last activity.
machine is reimaged or if that GUID changes, it will
Decide a timeframe of how long you want
register as a new machine within the console.
machines to remain in the console after being
It is recommended if a machine is reimaged, that it is inactive (like 90 days , a year etc.) and consider
deleted from the console and then re-enrolled under deleting them out. You can also use the API to
the new image to prevent duplicate counts. Another remove these machines after a period. Refer to the
tool to prevent inactive machines from remaining in API support section for more information.
your console is to use the filter feature in the
 Best Practices for using Chrome Browser Cloud 14
Management | August 2023

Viewing reports in Chrome Browser

Cloud Management

Once the devices are enrolled and present within ● It is also recommended to set the Managed
the console, you can start viewing the data that is browser reporting upload frequency to the
coming in. minimum of 3 hours to have reports come up
more frequently than the default 24 hours.
It is recommended that before you start applying
policies (especially around extensions) that you first Under the managed browsers section, you can
take a look at what is already present. select one of your enrolled devices and browse the
Applied Browser Policies section to see what
● You must turn on the cloud reporting feature in
policies are already in effect.
order for data to populate into the console.
 Best Practices for using Chrome Browser Cloud 15
Management | August 2023

To get a viewpoint on the

extensions that are already
installed on that machine,
you can view the Apps and
Extensions section.

To get a viewpoint of all

your installed extensions,
click on the Apps and
extensions usage Report
link on the right.

This view provides all of the extensions that are For a complete list of all extensions and further
present within your enrolled browsers. details, it is recommended to use the Extension
Takeout API.
Hitting the export button provides the ability to
export this list to a CSV file. Here is a link to instructions on how to set this up
and a link to an instructional video.
 Best Practices for using Chrome Browser Cloud 16
Management | August 2023

Applying policies

Once you have your devices reporting into the ● If you want to combine policies from multiple
console, any policies that you currently have applied sources (admin console and local machine
within Group Policies will work with any policies that policy), you can use the policy mergelist policy to
are pushed from the cloud. Local policy will take combine them together: Entering in a * into this
precedence over cloud policy by default if there is a policy will automatically merge all supported
conflict. policies together.

● If you want to override this functionality, in the ● Refer to this link for more information about

admin console there is a policy named Policy policy precedence and policy merging.

precedence where you can change what occurs ● If you set a policy in the console, it will apply to

in case of a conflict. the machine in near real time.

● Note that reports come up to the console by
default every 24 hours:
You can change it to every 3 hours via the
Managed browser reporting upload
frequency policy.

API support for Chrome

Browser Cloud Management

Nearly every setting in the console has API support. ● It has example augments that can move
For scaled management (like moving machines and browsers, delete out inactive browsers, pull
making bulk changes), it is recommended as information, and more.
a best practice to set up the API to make life easier
● It also has some helpful Powershell scripts to
for admins in the console.
wake the browser and force updates and
● For more information on how to setup the API in other useful Chrome Browser Cloud
Chrome Browser Cloud Management, refer to this Management enrollment related scripts.
guide.
● The Chrome Enterprise also has a Github repository
that provides tons of different scripts as well as a
C# framework called CBCM-CSharp that you can
use to learn, create, and solve complex use cases
through automation and integration.
 Best Practices for using Chrome Browser Cloud 17
Management | August 2023

Troubleshooting issues
in Chrome Browser
Cloud Management

My machine is present in the admin console, ● Possible solution 3: The console marks
but no information is being populated (like machines as unique on Windows through the
extension, version etc). machine GUID and via serial number on Macs.

● Possible solution: Make sure that Cloud If you do not use sys-prep on your Windows

reporting is turned on in the Organizational images and the machine GUID is the same,

Unit that the device is enrolled in. then if a machine enrolls with the same
Machine GUID, it will replace the one that is
I pushed out the token to my machines already present in the console.
but many of them are not present in the console.
Refer to the section on supporting Persistent VMs
● Possible solution 1: Chrome needs to be
in this guide on how to change the Machine GUID
restarted or launched in order for it to enroll
on your machines to prevent this issue.
into the console. Usually this happens over
time but if you want to speed things along, you
I set a policy in the console and it has applied on
can use this script that will add the enrollment
the machine but it isn’t showing up in the devices
token, launch the browser in a system context
view in the managed browser section of managed
(users will not see the window being
browser.
displayed), wait 15 seconds for the enrollment
to complete, and then close Chrome. ● Possible solution: By default, policies that you
set in the console apply to the machine in a
● Possible solution 2: Google update is required
few moments, but reporting back into the
to be present on the machine for the
console by default is every 24 hours (you can
enrollment to take place. It does not require for
reduce this to every 3 hours via policy).
Autoupdate to be on. Make sure that Google
update is present on the machine and that the
URLs that are needed for its function are not
blocked. For a list of the URLS, check out this
link, but most importantly the URL that is most
used is: https://m.google.com/device
management/data/api
 Best Practices for using Chrome Browser Cloud 18
Management | August 2023

I am seeing multiple instances of the same I have a lot of machines that are inactive
machine name in the managed browser ue to them being replaced or reimaged.
section of the console.
● Possible solution: Use the filter feature in the
● Possible solution: The console does not managed devices view by the last activity
support non-persistent VMs. If you enroll them column or click on the “search or add a filter
into the console, they will show up under the button” and select Last activity and delete
managed browser section, but once they are them out.
rebuilt they will receive a new Machine GUID
● Or you can set up the
which will have them show up as a duplicate
API and refer to the CBCM-Csharp section
entry, even if the machine name is the same.
on inactive browser deletion to automate
this.
 Best Practices for using Chrome Browser Cloud 19
Management | August 2023

Resources

Setting up Chrome Browser Cloud Management

Chrome Browser Cloud Management Deployment Guide

Chrome Browser Policy List

Chrome update management strategies

Managing Extensions in your Enterprise Guide

Moving from Shadow IT to Managed Chrome Browser