Manage Chrome browser with Intune Settings Catalog (Windows)

For administrators who manage Chrome browser on Windows for a business or school.

As a Chrome Enterprise administrator, you can use Microsoft Intune to deploy and manage Chrome browser on Windows devices.

Before you begin

• You need an administrator account to access the Microsoft Endpoint Manager admin center.
• To apply Chrome policies that are labeled as working only when joined to a Microsoft Active Directory domain, you need:
  • Chrome browser version 69 or later.
  • Any edition of Windows 10 and 11 but not Windows Home.

Step 1: Deploy Chrome browser

1. Download the Chrome browser executable and select the channel taking into account your audience.
2. When the executable is downloaded, you need to prepare it so that it can be uploaded in Intune.
   • Download Microsoft’s Win32 Content Prep tool.
   • Follow these instructions to prepare the Chrome browser app.
3. Sign into the Microsoft Endpoint Manager admin center.
4. Click AppsWindowsAdd.
5. Click Add.
6. For App type, select Windows App (Win32) and then click Select.
7. In the App information page, click Select app package file and search for the file you prepared in step 2.
   Note: The file must have the .intunewin extension.
8. When the file is uploaded, click OK.
9. On the App information page, add your app details.
   Some details of the Chrome browser app might be automatically filled in.
10. Click Next. 
11. In the Program page, configure the app installation and removal commands for the app by following these steps.
12. Click Next.
13. Configure any of the following as required:
    1. In the Requirements page, configure the requirements the device must meet before Chrome browser is installed and click Next.
    2. In the Detection rules page, configure any rules you require and click Next.
    3. In the Dependencies page, configure any dependencies you require and click Next.
    4. In the Supercedence page, configure any supercedences you require and click Next.
    5. In the Assignments page, configure any assignments you require and click Next.
14. Select any applicable Included groups and Excluded groups.
15. Click NextCreate.

Step 2: Configure Chrome browser with Settings Catalog

1. Still in the Microsoft Endpoint Manager admin center, select DevicesWindowsConfiguration Profiles.
2. Click Create Profile.
3. In Platforms, select Windows 10 and later.
4. In Profile type, select Settings Catalog (preview).
5. Enter a configuration name, for example Chrome browser configuration.
6. In the Configuration Settings page, select Add Settings.
7. In the search box, search for Chrome. You can now select from and configure a multitude of settings as detailed in the examples below. 
   Note: You don’t need to create separate policies to configure the different examples below. You can configure the examples below, and more, under the same policy.
8. Click Next.
9. Select any applicable Included groups and Excluded groups, and respective Filters.
10. Click Next.
11. Select any applicable Scope tags.
12. Click NextCreate.

Example A: Enable home button

1. Double click Administrative Templates\Google\Google Chrome\Startup, Home page and New Tab Page.
2. Scroll down and select the Show Home button on toolbar setting.
3. Enable the setting and click Next.

Example B: Configure URL for homepage button

1. Double click Administrative Templates\Google\Google Chrome\Startup, Home page and New Tab Page.
2. Scroll down and select the Configure the home page URL setting.
3. Enable the setting and in the Home page URL (Device), paste your URL. For example, https://www.google.com.
4. Click Next.

Example C: Enable site isolation for specified origins

1. Double click Administrative Templates\Google\Google Chrome\Startup.
2. Scroll down and select the Enable Site Isolation for specified origins setting.
3. Enable the setting and in Enable Site Isolation for specified origins (Device), define the origins.
4. Click Next.

Example D: Configure Legacy Browser Support

1. Double click Administrative Templates\Google\Google Chrome\Legacy Browser Support.
2. Scroll down and select the following settings:
   • Alternative browser to launch for configured websites
   • Enable the Legacy Browser Support feature  
   • Keep last tab open in Chrome
   • Websites to open in alternate browsers
3. Enable the setting and do the following:
   1. In the Alternative browser to launch for configured websites box, select one of the following:
      •  ${ie}
      • ${firefox}
      • ${safari}
      • ${opera}, ${edge}
      • a file path
   2. In the Websites to open in alternate browsers box, define the URLs you want to open in the alternative browser.
4. Click Next.

Example E: Allow specific extensions

1. Double click Administrative Templates\Google\Google Chrome\Extensions.
2. Scroll down and select the Configure extension installation allow list setting.
3. Enable the setting and under Extension IDs to exempt from the blocklist (Device), add the IDs of the extensions you want to add to your allowlist.
4. Click Next.

Example F: Block external extensions from being installed

1. Double click Administrative Templates\Google\Google Chrome\Extensions.
2. Scroll down and select the Block external extensions from being installed setting.
3. Enable the setting and click Next.

Example G: Manage bookmarks

1. Double click Administrative Templates\Google\Google Chrome.
2. Scroll down and select the Enable Bookmark Bar and Managed Bookmarks settings.
3. Enable both settings and in the Managed Bookmarks box paste the URLs you want to add to your list.
4. Click Next.

Step 3: Confirm that the policy is set

After you apply any Chrome policies, users need to restart Chrome browser for the settings to take effect. You can check users’ devices to make sure the policy was applied correctly.

Note: Allow time for Intune to propagate the policy to Chrome on the devices you’re managing. If the policy is taking some time to push, verify that the device is enrolled and you have synced the device to get the latest policies from Intune. 

1. On a managed device, open Chrome browser.
2. In the address bar, enter chrome://policy.
3. Click Reload policies.
4. Verify that the policy you set is enabled.

Step 4: Confirm the policy is set (Intune) 

Allow time for Intune to propagate the policy to Chrome on the devices you’re managing. If the policy is taking some time to push, verify that the device is enrolled and you have synced the device to get the latest policies from Intune. 

1. In the Microsoft Endpoint Manager admin center, select DevicesWindowsConfiguration Profiles, and click on the policy you just created.
2. If want to see which devices have been targeted by the policy, including devices in a pending policy assignment state, click Device assignment status report.
3. If want to view the configuration status of each setting for the policy across all devices and users, select the Per setting status report.

Related topics

• Enroll browsers with Microsoft Intune Settings Catalog (Windows)

Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.