Enroll ChromeOS devices

For administrators who manage ChromeOS devices for a business or school.

To enforce the device policies you set in your Google Admin console, you need to enroll ChromeOS devices. If you’re a Chrome Enterprise Upgrade, Chrome Education Upgrade, or Kiosk & Signage Upgrade customer, you can let users enroll them. Each enrolled device complies with the policies you set until you wipe or deprovision it.

Note: Your account type determines what Chrome features are available to you. For example, if your organization has an education account and you enroll a ChromeOS device bundled with Chrome Enterprise Upgrade, you can't access Chrome features that are exclusive to enterprise accounts.

Before you begin

• Before you can start to enroll devices you must accept the Terms of Service (TOS) agreement by doing the following:
  1. Sign in to your Google Admin console.

     Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to  Menu  DevicesChromeDevices.
  3. In the TOS pop-up, click I Accept.
• ChromeOS devices bundled with Chrome Enterprise Upgrade or Chrome Education Upgrade automatically prompt users to enroll after they accept the end-user license agreement. After enrollment, users can sign in and start using the device. If they’re not prompted to enroll, users should press Ctrl+Alt+E or select Enterprise enrollment before anyone signs in.
• You must enroll devices before anyone signs in to them. If you don’t, you need to wipe the device and restart enrollment. For details, see Wipe ChromeOS device data.
• If you want to control which users can enroll devices in your domain, see the Enrollment permissions user policy.
• By default, devices automatically enroll in the top-level organizational unit. If you want devices to automatically enroll in the organizational unit that the user belongs to, see the Device enrollment user policy.

Manually enroll devices

1. Turn on the device and follow the on-screen instructions until you see either the device setup screen or the sign in screen. If you see the enroll screen instead of the device setup screen or the sign in screen, go to Step 6.

2. In the device setup screen, select how you will use your device and click Next.

3. In the enroll screen, select Enroll the device. 
   To skip to Step 6 directly, you can also use the keyboard shortcut Ctrl+Alt+E.

4. Click Next.

5. Enter your username and password and click Next.

6. If prompted, enter the asset ID and location.
7. Choose the license you want to use to enroll:
   • Chrome Enterprise Upgrade or Chrome Education Upgrade—Click Enroll enterprise device.
   • Kiosk & Signage Upgrade—Click Enroll kiosk or signage device and then click Confirm to verify you are using the correct license type.

8. When you get a confirmation message that the device is successfully enrolled, click Done.

For devices enrolled with Chrome Enterprise Upgrade or Chrome Education Upgrade, users can sign in and start using them. For devices enrolled with Kiosk & Signage Upgrade, users can't sign in or use managed guest sessions.

You can see a list of enrolled devices in your Admin console. For details, see View ChromeOS device details.

Note: If you're enrolling a Chromebook tablet, tap Email or phone. Then, tap More Switch to full layout to open the on-screen keyboard.

Let users enter details during enrollment

To make it easier to monitor and manage devices in your Admin console, let users enter or edit identifying information about the device before they complete enrollment.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Enterprise Core, go to Menu  Chrome browserSettings.

3. To apply the setting to all users and enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
4. Go to Enrollment controls.
5. Click Asset identifier during enrollment.
   1. Select Users in this organization can provide asset ID and location during enrollment.
   2. Click Save. Or, you might click Override for an organizational unit.

      To later restore the inherited value, click Inherit. 

6. Click Enrollment permissions. Choose an option and click Save:
   1. Allow users in this organization to enroll new or re-enroll existing devices—Users can enroll a new device or re-enroll a deprovisioned device. Users can also re-enroll a device that was wiped or factory reset.
   2. Only allow users in this organization to re-enroll existing devices (cannot enroll new or deprovisioned devices)—Users can only re-enroll devices that were wiped or factory reset. They can’t enroll new or re-enroll deprovisioned devices.

How to enterprise enroll your Chromebook

Learn how to enterprise enroll your devices with Chrome Enterprise Upgrade.

How to enterprise enroll your Chromebook

Require managed users to enroll their devices

You can require managed users to enroll their non-zero touch devices if the following conditions are met:

• This is the first user signing into the device. For example, the device is new or just been reset to factory settings.
• The user has the permission required to enroll devices. For more details, see Enrollment permissions.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Enterprise Core, go to Menu  Chrome browserSettings.

3. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

   Group settings override organizational units. Learn more

4. Go to Enrollment controls.
5. For Initial sign-in choose an option:
   • Don't require users to enroll device (default)—Managed users in the organizational unit the policy is assigned to can always sign in without enrolling their devices.
   • Require users to enroll device—Managed users in the organizational unit the policy is assigned to are required to enroll their devices.
6. Click Save. Or, you might click Override for an organizational unit.

   To later restore the inherited value, click Inherit (or Unset for a group).

Troubleshoot

Change the upgrade type

If you accidentally enrolled a device using the wrong upgrade type, you'll need to deprovision the device and enroll it again using the correct upgrade type.

Error: You do not have enough upgrades to enroll this device

You used all of your organization’s available standalone upgrades for other devices. You need to purchase additional standalone upgrades. For details, see Manage Chrome upgrade orders.

Error: This user account is not eligible for the service

You’re trying to enroll a device with a username that isn’t allowed to enroll devices. To let users enroll devices, see the Enrollment permissions user policy.

Related topics

• ChromeOS Device Quick Start Guide
• Move a ChromeOS device to an organizational unit
• Order options for Chrome Enterprise
• Migrating to cloud-based Chrome management