Managed guest session devices

For administrators who manage ChromeOS devices for a business or school.

With managed guest sessions, multiple users can share the same ChromeOS devices without having to sign in to their Google Account. For example, use managed guest sessions to configure ChromeOS devices as loaner devices, shared computers.

With managed guest sessions, your users can have a full browsing experience and access multiple websites in windowed mode, not full-screen.

Before you begin

Enroll the devices that you want to let users run managed guest sessions on. For details, see Enroll ChromeOS devices.
Place devices that users will use to run managed guest sessions in an organizational unit. You can place a ChromeOS device in only one organizational unit at a time. You can then apply managed guest session settings to devices in that organizational unit.
Managed guest session pods are prioritized over user pods on the sign-in screen. Make sure that the sign-in screen displays users’ names and pictures. For details, see Sign-in screen.
Chrome Enterprise Upgrade and Chrome Education Upgrade, either standalone or bundled with devices, are required for each ChromeOS device that you want to run a managed guest session on. Kiosk & Signage Upgrade does not support deploying managed guest sessions.
Private apps and extensions that are limited to users in a domain can't be installed because managed guest sessions don't require users to sign in.

Set up managed guest sessions

Step 1: Configure your ChromeOS devices

Step 2: Configure managed guest session settings

Settings that are unique to managed guest sessions are in the table below. Most settings that are available on the Managed guest session settings page are also available on the User & browsers settings page. The policies behave in a similar way, but they apply inside the guest session instead of when users are signed in. These policies are described in Set Chrome policies for users or browsers.

Setting	Description
Managed guest session	Session name to appear on login screen The name that you want your users to see for the session. The settings below are only available for managed guest sessions that automatically launch on ChromeOS devices Auto-launch delay Enter the number of seconds to wait before automatically launching the managed guest session. Enable device health monitoring Select Enable device health monitoring to allow the health status of a kiosk to be reported. Then, you can check if a device is online and working properly. For information, see Monitor kiosk health. Enable device system log upload Important: Before using this setting, you must inform the users of managed kiosk devices that their activity might be monitored and data might be inadvertently captured and shared. Without notification to your users, you are in violation of the terms of your agreement with Google. Select Enable device system log upload to automatically capture system logs for kiosk devices. Logs are captured every 12 hours and uploaded to your Admin console. Logs are stored for up to 60 days. At any one time, 7 logs are available to download: Each day of the past 5 days 30 days ago 45 days ago For information, see Monitor kiosk health. Screen rotation (clockwise) To configure screen rotation for your kiosk devices, select your desired screen orientation. For example, to rotate the screen for a portrait layout, select 90 Degrees. This policy can be overridden by manually configuring the device to a different screen orientation.
Maximum user session length	Sign the user out of the session after a specified amount of time, between one and 1,440 minutes. For unlimited sessions, do not enter a value.
Idle settings	Action on idle Select what you want the device to do after the idle time expires. Choose whether devices go to sleep, exit session, shut down, or do nothing. Idle time in minutes To specify the amount of idle time, enter a value in minutes. To use the system default, which varies by device, leave the box empty. Action on lid close Choose whether you want devices to go to sleep, exit session, shut down, or do nothing when users close the device lid.
Screen saver	Specifies whether an idle ChromeOS device displays a screen saver on the lock screen. The default is to not display a screen saver when idle. If you select Display screen saver on lock screen when idle, do the following: Screen saver image URLs Add the image URls you want to display. The following applies: Add one URL per line. Each item must be a URL referencing an image file and begin with https://. Google does not verify whether an image is available under the specified URLs. Images must be .jpg or .jpeg files and the file size must not exceed 8MB. At least 2 valid images are required before the screen saver is activated. Invalid URLs and unsupported images are ignored. The number of images is limited to 25. Only the first 25 URL entries from the list are used. The ChromeOS device downloads the images and stores them in a local cache. If an image for the specified URL changes after the image is cached, it might not be updated. Activation Enter the time in seconds that the device remains idle before showing the screen saver on the lock screen. Valid values range from 1 second to 9999 seconds. If you leave the field empty, the default value of 7 seconds is used. Refresh Enter the interval in seconds to change the displayed image.. Valid values range from 1 second to 9999 seconds. If you leave the field empty, the default value of 60 seconds is used.
Display the logout confirmation dialog	By default, Show logout dialog when the last window is closed is selected. Users are prompted to confirm whether they want to sign out of Chrome when they close the last window. If you select Do not show logout dialog when the last window is closed, users are not automatically signed out of Chrome when they close the last window.
Browser launch on startup	Specifies whether Chrome Browser should automatically launch when users start their ChromeOS devices.
Session Locale	Specify the order of recommended languages on the ChromeOS device's sign-in screen. If you do not specify any recommended languages—ChromeOS will keep the current language when starting a managed guest session. The user can change this default setting when they start the session. If you specify only one language—ChromeOS will use this language when starting a managed guest session. The user can change this default setting when they start the session. If you specify more than one language—ChromeOS will ask the user to choose a language when starting a managed guest session. You can choose the order of languages in the list. By default, Chrome uses the most popular keyboard layout for the chosen language. Users can change the keyboard layout when they start the session. The language and keyboard layout will go back to their previous values when the managed guest session ends.
Persist display settings	Lets devices keep display settings that users set in managed guest sessions, even after sessions end. By default, all display settings are reset as soon as sessions end.

Step 3: Apply additional settings and policies

How to set up managed guest sessions

Learn how to create organizational units, apply an initial managed guest session policy, and move enrolled devices to the organizational unit to receive the policy.

How users browse in managed guest sessions

On the sign-in screen, users see the session display name that you set in Step 1 above. To use a managed guest session, users:

Click the managed guest session pod.
Users see:
- The domain name of the organization that manages the session
- A message that the admin might have access to all activity during the session, including passwords and communications
Click Next.
If there is a custom Terms of Service agreement, click Accept to start the session.
Start browsing the web.

The session is valid until the user signs out, reaches the maximum session time, or reaches the specified amount of idle time for the device. When the managed guest session ends, the user is automatically signed out and all local user data is wiped from the device.