Use Chromebooks for student assessments

When set up properly, Chromebooks meet K–12 education testing standards and are a secure platform for student assessments. You can disable students’ access to browse the web during an exam, external storage, screenshots, and the ability to print.

Both the Partnership for Assessment of Readiness for College and Careers (PARCC) and the Smarter Balanced Assessment Consortium have verified that Chromebooks meet hardware and operating system requirements for online student assessments.

Before you begin

• If you don’t already have Google Workspace for Education, for each Chromebook that you want to use, get help in signing up here.
• Enroll each Chromebook in your school’s domain. See Enroll ChromeOS devices.
• Move students taking the assessment to an organizational unit. For details, see Move users to an organizational unit.
• To make settings for a specific group of users or enrolled Chrome browsers, put the user accounts or browsers in a group or organizational unit. Only user accounts can be added to groups. For details, see Groups and Add an organizational unit.
• We recommend you set User data to Do not erase local user data for the duration of the assessment period to avoid student data loss if the device needs to be rebooted or loses power. For more details, see User data.

Set up Chromebooks for assessments

Option 1: School sets up Chromebook as a single-app kiosk running the exam app

Requirement: You need to have the exam available as a Chrome kiosk app. For more information, see Create and deploy Chrome kiosk apps.

1. Sign in with an administrator account to the Google Admin console.

   If you aren’t using an administrator account, you can’t access the Admin console.

2. Go to Menu  Devices > Chrome > Apps & extensions > Kiosks.
3. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how

4. Find and click the app you want to use and configure the settings. For details, see View and configure apps and extensions.

5. Next to Auto-launch app, choose the app that you want to automatically launch on ChromeOS devices.

6. (Strongly recommended) To make sure local student data is not erased during the exam:
   1. Go to Menu  Devices > Chrome > Settings > Device settings.

      Requires having the Mobile Device Management administrator privilege.

   2. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
   3. Go to Sign-in settings.
   4. Click User data.
   5. Select Do not erase all local user data.
   6. Click Save.

Auto-launch setting for a kiosk app

• If Auto-launch kiosk app is not configured, then the student sees a menu of kiosk apps in the system tray on the sign-in screen. The student must select the appropriate kiosk app to launch it and take the test. After the test is complete, the student can exit the kiosk app and sign back into a user session.
• If Auto-launch kiosk app is configured, when the device next starts, it immediately loads the kiosk app.

For help setting up kiosks, see Managed guest setting.

Option 2: Testing provider sets up domain and student accounts for assessment

Steps for the provider:

1. The testing provider creates a separate domain, owned by the provider.
2. The provider creates student accounts.

Steps for the school’s IT administrator:

1. Sign in with an administrator account to the Google Admin console.

   If you aren’t using an administrator account, you can’t access the Admin console.

2. Go to Menu  Devices > Chrome > Settings > Device settings.

   Requires having the Mobile Device Management administrator privilege.

3. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
4. (Strongly recommended) To make sure local student data is not erased during the exam:
   1. Go to Sign-in settings.
   2. Click User data.
   3. Select Do not erase all local user data.
   4. Click Save.
5. (Optional) To restrict who can sign in to the device as only those belonging to the assessment domain:
   1. Go to Sign-in settings.
   2. Click Sign-in restriction.
   3. Select Restrict sign-in to a list of users.
   4. Enter *@yourdomain.com.
   5. Click Save.

6. To block all apps but those you want to allow:

   1. Go to Menu  Devices > Chrome > Apps & extensions > Users & browsers.

      If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browser > Apps & extensions > Users & browsers.

   2. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

      Group settings override organizational units. Learn more

   3. On the right, click Additional settings.
   4. Go to Allow/block mode.
   5. Click Edit.
   6. For Chrome Web Store, select Block all apps, admin manages allowlist.
   7. Click Save.
7. To apply security measures for users and browsers:
   1. Go to  Menu  Devices > Chrome > Settings. The User & browser settings page opens by default.

      Requires having the Mobile Device Management administrator privilege.

      If you signed up for Chrome Enterprise Core, go to Menu  Chrome browser > Settings.

   2. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
   3. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

      Group settings override organizational units. Learn more

   4. Go to Security.
      1. Click Incognito mode.
      2. Select Disallow incognito mode.
      3. Click Save.
   5. Go to Content.
      1. Click Screenshot.
      2. Select Do not allow users to take screenshots or video recordings.
      3. Click Save.
   6. Go to Content.
      1. Click URL blocking.
      2. Enter Blocked URLs to block all URLs with a wildcard (*).
      3. Enter Blocked URL exceptions for the assessment URL and any other tools the student is allowed to access. Learn more.
      4. Click Save.
   7. Go to Printing.
      1. Click Printing.
      2. Select Disable printing.
      3. Click Save.
   8. Go to Hardware.
      1. Click External storage devices.
      2. Select Disallow external storage devices.
      3. Click Save.

For details on each setting, see Set Chrome policies for users or browsers.

Steps for the student:

1. Using the username and password from the provider, sign in to the Chromebook.
2. Take the test.
3. When the test is complete, sign out of the Chromebook.

When a student signs out, the device is wiped.

More security information:

In addition to Chrome’s native management capabilities listed above, some assessment providers may also choose to deploy their own Chrome extensions to add additional controls, such as tools to verify who’s signed in to the device and additional reporting. For more information, see Add apps and extensions.

Option 3: School sets up the assessment with managed guest sessions on devices

Chrome version 73 and later.

Before you begin

• Put ChromeOS devices in the organizational unit where you configure managed guest session settings. For details, see Move a Chrome device to an organizational unit. For information on managed guest sessions, see Managed guest session devices.

For managed ChromeOS devices.

1. Sign in with an administrator account to the Google Admin console.

   If you aren’t using an administrator account, you can’t access the Admin console.

2. Go to Menu  Devices > Chrome > Settings > Managed guest session settings.

   Requires having the Mobile Device Management administrator privilege.

3. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
4. Go to General.
5. Click Managed guest session.
6. Select Allow managed guest sessions.
7. Enter the name that you want your users to see for the session.
8. Click Save.
9. Configure managed guest session settings:
   1. (Optional) To set a specific amount of time for the exam:
      1. Go to General.
      2. Click Maximum user session length.
      3. Enter a time.
      4. Click Save.
   2. To set the idle time on a user's device:
      1. Click Idle settings.
      2. Set the idle time in minutes to at least 15 minutes.
      3. Click Save.
   3. To prevent users from opening new Incognito windows:
      1. Go to Security.
      2. Click Incognito mode.
      3. Select Disallow incognito mode.
      4. Click Save.
   4. To prevent users from taking screenshots:
      1. Go to Content.
      2. Click Screenshot
      3. Select Disable screenshot.
      4. Click Save.
   5. To prevent users from accessing specific URLs:
      1. Go to Content.
      2. Click URL blocking.
      3. For URL blocklist, enter https://* to block all URLs.
      4. For URL blocklist exceptions, enter the assessment URL and any other URLs that the student can access during the assessment.
      5. Click Save.
   6. To prevent users from printing from the Chrome menu, extensions, JavaScript applications, and so on:
      1. Go to Printing.
      2. Click Printing.
      3. Select Disable printing.
      4. Click Save.
   7. To prevent users from mounting an external drive:
      1. Go to Hardware.
      2. Click External storage devices.
      3. Select Disallow external storage devices.
      4. Click Save.
10. Choose the apps and extensions that you want to install. For details, see Automatically install apps and extensions.
11. Prevent students from accessing the test URL outside of the managed guest session:
    1. Go to  Menu  Devices > Chrome > Settings. The User & browser settings page opens by default.

       Requires having the Mobile Device Management administrator privilege.

       If you signed up for Chrome Enterprise Core, go to Menu  Chrome browser > Settings.

    2. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

       Group settings override organizational units. Learn more

    3. Go to Content.
    4. Click URL blocking.
    5. For URL blocklist exceptions, enter the assessment URL.
    6. Click Save. Or, you might click Override for an organizational unit.

       To later restore the inherited value, click Inherit (or Unset for a group).

Make sure that students use the managed guest session to take the test and don't sign in to their Google Account. When students finish the exam and exit the managed guest session, the session is wiped from the device.

Related topics

• Set ChromeOS device policies
• Managed guest session devices
• Using Chromebooks for online student assessments (PDF)