2. Enroll cloud-managed Chrome browsers

Option 1: Use the Group Policy Management Editor

Before you begin: If your organization doesn't use mobile device management (MDM) tools to deploy your configuration settings, consider using Option 2: Edit the registry file, described below.

Using Windows Server Management to access the Group Policy Management Editor, add the value of the enrollment token that you copied above to the CloudManagementEnrollmentToken policy in:

• Administrative templatesGoogleGoogle ChromeThe enrollment token of cloud policy on desktop

For details about how to install and configure policy templates, go to Set Chrome Browser policies on managed PCs.

Option 2: Edit the registry file

Under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome, set CloudManagementEnrollmentToken to the generated token you copied above.

Clear the current enrollment if one exists using:
-HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Enrollment
-HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Enrollment

(Optional) By default, if enrollment fails, for example if the enrollment token is invalid or revoked, Chrome will start in an unmanaged state. Instead, if you want to prevent Chrome browser from starting if enrollment fails, set CloudManagementEnrollmentMandatory under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome to true

Notes:

• The token must be set at a local machine level. It won't work at the user level. If you are repurposing an existing machine that has already been enrolled in Chrome Enterprise Core, you need to remove management tokens from it. For details, read Stop managing Chrome browser.
• If the machines you are enrolling are imaged from the same Microsoft Windows source, make sure that you have used Microsoft's System Preparation tool (Sysprep) with the /generalize option so that each enrolled machine has a unique identifier. Make sure that the MachineGUID is unique so that Chrome Enterprise Core identifies each device as an individual machine.
  You can check the value of MachineGuid in the registry:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Option 3: Download the reg file

Click Download .reg file. The downloaded .reg file automatically adds the token and clears the current enrollment when run.

When you use the reg file, Chrome browser will still respect the CloudManagementEnrollmentMandatory policy in Option 1, blocking launch if enrollment fails. See the note above if you're enrolling machines imaged from the same Windows source.

Option 4: Deploy an enrollment token in VMware Workspace One

You can use VMware Workspace ONE to generate a Chrome Enterprise Core enrollment token and enroll your Chrome browsers. See Enroll browsers with VMware Workspace One (Windows and macOS).

Option 1: Use a policy

Before you begin: If your organization doesn't use mobile device management (MDM) tools to deploy your configuration settings, consider using Option 2: Download the text file, described below.

Push the token to your browser as a policy named CloudManagementEnrollmentToken. To set policies on Apple Mac devices, you must use mobile management software, such as, Apple Profile Manager, Jamf, Workspace ONE, and so on.

Note: If you choose to manually set policies, be aware that macOS will delete the policy files on every sign-in. Learn more about setting up policies on Mac in the Quick Start Guide and help center.

(Optional) By default, if enrollment fails (for example if the enrollment token is invalid or revoked), Chrome will start in an unmanaged state. If you instead want to prevent Chrome browser from starting if enrollment fails, set CloudManagementEnrollmentMandatory to true

Option 2: Download the text file

Click Download file. If needed, create a /Library/Google/Chrome/ folder on your device. Put the file under /Library/Google/Chrome/. You need to add the text file at device level. It won't work if you add it at user level.

(Optional) By default, if enrollment fails (for example if the enrollment token is invalid or revoked), Chrome will start in an unmanaged state. If you instead want to prevent Chrome browser from starting if enrollment fails, create a file called CloudManagementEnrollmentOptions under /Library/Google/Chrome/ with the text Mandatory (case sensitive). This file must be encoded as a .txt file, but should not have the .txt filename extension.

If a token is pushed using both methods above, Chrome will use the value present in the policy and ignore the file. The token is stored in a directory under the home directory on the user's Mac. Each macOS user must enroll separately.

Option 3: Deploy an enrollment token in Jamf Pro

You can use Jamf Pro version 10.19 or later to generate a Chrome Enterprise Core enrollment token and enroll your Chrome browsers. See Enroll browsers with Jamf Pro (macOS).

Option 4: Deploy an enrollment token in VMware Workspace One

You can use VMware Workspace ONE to generate a Chrome Enterprise Core enrollment token and enroll your Chrome browsers. See Enroll browsers with VMware Workspace One (Windows and macOS).

The token can be pushed by creating a text file called CloudManagementEnrollmentToken, under /etc/opt/chrome/policies/enrollment. This file must only contain the token and nothing else. Alternatively, you can click Download file (Mac & Linux).

(Optional) By default, if enrollment fails (for example if the enrollment token is invalid or revoked), Chrome will start in an unmanaged state. If you instead want to prevent Chrome browser from starting if enrollment fails, create a file called CloudManagementEnrollmentOptions under /etc/opt/chrome/policies/enrollment/ with the text Mandatory (case sensitive). This file must be encoded as a .txt file, but should not have the .txt filename extension.

Note: To ensure that enrollment and reporting work correctly, /etc/machine-id should be unique per machine.

For details on how to manage Chrome browser on Android devices, see Set up Chrome Enterprise Core for Android.