Applies to Windows and macOS computers that are managed using Chrome Enterprise Core.
As an administrator, you can manage Chrome browser updates for users in your organization. Chrome releases a full browser update about every 6 weeks. Minor updates, such as security fixes and software updates, happen every 2–3 weeks.
To keep Chrome browser secure and up to date, we recommend using automatic updates instead of manual updates. If your organization deploys Chrome browser to thousands of devices or if you have bandwidth restrictions, you might need to customize how updates are deployed.
Configure auto-updates
By default, Chrome browser updates to the latest version of Chrome when it’s available. We recommend that you keep the default auto-update settings. That way, your users' devices will automatically update to new versions of Chrome browser as they’re released on the Stable channel. Your users will get critical security fixes and new features as they become available.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Devices > Chrome > Settings. The User & browser settings page opens by default.
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
Chrome browser > Settings.
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Chrome browser updates.
- Select Allow updates.
- Click Save.
If you need to stop Chrome browser updates, you can turn off automatic updates and prevent users from manually updating the browser themselves.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Chrome browser updates.
- Select Disable updates.
- Click Save.
Even if you turn off updates for Chrome browser, browser components, such as Widevine and DRM won’t automatically stop updating.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Component updates.
- Select Disable updates for components.
- Click Save.
Note: This policy does not apply to all components. For a full list of exempted components, see ComponentUpdatesEnabled.
Customize updates
You can prevent auto-updates from occurring during certain time periods, such as during your organization’s peak working hours.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Suppress auto-update check.
- Enter the start time, in 24-hour format (hh:mm), that you want to begin suppressing checks for browser updates each day.
- Enter the length of time, in minutes, that you want to suppress browser update checks for.
- Click Save.
Pinning Chrome browser to a major version, such as 86, allows computers to continue to receive security updates for as long as 86 is the major version on the Stable channel. Or, you can pin the browser to a specific version, such as 86.0.3945.88, so that computers only update to that version.
Google gradually updates computers on the Stable channel to new versions of Chrome browser over a few weeks. Sometimes, updates might take longer. If you pin browser updates, computers in your organization only update after the version is fully released to the Stable channel.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Chrome browser updates.
- Select Allow updates.
- For Target version prefix, enter the version number of the Chrome browser version that you want computers to update to. You can use version numbers with up to 4 parts, such as 86.0.3987.162. Unless you specify the exact version, include a period (.) after the version number to pin updates to the highest available version. For example:
- Specify the major version, such as 86., to let computers update to the highest available version of 86.
- Specify the major and minor version, such as 86.2., to let computers update to the highest available version of 86.2.
- Specify the exact version, such as 86.0.3987.16$, that you want computers to update to. Include $ after the version number to pin updates to that exact version.
- Click Save.
To make sure that users are protected by the latest security updates, we recommend that they use the latest version of Chrome browser. By running earlier versions of Chrome browser, you will expose your users to known security issues. If you roll back, each user’s browsing data is automatically deleted unless you do one of the following:
Starting in Chrome version 83, Chrome browser stores a snapshot of user information locally on devices after each major version update. The three most recent snapshots are retained. When you roll back to Chrome version 83 or newer, user data such as bookmarks and autofill data are restored from the snapshot.
- Data saved in snapshots includes bookmarks, browsing history, session restore data, passwords, autofill, cookies, and browser sign-in state.
- Users who don’t use Chrome Sync lose data that they stored locally on devices during the time between the latest version update and rollback.
- Each snapshot is approximately 10 MB but might be larger if the user has a large number of history entries or bookmarks.
If you’re rolling back to a version that’s earlier than 83, each user’s browsing data is automatically deleted unless you do one of the following:
- Turn on Chrome sync—You can turn on Chrome sync for all users or advise them to turn it on themselves. For details, see Force users to sign in to Chrome browser. After you roll back, users need to sign in again to Chrome browser to see their synced information.
- Turn on roaming user profiles—If you turn on the roaming profile policy in Chrome browser, users who sign in to a Windows computer in your organization will automatically see their synced information when they open Chrome browser. For details, see Use Chrome browser with Roaming User Profiles.
Note: You can only use this policy to roll back to the 3 latest major releases of Chrome browser. For information about how to downgrade to earlier Chrome browser versions, see Downgrade your Chrome version.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Chrome browser updates.
- Select Allow updates.
- For Target version prefix, enter the version number of the Chrome browser version that you want computers to roll back to. You can use version numbers with up to 4 parts, such as 85.0.3987.162.
- Specify the major version, such as 85., to let computers roll back to a version of 85.
- Specify the major and minor version, such as 85.2., to let computers roll back to a version of 85.2.
- Specify the exact version, such as 85.0.3987.162, that you want computers to roll back to.
- Under the target version prefix that you specified, select Rollback to target version.
- Click Save.
You can choose when to roll out Chrome browser updates to users by placing them on a release channel. In the Admin console, there are currently 4 channels available: Stable, Beta, Dev, and Extended stable. By default, Chrome browser follows updates on the Stable channel. For information to help you decide which channel to have your users on, go to Chrome browser release channels.
When you move a browser to a more stable channel, such as from Beta to Stable, the more stable channel is likely to have a lower version number. Machines with a higher version of Chrome browser installed only roll back to a lower version if Rollback to target version is selected. Otherwise, those machines will wait to switch channels until a higher version of Chrome browser is available on the specified release channel.
The Target version prefix policy, if set, is respected on the specified channel.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Chrome browser updates.
- Select an option:
- Stable channel
- Dev channel
- Beta channel
- Extended stable channel
- Click Save.
You can delay checks for auto-updates to help reduce peak bandwidth use within a network.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Auto-update check period.
- Enter the number of minutes between automatic update checks. Enter 0 to disable all auto-update checks (not recommended).
- Click Save.
After a Chrome browser update gets applied to a computer, users need to restart Chrome browser for it to take effect. You can display a notification prompting users to restart, but they might not restart the browser for some time.
If you want users to restart their browser sooner, you can force Chrome browser to automatically relaunch after a certain time.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Relaunch notification.
- Select an option:
- Force relaunch after a period—Users see a recurring message that Chrome browser will automatically relaunch after a certain time. Users can dismiss the notification and continue to use Chrome browser until the end of the relaunch period, at which point it will automatically relaunch.
- No relaunch notification—Chrome browser indicates to the user that a relaunch is needed via subtle changes to its menu. No notifications are shown.
- Show notification recommending relaunch—Users see a recurring message that they should relaunch Chrome browser. Users can dismiss the notification and keep using the old version of Chrome browser until they choose to relaunch Chrome Browser.
- (Optional) Set the notification period, in hours.
If you selected Force relaunch after a period, Chrome browser automatically relaunches after the specified time period elapses. - (Optional) Set the relaunch window.
Select Force relaunch after a period:- Relaunch window start time—Time of day, in 24-hour format (hh:mm), that you want to end the notification period, and begin relaunching Chrome browser and restarting ChromeOS devices.
- Relaunch window duration (minutes)—The length of time, in minutes, of the relaunch window.
- Click Save.
You can configure settings so that the Google Update server attempts to provide cache-friendly URLs for update payloads in its responses. This helps to reduce bandwidth and improve response times by caching and reusing frequently requested webpages.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Mobile Device Management administrator privilege.
If you signed up for Chrome Enterprise Core, go to Menu
-
To apply the setting to all enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to Chrome updates.
- Click Cacheable URLs.
- Select Attempt to provide cache-friendly download URLs.
- Click Save.
Related topics
Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.