• Chromium OS (Chromium OS) since version 27

Setting the policy to True displays the accessibility options in the system tray menu. If you set the policy to False, the options don't appear in the menu.

If you set the policy, users can't change it. If not set, accessibility options don't appear in the menu, but users can make them appear through the Settings page.

If you turn on accessibility features by other means (for example, by key combination), accessibility options always appear in the system tray menu.

• Chromium OS (Chromium OS) since version 29

Setting the policy to True keeps the large cursor on. Setting the policy to False keeps the large cursor off.

If you set the policy, users can't change the feature. If not set, the large cursor is off at first, but users can turn it on any time.

• Chromium OS (Chromium OS) since version 29

Setting the policy to True keeps spoken feedback on. Setting the policy to False keeps spoken feedback off.

If you set the policy, users can't change it. If not set, spoken feedback is off at first, but users can turn it on any time.

• Chromium OS (Chromium OS) since version 29

Setting the policy to True keeps High-contrast mode on. Setting the policy to False keeps High-contrast mode off.

If you set the policy, users can't change it. If not set, High-contrast mode is off, but users can turn it on any time.

• Chromium OS (Chromium OS) since version 34

Setting the policy to True keeps the on-screen keyboard on. Setting the policy to False keeps the on-screen keyboard off.

If you set the policy, users can't change it. If not set, the on-screen keyboard is off at first, but users can turn it on any time.

• Chromium OS (Chromium OS) since version 86

Enable or disable various features on the on-screen keyboard. This policy takes effect only when "VirtualKeyboardEnabled" policy is enabled.

If one feature in this policy is set to True, it will be enabled on the on-screen keyboard.

If one feature in this policy is set to False or left unset, it will be disabled on the on-screen keyboard.

NOTE: this policy is only supported in PWA Kiosk mode.

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\VirtualKeyboardFeatures = { "auto_complete_enabled": true, "auto_correct_enabled": true, "handwriting_enabled": false, "spell_check_enabled": false, "voice_input_enabled": false }

• Chromium OS (Chromium OS) since version 76

Setting the policy to True keeps sticky keys on. Setting the policy to False keeps sticky keys off.

If you set the policy, users can't change it. If not set, sticky keys is off at first, but users can turn it on any time.

• Chromium OS (Chromium OS) since version 35

Setting the policy to True makes the top row of keys on the keyboard act as function key commands. Pressing the Search key changes their behavior back to media keys.

If set to False or not set, the keyboard defaults to producing media key commands. Pressing the Search key changes them to function keys.

• Chromium OS (Chromium OS) since version 29

Setting the policy to None turns the screen magnifier off.

If you set the policy, users can't change it. If not set, the screen magnifier is off at first, but users can turn it on any time.

• 0 = Screen magnifier disabled
• 1 = Full-screen magnifier enabled
• 2 = Docked magnifier enabled

• Chromium OS (Chromium OS) since version 78

Enable the dictation accessibility feature.

If this policy is set to enabled, the dictation will always be enabled.

If this policy is set to disabled, the dictation will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the dictation is disabled initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 77

Enable the select to speak accessibility feature.

If this policy is set to true, the select to speak will always be enabled.

If this policy is set to false, the select to speak will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the select to speak is disabled initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 78

Enable the keyboard focus highlighting accessibility feature.

This feature is responsible for highlighting the object that has the focus by the keyboard.

If this policy is set to enabled, the keyboard focus highlighting will always be enabled.

If this policy is set to disabled, the keyboard focus highlighting will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the keyboard focus highlighting is disabled initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 78

Enable the cursor highlight accessibility feature.

This feature is responsible for highlighting the area that surrounds the mouse cursor while moving it.

If this policy is set to enabled, the cursor highlight will always be enabled.

If this policy is set to disabled, the cursor highlight will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the cursor highlight is disabled initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 78

Enable the caret highlight accessibility feature.

This feature is responsible for highlighting the area that surrounds the caret while editing.

If this policy is set to enabled, the caret highlight will always be enabled.

If this policy is set to disabled, the caret highlight will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the caret highlight is disabled initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 78

Enable the mono audio accessibility feature.

This feature is responsible for outputing stereo audio which includes different left and right channels, so different ears get different sounds.

If this policy is set to enabled, the mono audio will always be enabled.

If this policy is set to disabled, the mono audio will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the mono audio is disabled initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 81

Enable accessibility features shortcuts.

If this policy is set to true, accessibility features shortcuts will always be enabled.

If this policy is set to false, accessibility features shortcuts will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, accessibility features shortcuts will be enabled by default.

• Chromium OS (Chromium OS) since version 78

Enable the autoclick accessibility feature.

This feature is responsible to click without physically pressing your mouse or touchpad, hover over the object you'd like to click.

If this policy is set to enabled, the autoclick will always be enabled.

If this policy is set to disabled, the autoclick will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the autoclick is disabled initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 29

Setting the policy to True turns the large cursor on at the sign-in screen. Setting the policy to False turns the large cursor off at the sign-in screen.

If you set the policy, users can temporarily turn the large cursor on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.

If not set, the large cursor is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.

Note: DeviceLoginScreenLargeCursorEnabled overrides this policy if the former is specified.

• Chromium OS (Chromium OS) since version 29

Setting the policy to True turns spoken feedback on at the sign-in screen. Setting the policy to False turns spoken feedback off at the screen.

If you set the policy, users can temporarily turn spoken feedback on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.

If not set, spoken feedback is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.

Note: DeviceLoginScreenSpokenFeedbackEnabled overrides this policy if the former is specified.

• Chromium OS (Chromium OS) since version 29

Setting the policy to True turns High-contrast mode on at the sign-in screen. Setting the policy to False turns High-contrast mode off at the screen.

If you set the policy, users can temporarily change High-contrast mode, turning it on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.

If not set, High-contrast mode is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.

Note: DeviceLoginScreenHighContrastEnabled overrides this policy if the former is specified.

• Chromium OS (Chromium OS) since version 34

This policy is deprecated, please use the DeviceLoginScreenVirtualKeyboardEnabled policy instead.

Setting the policy to True turns the on-screen keyboard on at sign-in. Setting the policy to False turns the on-screen keyboard off at sign-in.

If you set the policy, users can temporarily turn the on-screen keyboard on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.

If not set, the on-screen keyboard is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.

Note: DeviceLoginScreenVirtualKeyboardEnabled overrides this policy if the former is specified.

• Chromium OS (Chromium OS) since version 29

Setting the policy to None turns screen magnification off at the sign-in screen.

If you set the policy, users can temporarily turn the screen magnifier on or off. When the sign-in screen reloads or stays idle for a minute, it reverts to its original state.

If not set, the screen magnifier is off at the sign-in screen. Users can turn it on any time, and its status on the sign-in screen persists across users.

Valid values: • 0 = Off • 1 = On • 2 = Docked magnifier on

Note: DeviceLoginScreenScreenMagnifierType overrides this policy if the former is specified.

• 0 = Screen magnifier disabled
• 1 = Full-screen magnifier enabled
• 2 = Docked magnifier enabled

• Chromium OS (Chromium OS) since version 78

Enable the large cursor accessibility feature on the login screen.

If this policy is set to true, the large cursor will always be enabled on the login screen.

If this policy is set to false, the large cursor will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the large cursor is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the spoken feedback accessibility feature on the login screen.

If this policy is set to true, the spoken feedback will always be enabled on the login screen.

If this policy is set to false, the spoken feedback will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the spoken feedback is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the high contrast accessibility feature on the login screen.

If this policy is set to true, the high contrast will always be enabled on the login screen.

If this policy is set to false, the high contrast will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the high contrast is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the virtual keyboard accessibility feature on the login screen.

If this policy is set to true, the virtual keyboard will always be enabled on the login screen.

If this policy is set to false, the virtual keyboard will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the virtual keyboard is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the dictation accessibility feature on the login screen.

If this policy is set to true, the dictation will always be enabled on the login screen.

If this policy is set to false, the dictation will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the dictation is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the select to speak accessibility feature on the login screen.

If this policy is set to true, the select to speak will always be enabled on the login screen.

If this policy is set to false, the select to speak will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the select to speak is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the cursor highlight accessibility feature on the login screen.

If this policy is set to true, the cursor highlight will always be enabled on the login screen.

If this policy is set to false, the cursor highlight will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the cursor highlight is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the caret highlight accessibility feature on the login screen.

If this policy is set to true, the caret highlight will always be enabled on the login screen.

If this policy is set to false, the caret highlight will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the caret highlight is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the mono audio accessibility feature on the login screen.

This feature allows to switch the device mode from the default stereo audio to the mono audio.

If this policy is set to true, the mono audio will always be enabled on the login screen.

If this policy is set to false, the mono audio will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the mono audio is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the autoclick accessibility feature on the login screen.

This feature allows to automatically click when the mouse cursor stops, without requiring the user to physically press the mouse or touchpad buttons.

If this policy is set to true, the autoclick will always be enabled on the login screen.

If this policy is set to false, the autoclick will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the autoclick is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the sticky keys accessibility feature on the login screen.

If this policy is set to true, the sticky keys will always be enabled on the login screen.

If this policy is set to false, the sticky keys will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the sticky keys is disabled on the login screen initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

Enable the keyboard focus highlighting accessibility feature on the login screen.

This feature is responsible for highlighting the object that is focused by the keyboard.

If this policy is set to enabled, the keyboard focus highlighting will always be enabled.

If this policy is set to disabled, the keyboard focus highlighting will always be disabled.

If you set this policy, users cannot change or override it.

If this policy is left unset, the keyboard focus highlighting is disabled initially but can be enabled by the user anytime.

• Chromium OS (Chromium OS) since version 79

If this policy is set, it controls the type of screen magnifier that is enabled.

If this policy is set to "Full-screen", the screen magnifier will always be enabled in full-screen magnifier mode on the login screen.

If this policy is set to "Docked", the screen magnifier will always be enabled in docked magnifier mode on the login screen.

If this policy is set to "None", the screen magnifier will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, the dictation is disabled on the login screen initially but can be enabled by the user anytime.

• 0 = Screen magnifier disabled
• 1 = Full-screen magnifier enabled
• 2 = Docked magnifier enabled

• Chromium OS (Chromium OS) since version 80

Setting the policy to True displays the accessibility options in the system tray menu. If you set the policy to False, the options don't appear in the menu.

If you set the policy, users can't change it. If not set, accessibility options don't appear in the menu, but users can make them appear through the Settings page.

If you turn on accessibility features by other means (for example, by key combination), accessibility options always appear in the system tray menu.

• Chromium OS (Chromium OS) since version 81

Enable accessibility features shortcuts on the login screen.

If this policy is set to true, accessibility features shortcuts will always be enabled on the login screen.

If this policy is set to false, accessibility features shortcuts will always be disabled on the login screen.

If you set this policy, users cannot change or override it.

If this policy is left unset, accessibility features shortcuts will be enabled by default on the login screen.

• Chromium OS (Chromium OS) since version 84

In kiosk mode, controls whether the floating accessibility menu is being shown.

If this policy is set to enabled, the floating accessibility menu will be always shown.

If this policy is set to disabled or left unset, the floating accessibility menu will never be shown.

• Chromium OS (Chromium OS) since version 50

Unless Ephemeral mode or multiple sign-in is on during the user's session, setting ArcEnabled to True turns ARC on for the user. Setting the policy to False or leaving it unset means enterprise users can't use ARC.

• Chromium OS (Chromium OS) since version 64

Unless ARC is turned off by other means, then setting the policy to True or leaving it unset lets users use ARC. Setting the policy to False means unaffiliated users may not use ARC.

Changes to the policy only apply while ARC isn't running, for example, while starting Chrome OS.

• Chromium OS (Chromium OS) since version 50

Setting the policy specifies a set of policies to hand over to the ARC runtime. Admins can use it to select the Android apps that autoinstall. Enter value in valid JSON format.

To pin apps to the launcher, see PinnedLauncherApps.

• Chromium OS (Chromium OS) since version 67

Setting the policy to True sends reports of key, policy-triggered Android app installation events to Google. Setting the policy to False means no events are captured.

• Chromium OS (Chromium OS) since version 68

Setting the policy to BackupAndRestoreEnabled means Android backup and restore is initially on. Setting the policy to BackupAndRestoreDisabled or leaving it unset keeps backup and restore off during setup.

Setting the policy to BackupAndRestoreUnderUserControl means users see prompts to use backup and restore. If they turn on backup and restore, Android app data is uploaded to Android backup servers and restored during reinstallations of compatible apps.

After initial setup, users can turn backup and restore on or off.

• 0 = Backup and restore disabled
• 1 = User decides whether to enable backup and restore
• 2 = Backup and restore enabled

• Chromium OS (Chromium OS) since version 68

Unless the DefaultGeolocationSetting policy is set to BlockGeolocation, then setting GoogleLocationServicesEnabled turns Google location services on during initial setup. Setting the policy to GoogleLocationServicesDisabled or leaving it unset keeps location services off during setup.

Setting policy to BackupAndRestoreUnderUserControl prompts users about whether or not to use Google location services. If they turn it on, Android apps use the services to search the device location and send anonymous location data to Google.

After initial setup, users can turn Google location services on or off.

• 0 = Google location services disabled
• 1 = User decides whether to enable Google location services
• 2 = Google location services enabled

• Chromium OS (Chromium OS) since version 52

Setting the policy to CopyCaCerts makes all ONC-installed CA certificates with Web TrustBit available for ARC-apps.

Setting to None or leaving it unset makes Chromium OS certificates unavailable for ARC-apps.

• 0 = Disable usage of Chromium OS certificates to ARC-apps
• 1 = Enable Chromium OS CA certificates to ARC-apps

• Chromium OS (Chromium OS) since version 75

Setting this policy to Enabled will cause recommendations for apps previously installed by the user on other devices. These recommendations will appear in the launcher after the local app recomendations, if no search text has been entered.

Setting this policy as Disabled or leaving it unset means these recommendations do not appear.

If this policy is set, users cannot change it.

• Chromium OS (Chromium OS) since version 88

If "DeviceArcDataSnapshotHours" policy is set, then the ARC data snapshotting mechanism is turned on. And the ARC data snapshot update can be started automatically during the defined time intervals. When an interval starts, ARC data snapshot update is required and no user is logged-in, the ARC data snapshot update process is started without user notification. If the user session is active, the UI notification is shown and have to be accepted in order to reboot a device and start ARC data snapshot update process. Note: a device is blocked for usage during the ARC data snapshot update process.

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\DeviceArcDataSnapshotHours = { "intervals": [ { "end": { "day_of_week": "MONDAY", "time": 21720000 }, "start": { "day_of_week": "MONDAY", "time": 12840000 } }, { "end": { "day_of_week": "FRIDAY", "time": 57600000 }, "start": { "day_of_week": "FRIDAY", "time": 38640000 } } ], "timezone": "GMT" }

• Chromium OS (Chromium OS) since version 84

Specifies device-wide client certificates that should be enrolled using the device management protocol.

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\RequiredClientCertificateForDevice = [ { "cert_profile_id": "cert_profile_id_1", "enable_remote_attestation_check": true, "key_algorithm": "rsa", "name": "Certificate Profile 1", "policy_version": "some_hash", "renewal_period_seconds": 2592000 } ]

• Chromium OS (Chromium OS) since version 83

Specifies client certificates that should be enrolled using the device management protocol.

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\RequiredClientCertificateForUser = [ { "cert_profile_id": "cert_profile_id_1", "enable_remote_attestation_check": true, "key_algorithm": "rsa", "name": "Certificate Profile 1", "policy_version": "some_hash", "renewal_period_seconds": 2592000 } ]

• Chromium OS (Chromium OS) since version 86
• Chromium (Linux) since version 86
• Chromium (Mac) since version 86
• Chromium (Windows) since version 86

Setting the policy to 3 lets websites ask for read access to files and directories in the host operating system's file system via the File System API. Setting the policy to 2 denies access.

Leaving it unset lets websites ask for access, but users can change this setting.

• 2 = Do not allow any site to request read access to files and directories via the File System API
• 3 = Allow sites to ask the user to grant read access to files and directories via the File System API

Windows (Intune):

<enabled/>

<data id="DefaultFileSystemReadGuardSetting" value="2"/>

• Chromium OS (Chromium OS) since version 86
• Chromium (Linux) since version 86
• Chromium (Mac) since version 86
• Chromium (Windows) since version 86

Setting the policy to 3 lets websites ask for write access to files and directories in the host operating system's file system. Setting the policy to 2 denies access.

Leaving it unset lets websites ask for access, but users can change this setting.

• 2 = Do not allow any site to request write access to files and directories
• 3 = Allow sites to ask the user to grant write access to files and directories

Windows (Intune):

<enabled/>

<data id="DefaultFileSystemWriteGuardSetting" value="2"/>

• Chromium (Linux) since version 79
• Chromium (Mac) since version 79
• Chromium (Windows) since version 79
• Chromium OS (Chromium OS) since version 79

Allows you to set whether users can add exceptions to allow mixed content for specific sites.

This policy can be overridden for specific URL patterns using the 'InsecureContentAllowedForUrls' and 'InsecureContentBlockedForUrls' policies.

If this policy is left not set, users will be allowed to add exceptions to allow blockable mixed content and disable autoupgrades for optionally blockable mixed content.

• 2 = Do not allow any site to load mixed content
• 3 = Allow users to add exceptions to allow mixed content

Windows (Intune):

<enabled/>

<data id="DefaultInsecureContentSetting" value="2"/>

• Chromium (Linux) since version 10
• Chromium (Mac) since version 10
• Chromium (Windows) since version 10
• Chromium OS (Chromium OS) since version 11
• Chromium (Android) since version 30

Setting the policy to 1 lets sites track the users' physical location as the default state. Setting the policy to 2 denies this tracking by default. You can set the policy to ask whenever a site wants to track the users' physical location.

Leaving the policy unset means the AskGeolocation policy applies, but users can change this setting.

• 1 = Allow sites to track the users' physical location
• 2 = Do not allow any site to track the users' physical location
• 3 = Ask whenever a site wants to track the users' physical location

If this policy is set to BlockGeolocation, Android apps cannot access location information. If you set this policy to any other value or leave it unset, the user is asked to consent when an Android app wants to access location information.

Windows (Intune):

<enabled/>

<data id="DefaultGeolocationSetting" value="1"/>

• Chromium (Linux) since version 22
• Chromium (Mac) since version 22
• Chromium (Windows) since version 22
• Chromium OS (Chromium OS) since version 22

Allows you to set whether websites are allowed to get access to media capture devices. Access to media capture devices can be allowed by default, or the user can be asked every time a website wants to get access to media capture devices.

If this policy is left not set, 'PromptOnAccess' will be used and the user will be able to change it.

• 2 = Do not allow any site to access the camera and microphone
• 3 = Ask every time a site wants to access the camera and/or microphone

Windows (Intune):

<enabled/>

<data id="DefaultMediaStreamSetting" value="2"/>

• Chromium OS (Chromium OS) since version 50
• Chromium (Android) since version 50
• Chromium (Linux) since version 50
• Chromium (Mac) since version 50
• Chromium (Windows) since version 50

Setting the policy to 3 lets websites ask for access to nearby Bluetooth devices. Setting the policy to 2 denies access to nearby Bluetooth devices.

Leaving the policy unset lets sites ask for access, but users can change this setting.

• 2 = Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API
• 3 = Allow sites to ask the user to grant access to a nearby Bluetooth device

Windows (Intune):

<enabled/>

<data id="DefaultWebBluetoothGuardSetting" value="2"/>

• Chromium OS (Chromium OS) since version 86
• Chromium (Linux) since version 86
• Chromium (Mac) since version 86
• Chromium (Windows) since version 86

Setting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports.

Leaving it unset lets websites ask for access, but users can change this setting.

• 2 = Do not allow any site to request access to serial ports via the Serial API
• 3 = Allow sites to ask the user to grant access to a serial port

Windows (Intune):

<enabled/>

<data id="DefaultSerialGuardSetting" value="2"/>

• Chromium (Linux) since version 15
• Chromium (Mac) since version 15
• Chromium (Windows) since version 15
• Chromium OS (Chromium OS) since version 15

Setting the policy lets you make a list of URL patterns that specify sites for which Chrome can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected.

Examples for the usage of the $FILTER section:

* When $FILTER is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected.

* When $FILTER contains both the "ISSUER" and the "SUBJECT" sections, only client certificates that satisfy both conditions are selected.

* When $FILTER contains a "SUBJECT" section with the "O" value, a certificate needs at least one organization matching the specified value to be selected.

* When $FILTER contains a "SUBJECT" section with a "OU" value, a certificate needs at least one organizational unit matching the specified value to be selected.

* When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply.

Leaving the policy unset means there's no autoselection for any site.

Windows (Windows clients):

Software\Policies\Chromium\AutoSelectCertificateForUrls\1 = "{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}"

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\AutoSelectCertificateForUrls\1 = "{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}"

Android/Linux:

[ "{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}" ]

Mac:

<array> <string>{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}</string> </array>

Windows (Intune):

<enabled/>

<data id="AutoSelectCertificateForUrlsDesc" value="1&#xF000;{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}"/>

• Chromium (Linux) since version 37
• Chromium (Mac) since version 37
• Chromium (Windows) since version 37
• Chromium OS (Chromium OS) since version 37

Setting the policy (as recommended only) lets you register a list of protocol handlers, which merge with the ones that the user registers, putting both sets in use. Set the property "protocol" to the scheme, such as "mailto", and set the property "URL" to the URL pattern of the application that handles the scheme specified in the "protocol" field. The pattern can include a "%s" placeholder, which the handled URL replaces.

Users can't remove a protocol handler registered by policy. However, by installing a new default handler, they can change the protocol handlers installed by policy.

The protocol handlers set via this policy are not used when handling Android intents.

Windows (Windows clients):

Software\Policies\Chromium\Recommended\RegisteredProtocolHandlers = [ { "default": true, "protocol": "mailto", "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s" } ]

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\Recommended\RegisteredProtocolHandlers = [ { "default": true, "protocol": "mailto", "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s" } ]

Android/Linux:

RegisteredProtocolHandlers: [ { "default": true, "protocol": "mailto", "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s" } ]

Mac:

<key>RegisteredProtocolHandlers</key> <array> <dict> <key>default</key> <true/> <key>protocol</key> <string>mailto</string> <key>url</key> <string>https://mail.google.com/mail/?extsrc=mailto&amp;url=%s</string> </dict> </array>

Windows (Intune):

<enabled/>

<data id="RegisteredProtocolHandlers" value="{"url": "https://mail.google.com/mail/?extsrc=mailto&url=%s", "default": true, "protocol": "mailto"}"/>

• Chromium (Android) since version 75
• Chromium OS (Chromium OS) since version 74
• Chromium (Linux) since version 74
• Chromium (Mac) since version 74
• Chromium (Windows) since version 74

Setting the policy lets you list the URL patterns that specify which sites are automatically granted permission to access a USB device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the policy to be valid. Each item in the devices field can have a vendor_id and product_id field. Omitting the vendor_id field will create a policy matching any device. Omitting the product_id field will create a policy matching any device with the given vendor ID. A policy which has a product_id field without a vendor_id field is invalid.

The USB permission model uses the requesting and embedding URLs to grant the requesting URL permission to access the USB device. The requesting URL can be different than the embedding URL when the requesting site is loaded in an iframe. So, the urls field can have up to 2 URL strings delimited by a comma to specify the requesting and embedding URL, respectively. If only one URL is specified, then access to the corresponding USB devices is granted when the requesting site's URL matches this URL, regardless of embedding status. The URLs must be valid, otherwise the policy is ignored.

Leaving the policy unset means DefaultWebUsbGuardSetting applies, if it's set. If not, the user's personal setting applies.

URL patterns in this policy shouldn't conflict with those configured through WebUsbBlockedForUrls. If they do, this policy takes precedence over WebUsbBlockedForUrls and WebUsbAskForUrls.

Windows (Windows clients):

Software\Policies\Chromium\WebUsbAllowDevicesForUrls = [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://requesting.com,https://embedded.com" ] } ]

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\WebUsbAllowDevicesForUrls = [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://requesting.com,https://embedded.com" ] } ]

Android/Linux:

WebUsbAllowDevicesForUrls: [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://requesting.com,https://embedded.com" ] } ]

Mac:

<key>WebUsbAllowDevicesForUrls</key> <array> <dict> <key>devices</key> <array> <dict> <key>product_id</key> <integer>5678</integer> <key>vendor_id</key> <integer>1234</integer> </dict> </array> <key>urls</key> <array> <string>https://google.com</string> <string>https://requesting.com,https://embedded.com</string> </array> </dict> </array>

Windows (Intune):

<enabled/>

<data id="WebUsbAllowDevicesForUrls" value="{"urls": ["https://google.com", "https://requesting.com,https://embedded.com"], "devices": [{"vendor_id": 1234, "product_id": 5678}]}"/>

• Chromium OS (Chromium OS) since version 53

Unless the SystemTimezone policy turns off automatic time zone detection, then setting the policy outlines the automatic time zone detection method, which users can't change.

Setting the policy to: * TimezoneAutomaticDetectionDisabled keeps automatic time zone detection off. * TimezoneAutomaticDetectionIPOnly keeps automatic time zone detection on, using the IP-only method. * TimezoneAutomaticDetectionSendWiFiAccessPoints keeps automatic time zone detection on, continually sending the list of visible Wi-Fi access-points to the Geolocation API server for finer-grained time zone detection. * TimezoneAutomaticDetectionSendAllLocationInfo keeps automatic time zone detection on, continually sending location information (such as Wi-Fi access points, reachable cell towers, GPS) to a server for the most fine-grained time zone detection.

If not set, set to Let users decide, or set to None, then users control automatic time zone detection using normal controls in chrome://settings.

• 0 = Let users decide
• 1 = Never auto-detect timezone
• 2 = Always use coarse timezone detection
• 3 = Always send WiFi access-points to server while resolving timezone
• 4 = Always send any available location signals to the server while resolving timezone

• Chromium OS (Chromium OS) since version 30

Setting the policy to True gives a device's sign-in screen a 24-hour clock format.

Setting the policy to False gives a device's sign-in screen a 12-hour clock format.

Leaving the policy unset makes a device use the format from the current locale.

User sessions also default to the device format, but users can change an account's clock format.

• Chromium (Linux) since version 8
• Chromium (Mac) since version 8
• Chromium (Windows) since version 8
• Chromium OS (Chromium OS) since version 11
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderName specifies the default search provider's name.

Leaving DefaultSearchProviderName unset means the hostname specified by the search URL is used.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderName" value="My Intranet Search"/>

• Chromium (Linux) since version 8
• Chromium (Mac) since version 8
• Chromium (Windows) since version 8
• Chromium OS (Chromium OS) since version 11
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderKeyword specifies the keyword or shortcut used in the address bar to trigger the search for this provider.

Leaving DefaultSearchProviderKeyword unset means no keyword activates the search provider.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderKeyword" value="mis"/>

• Chromium (Linux) since version 8
• Chromium (Mac) since version 8
• Chromium (Windows) since version 8
• Chromium OS (Chromium OS) since version 11
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURL specifies the URL of the search engine used during a default search. The URL should include the string '{searchTerms}', replaced in the query by the user's search terms.

You can specify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderSearchURL" value="https://search.my.company/search?q={searchTerms}"/>

• Chromium (Linux) since version 8
• Chromium (Mac) since version 8
• Chromium (Windows) since version 8
• Chromium OS (Chromium OS) since version 11
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURL specifies the URL of the search engine to provide search suggestions. The URL should include the string '{searchTerms}', replaced in the query by the user's search terms.

You can specify Google's search URL as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderSuggestURL" value="https://search.my.company/suggest?q={searchTerms}"/>

• Chromium (Linux) since version 8
• Chromium (Mac) since version 8
• Chromium (Windows) since version 8
• Chromium OS (Chromium OS) since version 11
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderIconURL specifies the default search provider's favorite icon URL.

Leaving DefaultSearchProviderIconURL unset means there's no icon for the search provider.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderIconURL" value="https://search.my.company/favicon.ico"/>

• Chromium (Linux) since version 8
• Chromium (Mac) since version 8
• Chromium (Windows) since version 8
• Chromium OS (Chromium OS) since version 11
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, setting DefaultSearchProviderEncodings specifies the character encodings supported by the search provider. Encodings are code page names such as UTF-8, GB2312, and ISO-8859-1. They're tried in the order provided.

Leaving DefaultSearchProviderEncodings unset puts UTF-8 in use.

Windows (Windows clients):

Software\Policies\Chromium\DefaultSearchProviderEncodings\1 = "UTF-8" Software\Policies\Chromium\DefaultSearchProviderEncodings\2 = "UTF-16" Software\Policies\Chromium\DefaultSearchProviderEncodings\3 = "GB2312" Software\Policies\Chromium\DefaultSearchProviderEncodings\4 = "ISO-8859-1"

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\DefaultSearchProviderEncodings\1 = "UTF-8" Software\Policies\ChromiumOS\DefaultSearchProviderEncodings\2 = "UTF-16" Software\Policies\ChromiumOS\DefaultSearchProviderEncodings\3 = "GB2312" Software\Policies\ChromiumOS\DefaultSearchProviderEncodings\4 = "ISO-8859-1"

Android/Linux:

[ "UTF-8", "UTF-16", "GB2312", "ISO-8859-1" ]

Mac:

<array> <string>UTF-8</string> <string>UTF-16</string> <string>GB2312</string> <string>ISO-8859-1</string> </array>

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderEncodingsDesc" value="1&#xF000;UTF-8&#xF000;2&#xF000;UTF-16&#xF000;3&#xF000;GB2312&#xF000;4&#xF000;ISO-8859-1"/>

• Chromium (Linux) since version 24
• Chromium (Mac) since version 24
• Chromium (Windows) since version 24
• Chromium OS (Chromium OS) since version 24
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderAlternateURLs specifies a list of alternate URLs for extracting search terms from the search engine. The URLs should include the string '{searchTerms}'.

Leaving DefaultSearchProviderAlternateURLs unset means no alternate URLs are used to extract search terms.

Windows (Windows clients):

Software\Policies\Chromium\DefaultSearchProviderAlternateURLs\1 = "https://search.my.company/suggest#q={searchTerms}" Software\Policies\Chromium\DefaultSearchProviderAlternateURLs\2 = "https://search.my.company/suggest/search#q={searchTerms}"

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\DefaultSearchProviderAlternateURLs\1 = "https://search.my.company/suggest#q={searchTerms}" Software\Policies\ChromiumOS\DefaultSearchProviderAlternateURLs\2 = "https://search.my.company/suggest/search#q={searchTerms}"

Android/Linux:

[ "https://search.my.company/suggest#q={searchTerms}", "https://search.my.company/suggest/search#q={searchTerms}" ]

Mac:

<array> <string>https://search.my.company/suggest#q={searchTerms}</string> <string>https://search.my.company/suggest/search#q={searchTerms}</string> </array>

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderAlternateURLsDesc" value="1&#xF000;https://search.my.company/suggest#q={searchTerms}&#xF000;2&#xF000;https://search.my.company/suggest/search#q={searchTerms}"/>

• Chromium (Linux) since version 29
• Chromium (Mac) since version 29
• Chromium (Windows) since version 29
• Chromium OS (Chromium OS) since version 29
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURL specifies the URL of the search engine used for image search. (If DefaultSearchProviderImageURLPostParams is set, then image search requests use the POST method instead.)

Leaving DefaultSearchProviderImageURL unset means no image search is used.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderImageURL" value="https://search.my.company/searchbyimage/upload"/>

• Chromium (Linux) since version 30
• Chromium (Mac) since version 30
• Chromium (Windows) since version 30
• Chromium OS (Chromium OS) since version 30
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderNewTabURL specifies the URL of the search engine used to provide a New Tab page.

Leaving DefaultSearchProviderNewTabURL unset means no new tab page is provided.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderNewTabURL" value="https://search.my.company/newtab"/>

• Chromium (Linux) since version 29
• Chromium (Mac) since version 29
• Chromium (Windows) since version 29
• Chromium OS (Chromium OS) since version 29
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURLPostParams specifies the parameters when searching a URL with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it.

Leaving DefaultSearchProviderSearchURLPostParams unset means search requests are sent using the GET method.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderSearchURLPostParams" value="q={searchTerms},ie=utf-8,oe=utf-8"/>

• Chromium (Linux) since version 29
• Chromium (Mac) since version 29
• Chromium (Windows) since version 29
• Chromium OS (Chromium OS) since version 29
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURLPostParams specifies the parameters during suggestion search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it.

Leaving DefaultSearchProviderSuggestURLPostParams unset unset means suggest search requests are sent using the GET method.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderSuggestURLPostParams" value="q={searchTerms},ie=utf-8,oe=utf-8"/>

• Chromium (Linux) since version 29
• Chromium (Mac) since version 29
• Chromium (Windows) since version 29
• Chromium OS (Chromium OS) since version 29
• Chromium (Android) since version 30
• Chromium (iOS) since version 88

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURLPostParams specifies the parameters during image search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as {imageThumbnail}, real image thumbnail data replaces it.

Leaving DefaultSearchProviderImageURLPostParams unset means image search request is sent using the GET method.

Windows (Intune):

<enabled/>

<data id="DefaultSearchProviderImageURLPostParams" value="content={imageThumbnail},url={imageURL},sbisrc={SearchSource}"/>

• Chromium OS (Chromium OS) since version 11

Specifies the release channel that this device should be locked to.

• "stable-channel" = Stable channel
• "beta-channel" = Beta channel
• "dev-channel" = Dev channel (may be unstable)

• Chromium OS (Chromium OS) since version 19

If this policy is set to True and the ChromeOsReleaseChannel policy is not specified then users of the enrolling domain will be allowed to change the release channel of the device. If this policy is set to false the device will be locked in whatever channel it was last set.

The user selected channel will be overridden by the ChromeOsReleaseChannel policy, but if the policy channel is more stable than the one that was installed on the device, then the channel will only switch after the version of the more stable channel reaches a higher version number than the one installed on the device.

• Chromium OS (Chromium OS) since version 19

Disables automatic updates when set to True.

Chromium OS devices automatically check for updates when this setting is not configured or set to False.

Warning: It is recommended to keep auto-updates enabled so that users receive software updates and critical security fixes. Turning off auto-updates might leave users at risk.

• Chromium OS (Chromium OS) since version 31

Specifies whether p2p is to be used for OS update payloads. If set to True, devices will share and attempt to consume update payloads on the LAN, potentially reducing Internet bandwidth usage and congestion. If the update payload is not available on the LAN, the device will fall back to downloading from an update server. If set to False or not configured, p2p will not be used.

• Chromium OS (Chromium OS) since version 69

This policy controls the time frames during which the Chromium OS device is not allowed to check for updates automatically. When this policy is set to a non-empty list of time intervals: Devices will not be able to check for updates automatically during the specified time intervals. Devices that require a rollback or are below the minimum Chromium OS version will not be affected by this policy due to potential security issues. Furthermore, this policy will not block update checks requested by users or administrators. When this policy is unset or contains no time intervals: No automatic update checks will be blocked by this policy, but they may be blocked by other policies. This feature is only enabled on Chrome devices configured as auto-launch kiosks. Other devices will not be restricted by this policy.

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\DeviceAutoUpdateTimeRestrictions = [ { "end": { "day_of_week": "Thursday", "hours": 2, "minutes": 30 }, "start": { "day_of_week": "Monday", "hours": 3, "minutes": 50 } }, { "end": { "day_of_week": "Sunday", "hours": 15, "minutes": 10 }, "start": { "day_of_week": "Thursday", "hours": 3, "minutes": 30 } } ]

• Chromium OS (Chromium OS) since version 19

Sets a target version for Auto Updates.

Specifies the prefix of a target version Chromium OS should update to. If the device is running a version that's before the specified prefix, it will update to the latest version with the given prefix. If the device is already on a later version, effects depend on the value of DeviceRollbackToTargetVersion. The prefix format works component-wise as is demonstrated in the following example:

"" (or not configured): update to latest version available. "1412.": update to any minor version of 1412 (e.g. 1412.24.34 or 1412.60.2) "1412.2.": update to any minor version of 1412.2 (e.g. 1412.2.34 or 1412.2.2) "1412.24.34": update to this specific version only

Warning: It is not recommended to configure version restrictions as they may prevent users from receiving software updates and critical security fixes. Restricting updates to a specific version prefix might leave users at risk.

• Chromium OS (Chromium OS) since version 69

This policy defines a list of percentages that will define the fraction of Chromium OS devices in the OU to update per day starting from the day the update is first discovered. The discovery time is later than the update published time, since it could be a while after the update publishing until the device checks for updates.

Each (day, percentage) pair contains which percentage of the fleet has to be updated by the given number of days since the update has been discovered. For example, if we have the pairs [(4, 40), (10, 70), (15, 100)], then 40% of the fleet should have been updated 4 days after seeing the update. 70% should be updated after 10 days, and so on.

If there is a value defined for this policy, updates will ignore the DeviceUpdateScatterFactor policy and follow this policy instead.

If this list is empty, there will be no staging and updates will be applied according to other device policies.

This policy does not apply for channel switches.

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\DeviceUpdateStagingSchedule = [ { "days": 7, "percentage": 50 }, { "days": 10, "percentage": 100 } ]

• Chromium OS (Chromium OS) since version 20

Specifies the number of seconds up to which a device may randomly delay its download of an update from the time the update was first pushed out to the server. The device may wait a portion of this time in terms of wall-clock-time and the remaining portion in terms of the number of update checks. In any case, the scatter is upper bounded to a constant amount of time so that a device does not ever get stuck waiting to download an update forever.

• Chromium OS (Chromium OS) since version 21

The types of connections that are allowed to use for OS updates. OS updates potentially put heavy strain on the connection due to their size and may incur additional cost. Therefore, they are by default not enabled for connection types that are considered expensive (currently only "cellular").

The recognized connection type identifiers are "ethernet", "wifi", and "cellular".

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\DeviceUpdateAllowedConnectionTypes\1 = "ethernet"

• Chromium OS (Chromium OS) since version 29

Auto-update payloads on Chromium OS can be downloaded via HTTP instead of HTTPS. This allows transparent HTTP caching of HTTP downloads.

If this policy is set to true, Chromium OS will attempt to download auto-update payloads via HTTP. If the policy is set to false or not set, HTTPS will be used for downloading auto-update payloads.

• Chromium OS (Chromium OS) since version 29

Schedule an automatic reboot after a Chromium OS update has been applied.

When this policy is set to true, an automatic reboot is scheduled when a Chromium OS update has been applied and a reboot is required to complete the update process. The reboot is scheduled immediately but may be delayed on the device by up to 24 hours if a user is currently using the device.

When this policy is set to false, no automatic reboot is scheduled after applying a Chromium OS update. The update process is completed when the user next reboots the device.

If you set this policy, users cannot change or override it.

Note: Currently, automatic reboots are only enabled while the login screen is being shown or a kiosk app session is in progress. This will change in the future and the policy will always apply, regardless of whether a session of any particular type is in progress or not.

• Chromium OS (Chromium OS) since version 67

Specifies whether the device should roll back to the version set by DeviceTargetVersionPrefix if it's already running a later version.

Default is RollbackDisabled.

• 1 = Do not roll back to target version if OS version is newer than target. Updates are also disabled.
• 2 = Roll back and stay on target version if OS version is newer than target. Do a powerwash during the process.
• 3 = Roll back and stay on target version if OS version is newer than target. Try to carry over device-level configuration (including network credentials) through the rollback process, if possible, but do the rollback with full powerwash even if restoring the data is not possible (because the target version doesn't support restoring data or because of a backward-incompatible change). Supported on Chromium OS version 75 and higher. For older clients, this value means that rollback is disabled.

• Chromium OS (Chromium OS) since version 67

Specifies the minimum number of Chromium OS milestones rollback should be allowed starting from the stable version at any time.

Default is 0 for consumer, 4 (approx. half a year) for enterprise enrolled devices.

Setting this policy prevents rollback protection to apply for at least this number of milestones.

Setting this policy to a lower value has a permanent effect: the device MAY not be able to roll back to earlier versions even after the policy is reset to a larger value.

Actual rollback possibilities may also depend on the board and critical vulnerability patches.

• Minimum:0
• Maximum:4

• Chromium OS (Chromium OS) since version 75

This policy controls whether or not the device should be updated to a Quick Fix Build.

If policy value is set to a token that maps to a Quick Fix Build, the device will be updated to the corresponding Quick Fix Build if the update is not blocked by another policy.

If this policy is not set, or if its value does not map to a Quick Fix Build, then the device won't be updated to a Quick Fix Build. If the device is already running a Quick Fix Build and the policy is not set anymore or its value does not map to a Quick Fix Build anymore, then the device will be updated to a regular build if the update is not blocked by another policy.

• Chromium OS (Chromium OS) since version 86

Configures the requirement of the minimum allowed version of Chromium OS.

When this policy is set to a non-empty list: If none of the entries has a chromeos_version greater than the current version of the device, then no restrictions are applied and the already existing restrictions are revoked. If at least one of the entries has a chromeos_version greater than the current version, the entry whose version is greater and closest to the current version is chosen. In case of conflict, preference is given to the entry with lower warning_period or aue_warning_period and the policy is applied using that entry.

If the current version becomes obsolete during user session and the current network limits auto updates, an on-screen notification is shown to update the device within the warning_period shown in the notification. No notifications are shown if the current network allows auto updates and the device must be updated within the warning_period. The warning_period starts from the time the policy is applied. If the device is not updated till the expiry of the warning_period, the user is signed out of the session. If the current version is found to be obsolete at the time of login with expired warning_period, the user is required to update the device before signing in.

If the current version becomes obsolete during user session and the device has reached auto update expiration, an on-screen notification is shown to return the device within aue_warning_period. If the device is found to have reached auto update expiration at the time of login with expired aue_warning_period, the device is blocked for any user to sign in.

Unmanaged user sessions do not receive notifications and force log out if unmanaged_user_restricted is unset or set to False.

If this policy is not set or set to empty, no restrictions are applied, already existing restrictions are revoked and user can sign in regardless of Chromium OS version.

Here chromeos_version can be either an exact version like '13305.0.0' or a version prefix, like '13305'. The warning_period and aue_warning_period are optional values specified in number of days. Default value for them is 0 days, which means that there is no warning period. The unmanaged_user_restricted is an optional property with default value as False.

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\DeviceMinimumVersion = { "requirements": [ { "aue_warning_period": 14, "chromeos_version": "12215", "warning_period": 0 }, { "aue_warning_period": 21, "chromeos_version": "13315.60.12", "warning_period": 10 } ], "unmanaged_user_restricted": true }

• Chromium OS (Chromium OS) since version 86

This policy is only effective when the device has reached auto update expiration and does not meet the minimum allowed version of Chromium OS set through DeviceMinimumVersion policy.

When this policy is set to a non-empty string : If the warning time mentioned in DeviceMinimumVersion policy has expired, this message is shown at the login screen when the device is blocked for any user to sign in. If the warning time mentioned in DeviceMinimumVersion policy has not expired, this message is shown on the Chrome management page after user sign in.

If this policy is not set or set to empty, the default auto update expiration message is shown to the user in both of the above cases. The auto update expiration message must be plain text without any formatting. No markup is allowed.

• Chromium OS (Chromium OS) since version 48

Setting the policy has each display rotate to the specified orientation on every reboot and the first time it's connected after the policy value changes. Users may change the display rotation through the settings page after signing in, but it changes back at the next reboot. This policy applies to primary and secondary displays.

If not set, the default value is 0 degrees and users are free to change it. In this case, the default value isn't reapplied at restart.

• 0 = Rotate screen by 0 degrees
• 1 = Rotate screen clockwise by 90 degrees
• 2 = Rotate screen by 180 degrees
• 3 = Rotate screen clockwise by 270 degrees

• Chromium (Linux) since version 86
• Chromium (Mac) since version 86
• Chromium (Windows) since version 86
• Chromium OS (Chromium OS) since version 86

Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if blocked, without a way for the user to enable them. Once an extension disabled due to the blocklist is removed from it, it will automatically get re-enabled.

A blocklist value of '*' means all extensions are blocked unless they are explicitly listed in the allowlist.

If this policy is left not set the user can install any extension in Chromium.

Windows (Windows clients):

Software\Policies\Chromium\ExtensionInstallBlocklist\1 = "extension_id1" Software\Policies\Chromium\ExtensionInstallBlocklist\2 = "extension_id2"

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\ExtensionInstallBlocklist\1 = "extension_id1" Software\Policies\ChromiumOS\ExtensionInstallBlocklist\2 = "extension_id2"

Android/Linux:

[ "extension_id1", "extension_id2" ]

Mac:

<array> <string>extension_id1</string> <string>extension_id2</string> </array>

Windows (Intune):

<enabled/>

<data id="ExtensionInstallBlocklistDesc" value="1&#xF000;extension_id1&#xF000;2&#xF000;extension_id2"/>

• Chromium (Linux) since version 8
• Chromium (Mac) since version 8
• Chromium (Windows) since version 8
• Chromium OS (Chromium OS) since version 11

This policy is deprecated, please use the 'ExtensionInstallBlocklist' policy instead.

Setting the policy specifies which extensions users can't install. Extensions already installed are turned off, if prohibited, without a way for users to turn them on. If a prohibited extension gets removed from the blocked list, it's automatically re-enabled. Use a value of * to prohibit all extensions, except those explicitly allowed.

If the policy is unset, users can install any extension in Chromium.

Windows (Windows clients):

Software\Policies\Chromium\ExtensionInstallBlacklist\1 = "extension_id1" Software\Policies\Chromium\ExtensionInstallBlacklist\2 = "extension_id2"

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\ExtensionInstallBlacklist\1 = "extension_id1" Software\Policies\ChromiumOS\ExtensionInstallBlacklist\2 = "extension_id2"

Android/Linux:

[ "extension_id1", "extension_id2" ]

Mac:

<array> <string>extension_id1</string> <string>extension_id2</string> </array>

Windows (Intune):

<enabled/>

<data id="ExtensionInstallBlacklistDesc" value="1&#xF000;extension_id1&#xF000;2&#xF000;extension_id2"/>

• Chromium (Linux) since version 8
• Chromium (Mac) since version 8
• Chromium (Windows) since version 8
• Chromium OS (Chromium OS) since version 11

This policy is deprecated, please use the 'ExtensionInstallAllowlist' policy instead.

Setting the policy specifies which extensions are exempt from the list of prohibited extensions. Use a value of * for ExtensionInstallBlacklist to prohibit all extensions, and users can only install explicitly allowed extensions. By default, all extensions are allowed. But, if you prohibited extensions by policy, use the list of allowed extensions to change that policy.

Windows (Windows clients):

Software\Policies\Chromium\ExtensionInstallWhitelist\1 = "extension_id1" Software\Policies\Chromium\ExtensionInstallWhitelist\2 = "extension_id2"

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\ExtensionInstallWhitelist\1 = "extension_id1" Software\Policies\ChromiumOS\ExtensionInstallWhitelist\2 = "extension_id2"

Android/Linux:

[ "extension_id1", "extension_id2" ]

Mac:

<array> <string>extension_id1</string> <string>extension_id2</string> </array>

Windows (Intune):

<enabled/>

<data id="ExtensionInstallWhitelistDesc" value="1&#xF000;extension_id1&#xF000;2&#xF000;extension_id2"/>

• Chromium (Linux) since version 25
• Chromium (Mac) since version 25
• Chromium (Windows) since version 25
• Chromium OS (Chromium OS) since version 25

Setting the policy controls which apps and extensions may be installed in Chromium, which hosts they can interact with, and limits runtime access.

Leaving the policy unset results in no restrictions on the acceptable extension and app types.

Extensions and apps which have a type that's not on the list won't be installed. Each value should be one of these strings:

* "extension"

* "theme"

* "user_script"

* "hosted_app"

* "legacy_packaged_app"

* "platform_app"

See the Chromium extensions documentation for more information on these types.

Versions earlier than 75 that use multiple comma separated extension IDs aren't supported and are skipped. The rest of the policy applies.

Note: This policy also affects extensions and apps to be force-installed using ExtensionInstallForcelist.

Windows (Windows clients):

Software\Policies\Chromium\ExtensionAllowedTypes\1 = "hosted_app"

Windows (Chromium OS clients):

Software\Policies\ChromiumOS\ExtensionAllowedTypes\1 = "hosted_app"

Android/Linux:

[ "hosted_app" ]

Mac:

<array> <string>hosted_app</string> </array>

Windows (Intune):

<enabled/>

<data id="ExtensionAllowedTypesDesc" value="1&#xF000;hosted_app"/>

• Chromium OS (Chromium OS) since version 74

Setting the policy to Enabled lets Google Assistant access screen context and send that data to a server. Setting the policy to Disabled keeps Google Assistant from screen context.

Leaving the policy unset lets users decide to turn this feature on or off.

• Chromium OS (Chromium OS) since version 74

Setting the policy to Enabled lets Google Assistant listen for the voice activation phrase. Setting the policy to Disabled keeps Google Assistant from listening for the phrase.

Leaving the policy unset lets users decide to turn this feature on or off.

• Chromium OS (Chromium OS) since version 84

This policy gives Quick Answers permission to access selected content and send the info to server.

If the policy is enabled, Quick Answers will be allowed to access selected content. If the policy is disabled, Quick Answers will not be allowed to access selected content. If the policy is not set, users can decide whether to allow Quick Answers to access selected content.

• Chromium (Linux) since version 52
• Chromium (Mac) since version 52
• Chromium (Windows) since version 52
• Chromium OS (Chromium OS) since version 52
• Chromium (Android) since version 52

Setting the policy to Enabled or leaving it unset turns on Google Cast, which users can launch from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon.

Setting the policy to Disabled turns off Google Cast.

Windows (Intune):

<enabled/>

• Chromium (Linux) since version 58
• Chromium (Mac) since version 58
• Chromium (Windows) since version 58
• Chromium OS (Chromium OS) since version 58

Setting the policy to Enabled displays the Cast toolbar icon on the toolbar or the overflow menu, and users can't remove it.

Setting the policy to Disabled or leaving it unset lets users pin or remove the icon through its contextual menu.

If the policy EnableMediaRouter is set to Disabled, then this policy's value has no effect, and the toolbar icon doesn't appear.

Windows (Intune):

<disabled/>

• Chromium OS (Chromium OS) since version 19

Setting the policy to Enabled turns off Google Drive syncing in the Chromium OS Files app when on a cellular connection. Data is only synced to Drive when connected through Wi-Fi or Ethernet.

Setting the policy to Disabled or leaving it unset lets users transfer files to Drive on cellular connections.

This policy has no effect on the Android Google Drive app. If you want to prevent use of Google Drive over cellular connections, you should disallow installation of the Android Google Drive app.

• Chromium (Linux) since version 9
• Chromium (Mac) since version 9
• Chromium (Windows) since version 9
• Chromium (Android) since version 46
• Chromium OS (Chromium OS) since version 62

Setting the policy specifies which HTTP authentication schemes Chromium supports.

Leaving the policy unset employs all 4 schemes.

Valid values:

* basic

* digest

* ntlm

* negotiate

Note: Separate multiple values with commas.

Windows (Intune):

<enabled/>

<data id="AuthSchemes" value="basic,digest,ntlm,negotiate"/>

• Chromium (Linux) since version 9
• Chromium (Mac) since version 9
• Chromium (Windows) since version 9
• Chromium (Android) since version 46
• Chromium OS (Chromium OS) since version 62

Setting the policy to Enabled skips CNAME lookup. The server name is used as entered when generating the Kerberos SPN.

Setting the policy to Disabled or leaving it unset means CNAME lookup determines the canonical name of the server when generating the Kerberos SPN.

Windows (Intune):

<disabled/>

• Chromium (Linux) since version 9
• Chromium (Mac) since version 9
• Chromium (Windows) since version 9
• Chromium OS (Chromium OS) since version 62

Setting the policy to Enabled and entering a nonstandard port (in other words, a port other than 80 or 443) includes it in the generated Kerberos SPN.