caption: Prompt when multiple certificates match on the sign-in screen
default: false
desc: |-
  This policy controls whether the user is prompted to select a client certificate on the sign-in screen in the frame hosting the SAML flow when more than one certificate matches <ph name="DEVICE_LOGIN_SCREEN_AUTO_SELECT_CERTIFICATE_FOR_URLS_POLICY_NAME">DeviceLoginScreenAutoSelectCertificateForUrls</ph>.
        If this policy is set to Enabled, the user is asked to select the client certificate whenever the auto-selection policy matches multiple certificates.
        If this policy is set to Disabled or not set, the user is never prompted to select a client certificate on the sign-in screen.
        Note: This policy is in general not recommended, since it imposes potential privacy risks (in case device-wide TPM-backed certificates are used) and presents poor user experience.
device_only: true
example_value: true
features:
  dynamic_refresh: true
  per_profile: false
items:
- caption: Prompt the user to select the client certificate whenever the auto-selection
    policy matches multiple certificates on the sign-in screen
  value: true
- caption: Do not prompt the user to select a client certificate on the sign-in screen
  value: false
owners:
- miersh@google.com
schema:
  type: boolean
supported_on:
- chrome_os:96-
tags: []
type: main
generate_device_proto: False
