Settings for Google\'s AI Mode integrations in the address bar and New Tab page search box. This policy controls Google\'s AI Mode integrations in the address bar and the New Tab page search box. To access this feature, Google must be set as the user\'s default search engine. 0 = The feature will be available to users. 1 = The feature will not be available to users. If the policy is unset, its behavior is determined by the GenAiDefaultSettings policy. Allow AI Mode integrations. Do not allow AI Mode integrations. 0 1 Make Access-Control-Allow-Methods matching in CORS preflight spec conformant This policy controls whether request methods are uppercased when matching with Access-Control-Allow-Methods response headers in CORS preflight. If the policy is Disabled, request methods are uppercased. This is the behavior on or before Google Chrome 108. If the policy is Enabled or not set, request methods are not uppercased, unless matching case-insensitively with DELETE, GET, HEAD, OPTIONS, POST, or PUT. This would reject fetch(url, {method: \'Foo\'}) + \"Access-Control-Allow-Methods: FOO\" response header, and would accept fetch(url, {method: \'Foo\'}) + \"Access-Control-Allow-Methods: Foo\" response header. Note: request methods \"post\" and \"put\" are not affected, while \"patch\" is affected. This policy is intended to be temporary and will be removed in the future. Do not uppercase request methods except for DELETE/GET/HEAD/OPTIONS/POST/PUT Always uppercase request methods True False Allow Accessibility Performance Filtering. A policy to control whether the accessibility engine is allowed to dynamically compute a filter for the accessibility tree in Google Chrome to improve performance. When the policy is either set to Enabled or not set, the accessibility engine is allowed to dynamically compute filter modes for the accessibility tree in Google Chrome, which may lead to a performance improvement. When the policy is set to Disabled, the accessibility engine is not allowed to dynamically compute filter modes for the accessibility tree. Allow Accessibility Performance Filtering to be used. Disallow Accessibility Performance Filtering to be used. True False Allow DNS queries for additional DNS record types This policy controls whether Google Chrome may query additional DNS record types when making insecure DNS requests. This policy has no effect on DNS queries made via Secure DNS, which may always query additional DNS types. If this policy is unset or set to Enabled, additional types such as HTTPS (DNS type 65) may be queried in addition to A (DNS type 1) and AAAA (DNS type 28). If this policy is set to Disabled, DNS will only be queried for A (DNS type 1) and/or AAAA (DNS type 28). This policy is a temporary measure and will be removed in future versions of Google Chrome. After removal of the policy, Google Chrome will always be able to query additional DNS types. Allow additional DNS query types Prevent additional DNS query types True False Ads setting for sites with intrusive ads Unless SafeBrowsingEnabled is set to False, then setting AdsSettingForIntrusiveAdsSites to 1 or leaving it unset allows ads on all sites. Setting the policy to 2 blocks ads on sites with intrusive ads. Allow ads on all sites Do not allow ads on sites with intrusive ads 1 2 List of origins allowing all HTTP authentication Setting the policy specifies for which origins to allow all the HTTP authentication schemes Google Chrome supports regardless of the AuthSchemes policy. Format the origin pattern according to this format (https://support.google.com/chrome/a?p=url_blocklist_filter_format). Up to 1,000 exceptions can be defined in AllHttpAuthSchemesAllowedForOrigins. Wildcards are allowed for the host component (e.g., \'*:8000\' matches all hosts on port 8000). To match all schemes or all ports, omit the component entirely (e.g., \'example.com\' matches any scheme and any port). A hostname (e.g., \'example.com\') also matches its subdomains. To match a host exactly and exclude its subdomains, prepend it with a dot (e.g., \'.example.com\'). To match all origins, use a single asterisk (\'*\'). Allow pages with Cache-Control: no-store header to enter back/forward cache This policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header may not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible. If the policy is enabled or unset, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered (e.g. when there is HTTP-only cookie change to the site). If the policy is disabled, the page with Cache-Control: no-store header will not be stored in back/forward cache. Allow pages with Cache-Control: no-store header to be stored in back/forward cache. Disallow pages with Cache-Control: no-store header to be stored in back/forward cache. True False Allow socket pool size randomization for proxies Socket pool size randomization is a security mechanism that prevents attackers from exploiting deterministic capacity limits to learn cross-site information. If the capacity for a pool is normally 128 sockets, this mechanism randomly caps the pool between 128 and 256. This can allow up to 2x as many connections to the proxy, but in practice the expected value is more like 1.2x. This impacts the settings from MaxConnectionsPerProxy and MaxConnectionsPerProxyForWebSocket. Instead of them defining the upper limit, the upper limit is 2x their values (though again, the expected value in practice is more like 1.2x them). This is enabled by default for all pools, but this policy allows the feature to be disabled for proxy pools specifically. Allow socket pool randomization for proxies Prevent socket pool randomization for proxies True False Allow Web Authentication requests on sites with broken TLS certificates. If set to Enabled, Google Chrome will allow Web Authentication requests on websites that have TLS certificates with errors (i.e. websites considered not secure). If the policy is set to Disabled or left unset, the default behavior of blocking such requests will apply. Allow WebAuthn API requests on sites with broken TLS certificates. Do not allow WebAuthn API requests on sites with broken TLS certificates. True False Define domains allowed to access Google Workspace Setting the policy turns on Chrome\'s restricted sign-in feature in Google Workspace and prevents users from changing this setting. Users can only access Google tools using accounts from the specified domains (to allow gmail or googlemail accounts, add consumer_accounts to the list of domains). This setting prevents users from signing in and adding a Secondary Account on a managed device that requires Google authentication, if that account doesn\'t belong to one of the explicitly allowed domains. Leaving this setting empty or unset means users can access Google Workspace with any account. Users cannot change or override this setting. Note: This policy causes the X-GoogApps-Allowed-Domains header to be appended to all HTTP and HTTPS requests to all google.com domains, as described in https://support.google.com/a/answer/1668854. Enable alternate error pages Setting the policy to True means Google Chrome uses alternate error pages built into (such as \"page not found\"). Setting the policy to False means Google Chrome never uses alternate error pages. If you set the policy, users can\'t change it. If not set, the policy is on, but users can change this setting. Enable alternate error pages Disable alternate error pages Allow the user to decide True False None Allow automatic sign-in to Microsoft® cloud identity providers on Android Configures automatic user sign-in for accounts backed by a Microsoft® cloud identity provider on Android. By setting this policy to 1 (Enabled), users who have signed into a Microsoft® productivity application on their device can be automatically signed into Microsoft® web properties within Google Chrome. This functionality requires the presence of a Microsoft® authentication broker app, such as Microsoft® Authenticator®, Microsoft® Intune Company Portal®, or Microsoft® Link to Windows®. To facilitate the single sign-on, necessary authentication data is shared with the Microsoft® cloud identity provider. By setting this policy to 0 (Disabled) or leaving it unset, automatic sign-in as described above is disabled, and users must manually provide credentials for Microsoft® web properties. Note: This policy does not apply to Incognito or Guest modes. Disable Microsoft® cloud authentication Enable Microsoft® cloud authentication 0 1 Account type for HTTP Negotiate authentication Setting the policy specifies the type of accounts provided by the Android authentication app that supports HTTP Negotiate authentication (such as Kerberos authentication). This information should be available from the supplier of the authentication app. For details, see The Chromium Projects ( https://goo.gl/hajyfN ) Leaving the policy unset turns off HTTP Negotiate authentication on Android. Kerberos delegation server allowlist Setting the policy assigns servers that Google Chrome may delegate to. Separate multiple server names with commas. Wildcards, *, are allowed. Leaving the policy unset means Google Chrome won\'t delegate user credentials, even if a server is detected as intranet. Supported authentication schemes Setting the policy specifies which HTTP authentication schemes Google Chrome supports. Leaving the policy unset employs all 4 schemes. Valid values: * basic * digest * ntlm * negotiate Note: Separate multiple values with commas. Authentication server allowlist Setting the policy specifies which servers should be allowed for integrated authentication. Integrated authentication is only on when Google Chrome gets an authentication challenge from a proxy or from a server in this permitted list. Leaving the policy unset means Google Chrome tries to detect if a server is on the intranet. Only then will it respond to IWA requests. If a server is detected as internet, then Google Chrome ignores IWA requests from it. Note: Separate multiple server names with commas. Wildcards, *, are allowed. Automatically select client certificates for these sites Setting the policy lets you make a list of URL patterns that specify sites for which Chrome can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { \"pattern\": \"$URL_PATTERN\", \"filter\" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server\'s certificate request are selected. On Android and iOS, Chrome can only select client certificates that it has provisioned itself; it cannot access certificates installed at the operating system level. Examples for the usage of the $FILTER section: * When $FILTER is set to { \"ISSUER\": { \"CN\": \"$ISSUER_CN\" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected. * When $FILTER contains both the \"ISSUER\" and the \"SUBJECT\" sections, only client certificates that satisfy both conditions are selected. * When $FILTER contains a \"SUBJECT\" section with the \"O\" value, a certificate needs at least one organization matching the specified value to be selected. * When $FILTER contains a \"SUBJECT\" section with a \"OU\" value, a certificate needs at least one organizational unit matching the specified value to be selected. * When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply. Leaving the policy unset means there\'s no autoselection for any site. Enable AutoFill for addresses Setting the policy to True or leaving it unset gives users control of Autofill for addresses in the UI. Setting the policy to False means Autofill never suggests or fills address information, nor does it save additional address information that users submit while browsing the web. Enable AutoFill for addresses Disable AutoFill for addresses True False Enable AutoFill for credit cards Setting the policy to True or leaving it unset means users can control autofill suggestions for credit cards in the UI. Setting the policy to False means autofill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web. Enable AutoFill for credit cards Disable AutoFill for credit cards True False Settings for enhanced autofill Specifies whether users can let Google Chrome use Generative AI to better understand forms and help them fill more fields. 0 = Has the same effect as 1. Before M153, the setting allowed Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. 0 is the default value, except when noted below. 1 = Allow the feature to be used, but does not allow Google to improve models using relevant data (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace. 2 = Do not allow the feature. If the policy is unset, its behavior is determined by the GenAiDefaultSettings policy. For more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings. Allow enhanced autofill without improving AI models (improves AI models prior to M153). Allow enhanced autofill without improving AI models. Do not allow enhanced autofill. 0 1 2 Allow automatic downloads on these sites Allows you to set a list of URL patterns that specify sites which are allowed to download multiple files automatically. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns. If a URL matches both AutomaticDownloadsAllowedForUrls and AutomaticDownloadsBlockedForUrls, AutomaticDownloadsBlockedForUrls takes precedence. If this policy is not set, DefaultAutomaticDownloadsSetting applies for all sites, if it is set. If not, the user\'s personal setting applies. Block automatic downloads on these sites Allows you to set a list of URL patterns that specify sites which are not allowed to download multiple files automatically. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns. If a URL matches both AutomaticDownloadsAllowedForUrls and AutomaticDownloadsBlockedForUrls, AutomaticDownloadsBlockedForUrls takes precedence. If this policy is not set, DefaultAutomaticDownloadsSetting applies for all sites, if it is set. If not, the user\'s personal setting applies. Allow media autoplay Setting the policy to True lets Google Chrome autoplay media. Setting the policy to False stops Google Chrome from autoplaying media. If this policy is left unset, Google Chrome doesn\'t autoplay media. But, for certain URL patterns, you can use the AutoplayAllowlist policy to change this setting. If this policy changes while Google Chrome is running, it only applies to newly opened tabs. Allow Chrome to autoplay media Do not allow Chrome to autoplay media Do not allow Chrome to autoplay media unless the URL is specified in the AutoplayAllowlist policy True False None Allow media autoplay on a allowlist of URL patterns Setting the policy lets videos play automatically (without user consent) with audio content in Google Chrome. If AutoplayAllowed policy is set to True, then this policy has no effect. If AutoplayAllowed is set to False, then any URL patterns set in this policy can still play. If this policy changes while Google Chrome is running, it only applies to newly opened tabs. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. Control the BackForwardCache feature. When enabled the BackForwardCache feature allows the use of the back-forward cache. When navigating away from a page, its current state (document tree, script, etc.) may be preserved in the back-forward cache. If the browser navigates back to the page, the page may be restored from the back-forward cache and displayed in the state it was in before being cached. This feature might cause issues for some websites that do not expect this caching. In particular, some websites depend on the \"unload\" event being dispatched when the browser navigates away from the page. The \"unload\" event will not be dispatched if the page enters the back-forward cache. If this policy is set to enabled or not set, the BackForwardCache feature will be enabled. If this policy is set to disabled then the feature will be force disabled. Allow the back-forward cache to be used Do not allow the back-forward cache to be used True False Allow Back/Forward Cache for WebSockets This policy controls whether active WebSocket connections are disconnected when a page enters back/forward cache. Active WebSocket connections previously prevented a page from being stored in back/forward cache, but Google Chrome has changed this behavior to disconnect the WebSockets instead, allowing the page to be cached and restoring it in a disconnected state. If this policy is set to Enabled or left unset, WebSockets are disconnected when a page enters back/forward cache. If this policy is set to Disabled, WebSockets will not be disconnected when a page enters back/forward cache. Since back/forward cache does not support active WebSockets, this means pages with active WebSockets will not be cached. This policy is intended to be temporary and will be removed in the future. Allow Back/Forward Cache for WebSockets (disconnect them when entering cache). Active WebSocket connections will prevent pages from entering Back/Forward Cache. True False Blocks external extensions from being installed Controls external extensions installation. Setting this policy to Enabled blocks external extensions from being installed. Setting this policy to Disabled or leaving it unset allows external extensions to be installed. External extensions and their installation are documented at https://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions. Note: This policy only applies to platforms that support extensions. Block installation of external extensions Allow installation of external extensions True False Block third party cookies Setting the policy to Enabled prevents webpage elements that aren\'t from the domain that\'s in the browser\'s address bar from setting cookies. Setting the policy to Disabled lets those elements set cookies and prevents users from changing this setting. Leaving it unset allows third-party cookies, but users can change this setting. Note: This policy doesn\'t apply in Incognito mode, where third-party cookies are blocked and can only be allowed at the site level. To allow cookies at the site level, use the CookiesAllowedForUrls policy. Block 3rd party cookies Allow 3rd party cookies Allow 3rd party cookies, but allow the user to change this setting True False None Enable Bookmark Bar Setting the policy to True displays a bookmark bar in Google Chrome. Setting the policy to False means users never see the bookmark bar. If you set the policy, users can\'t change it. If not set, users decide whether to use this function. Enable bookmark bar Disable bookmark bar Allow the user to decide True False None Browser sign in settings This policy controls the sign-in behavior of the browser. It allows you to specify if the user can sign in to Google Chrome with their account and use account related services like Google Chrome Sync. If the policy is set to \"Disable browser sign-in\" then the user cannot sign in to the browser and use account-based services. In this case browser-level features like Google Chrome Sync cannot be used and will be unavailable. On iOS, if the user was signed in and the policy is set to \"Disabled\" they will be signed out immediately. On other platforms, they will be signed out the next time they run Google Chrome. On all platforms, their local profile data like bookmarks, passwords etc. will be preserved and still usable. The user will still be able to sign into and use Google web services like Gmail. If the policy is set to \"Enable browser sign-in,\" then the user is allowed to sign in to the browser. On all platforms except iOS, the user is automatically signed in to the browser when signed in to Google web services like Gmail. Being signed in to the browser means the user\'s account information will be kept by the browser. However, it does not mean that Google Chrome Sync will be turned on by default; the user must separately opt-in to use this feature. Enabling this policy will prevent the user from turning off the setting that allows browser sign-in. To control the availability of Google Chrome Sync, use the SyncDisabled policy. If the policy is set to \"Force browser sign-in\" the user is presented with an account selection dialog and has to choose and sign in to an account to use the browser. This ensures that for managed accounts the policies associated with the account are applied and enforced. The default value of BrowserGuestModeEnabled will be set to disabled. Note that existing unsigned profiles will be locked and inaccessible after enabling this policy. For more information, see help center article: https://support.google.com/chrome/?p=force_browser_signin . This option is not supported on Google ChromeOS nor Android, where it will fall back to \"Enable browser sign-in\" if used. If this policy is not set then the user can decide if they want to enable browser sign-in in the Google Chrome settings and use it as they see fit. Disable browser sign-in Enable browser sign-in Force users to sign-in to use the browser 0 1 2 Browsing Data Lifetime Settings Configures browsing data lifetime settings for Google Chrome. This policy allows admins to configure (per data-type) when data is deleted by the browser. This is useful for customers that work with sensitive customer data. Warning: Setting this policy can impact and permanently remove local personal data. It is recommended to test your settings before deploying to prevent accidental deletion of personal data. The available data types are \'browsing_history\', \'download_history\', \'cookies_and_other_site_data\', \'cached_images_and_files\', \'password_signin\', \'autofill\', \'site_settings\' and \'hosted_app_data\'. \'download_history\' and \'hosted_app_data\' are not supported on Android. The browser will automatically remove data of selected types that is older than \'time_to_live_in_hours\'. The minimum value that can be set is 1 hour. The deletion of expired data will happen 15 seconds after the browser starts then every 30 minutes while the browser is running. The user will stay signed into their Google account when deleting cookies. Until Chrome 114, this policy required the SyncDisabled policy to be set to true. Starting Chrome 115, setting this policy will disable sync for the respective data types if neither `Chrome Sync` is disabled by setting the SyncDisabled policy nor BrowserSignin is disabled. Use built-in DNS client This policy controls which software stack is used to communicate with the DNS server: the Operating System DNS client, or Google Chrome\'s built-in DNS client. This policy does not affect which DNS servers are used: if, for example, the operating system is configured to use an enterprise DNS server, that same server would be used by the built-in DNS client. It also does not control if DNS-over-HTTPS is used; Google Chrome will always use the built-in resolver for DNS-over-HTTPS requests. Please see the DnsOverHttpsMode policy for information on controlling DNS-over-HTTPS. If this policy is set to Enabled or is left unset, the built-in DNS client will be used. If this policy is set to Disabled, the built-in DNS client will only be used when DNS-over-HTTPS is in use. Always use the built-in DNS client Never use the built-in DNS client Always use the built-in DNS client True False None TLS certificates that should be trusted by Google Chrome for server authentication A list of TLS certificates that should be trusted by Google Chrome for server authentication. Certificates should be base64-encoded. TLS certificates that should be trusted by Google Chrome for server authentication with constraints A list of TLS certificates that should be trusted by Google Chrome for server authentication, with constraints added outside the certificate. If no constraint of a certain type is present, then any name of that type is allowed. Certificates should be base64-encoded. At least one constraint must be specified for each certificate. TLS certificates that should be distrusted by Google Chrome for server authentication A list of certificate public keys that should be distrusted by Google Chrome for TLS server authentication. The policy value is a list of base64-encoded X.509 certificates. Any certificate with a matching SPKI (SubjectPublicKeyInfo) will be distrusted. TLS certificates that are not trusted or distrusted but can be used in path-building for server authentication A list of certificates that are not trusted or distrusted in Google Chrome but can be used as hints for path-building. Certificates should be base64-encoded. Use user-added TLS certificates from platform trust stores for server authentication If enabled(or not set), user-added TLS certificates from platform trust stores will be used in path-building for TLS server authentication. If disabled, user-added TLS certificates from platform trust stores will not be used in path-building for TLS server authentication. Import user-added TLS server certificates from platform trust stores. Do not import user-added TLS server certificates from platform trust stores. True False CORS non-wildcard request headers support Configures support of CORS non-wildcard request headers. Google Chrome version 97 introduces support for CORS non-wildcard request headers. When scripts make a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header must be explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. \"Explicitly\" here means that the wild card symbol \"*\" doesn\'t cover the Authorization header. See https://chromestatus.com/feature/5742041264816128 for more detail. If this policy is not set, or set to True, Google Chrome will support the CORS non-wildcard request headers and behave as described above. When this policy is set to False, chrome will allow the wildcard symbol (\"*\") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header. This Enterprise policy is temporary; it\'s intended to be removed in the future. Support CORS non-wildcard request headers. Do not support CORS non-wildcard request headers. True False Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes Setting the policy turns off enforcement of Certificate Transparency disclosure requirements for a list of subjectPublicKeyInfo hashes. Enterprise hosts can keep using certificates that otherwise wouldn\'t be trusted (because they weren\'t properly publicly disclosed). To turn off enforcement, the hash must meet one of these conditions: * It\'s of the server certificate\'s subjectPublicKeyInfo. * It\'s of a subjectPublicKeyInfo that appears in a Certificate Authority (CA) certificate in the certificate chain. That CA certificate is constrained through the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName has an organizationName attribute. * It\'s of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server\'s certificate has the same number of organizationName attributes, in the same order, and with byte-for-byte identical values. Specify a subjectPublicKeyInfo hash by linking the hash algorithm name, a slash, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. Base64 encoding format matches that of an SPKI Fingerprint. The only recognized hash algorithm is sha256; others are ignored. Leaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren\'t disclosed, then Google Chrome doesn\'t trust those certificates. Disable Certificate Transparency enforcement for a list of URLs Setting the policy turns off Certificate Transparency disclosure requirements for the hostnames in the specified URLs. While making it harder to detect misissued certificates, hosts can keep using certificates that otherwise wouldn\'t be trusted (because they weren\'t properly publicly disclosed). Leaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren\'t disclosed, then Google Chrome doesn\'t trust those certificates. A URL pattern follows this format ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). However, because the validity of certificates for a given hostname is independent of the scheme, port, or path, Google Chrome only considers the hostname portion of the URL. Wildcard hosts aren\'t supported. Allow Chrome for Testing Controls whether users may use Chrome for Testing. If this policy is set to Enabled or not set, users may install and run Chrome for Testing. If this policy is set to Disabled, users are not allowed to run Chrome for Testing. Users will still be able to install Chrome for Testing, however it will not run with the profiles where this policy is set to Disabled. Allow use of the Chrome for Testing Do not allow use of the Chrome for Testing True False Determine the availability of variations Configuring this policy allows to specify which variations are allowed to be applied in Google Chrome. Variations provide a means for offering modifications to Google Chrome without shipping a new version of the browser by selectively enabling or disabling already existing features. See https://support.google.com/chrome/a?p=Manage_the_Chrome_variations_framework for more information. Setting the VariationsEnabled (value 0), or leaving the policy not set allows all variations to be applied to the browser. Setting the CriticalFixesOnly (value 1), allows only variations considered critical security or stability fixes to be applied to Google Chrome. Setting the VariationsDisabled (value 2), prevent all variations from being applied to the browser. Please note that this mode can potentially prevent the Google Chrome developers from providing critical security fixes in a timely manner and is thus not recommended. Enable all variations Enable variations concerning critical fixes only Disable all variations 0 1 2 Allow clipboard on these sites Setting the policy lets you set a list of URL patterns that specify sites that can use the clipboard site permission. This does not include all clipboard operations on origins matching the patterns. For instance, users will still be able to paste using keyboard shortcuts as this isn\'t gated by the clipboard site permission. Leaving the policy unset means DefaultClipboardSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Block clipboard on these sites Setting the policy lets you set a list of URL patterns that specify sites that can\'t use the clipboard site permission. This does not include all clipboard operations on origins matching the patterns. For instance, users will still be able to paste using keyboard shortcuts as this isn\'t gated by the clipboard site permission. Leaving the policy unset means DefaultClipboardSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. The enrollment token of cloud policy Setting the policy means Google Chrome tries to register itself with Chrome Enterprise Core browser management. The value of this policy is an enrollment token you can retrieve from the Google Admin console. See https://support.google.com/chrome/a/answer/9301891 for details. Google Chrome cloud policy overrides Platform policy. Setting the policy to Enabled means cloud policy takes precedence if it conflicts with platform policy. Setting the policy to Disabled or leaving it unset means platform policy takes precedence if it conflicts with cloud policy. This mandatory policy affects machine scope cloud policies. This policy is specific to Google Chrome and does not affect Google Update because they are independent applications. Google Update has a separate policy with the same name. Cloud machine policies take precedence over platform machine policies Platform machine policies take precedence over cloud machine policies True False Enables merging of user cloud policies into machine-level policies Setting the policy to Enabled allows policies associated with a managed account to be merged into machine-level policies. Setting the policy to Disabled or leaving it unset prevents user-level cloud policies from being merged with policies from any other sources. Only policies originating from secure users can take precedence. A secure user is affiliated with the organization that manages their browser using Chrome Enterprise Core. All other user-level policies will have default precedence. Policies that need to be merged also need to be set in either PolicyListMultipleSourceMergeList or PolicyDictionaryMultipleSourceMergeList. This policy will be ignored if neither of the two aforementioned policies is configured. Enable merging of user-level cloud policies. Disable merging of user-level cloud policies. True False Allow user cloud policies to override Chrome Browser Cloud Management policies. Setting the policy to Enabled allows policies associated with a managed account to take precedence if they conflict with Chrome Enterprise Core browser policies. Setting the policy to Disabled or leaving it unset causes user-level cloud policies to have default priority. Only policies originating from secure users can take precedence. A secure user is affiliated with the organization that manages their browser using Chrome Enterprise Core. All other user-level policies will have default precedence. The policy can be combined with CloudPolicyOverridesPlatformPolicy. If both policies are enabled, user cloud policies will also take precedence over conflicting platform policies. Allow user cloud policies to override machine cloud policies. Prevent user cloud policies from overriding machine cloud policies. True False Enable component updates in Google Chrome Enables component updates for all components in Google Chrome when not set or set to enabled. If set to disabled, updates to components are disabled. However, some components are exempt from this policy: updates to any component that does not contain executable code and is critical for the security of the browser will not be disabled. Examples of such components include the certificate revocation lists and subresource filters. Enable updates for all components Disable updates for non-critical components True False Enable Touch to Search Setting the policy to True or leaving it unset makes Touch to Search available to the user, and they can turn the feature on or off. Setting the policy to False turns Touch to Search off completely. Allow users to use Touch to Search Prevent users from using Touch to Search True False Allow cookies on these sites Allows you to set a list of url patterns that specify sites which are allowed to set cookies. URL patterns may be a single URL indicating that the site may use cookies on all top-level sites. Patterns may also be two URLs delimited by a comma. The first specifies the site that should be allowed to use cookies. The second specifies the top-level site that the first value should be applied on. If you use a pair of URLs, the first value in the pair supports * but the second value does not. Using * for the first value indicates that all sites may use cookies when the second URL is the top-level site. If this policy is left not set the global default value will be used for all sites either from the DefaultCookiesSetting or BlockThirdPartyCookies policies if they are set, or the user\'s personal configuration otherwise. See also policies CookiesBlockedForUrls and CookiesSessionOnlyForUrls. Note that there must be no conflicting URL patterns between these three policies - it is unspecified which policy takes precedence. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Block cookies on these sites Setting the policy lets you make a list of URL patterns that specify sites that can\'t set cookies. Leaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it\'s set. If not, the user\'s personal setting applies. While no specific policy takes precedence, see CookiesAllowedForUrls and CookiesSessionOnlyForUrls. URL patterns among these 3 policies must not conflict. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Limit cookies from matching URLs to the current session Unless the RestoreOnStartup policy is set to permanently restore URLs from previous sessions, then setting CookiesSessionOnlyForUrls lets you make a list of URL patterns that specify sites that can and can\'t set cookies for one session. Leaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it\'s set. If not, the user\'s personal setting applies. URLs not covered by the patterns specified also result in the use of defaults. While no specific policy takes precedence, see CookiesBlockedForUrls and CookiesAllowedForUrls. URL patterns among these 3 policies must not conflict. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Override for the CPU performance tier Setting this policy allows enterprises to override the value returned by the CPU Performance API (i.e., navigator.cpuPerformance, please see https://github.com/WICG/cpu-performance for details). If this policy is set, the value of navigator.cpuPerformance will be overridden to the specified value. If the policy is not set, then the default performance tier calculation is used. The possible values for this policy are 0 to 4. DataURL Whitespace Preservation for all media types This policy provides a temporary opt-out for changes to how Chrome handles whitepsace in data URLS. Previously, whitespace would be kept only if the top level media type was text or contained the media type string xml. Now, whitespace will be preserved in all data URLs, regardless of media type. If this policy is left unset or is set to True, the new behavior is enabled. When this policy is set to False, the old behavior is enabled. Keep whitespace for all mime-types Only keep whitespace for text and xml mime-types True False Data URL support for SVGUseElement. This policy enables Data URL support for SVGUseElement, which will be disabled by default starting in M119. If this policy is set to Enabled, Data URLs will continue to work in SVGUseElement. If this policy is set to Disabled or not set, Data URLs won\'t work in SVGUseElement. Enable Data URL support in SVGUseElement. Disable Data URL support in SVGUseElement. True False Enable opaque origins for data URLs in Web Workers Controls whether Web Workers created from data URLs are assigned a unique opaque origin. Web Workers can be created using a data URL containing the worker\'s script. Previously, these workers inherited the origin of the page that created them, allowing them to access the same local storage, cookies, and other origin-bound data. To improve security and align with the HTML specification, Chrome is changing its default behavior in milestone 149 so that workers created from data URLs will now have a unique, opaque origin. This isolates them from the creator page\'s data. If this policy is set to Enabled or left unset, the new default (more secure) behavior is used, and Web Workers created from data URLs will have a unique opaque origin. If this policy is set to Disabled, Chrome reverts to the legacy behavior, and Web Workers created from data URLs will inherit the origin of their creator. This allows administrators to temporarily resolve compatibility issues if internal applications break due to the security change. This policy is intended to be temporary and will be removed in milestone 157. Opaque origins for data URLs in Web Workers are enabled (new default behavior) Opaque origins for data URLs in Web Workers are disabled (deprecated legacy behavior) True False Default automatic downloads setting Setting the policy to 1 lets websites download multiple files automatically. Setting the policy to 2 denies this permission. You can set the policy to ask whenever a website wants to download multiple files automatically. Leaving the policy unset means the AskAutomaticDownloads policy applies, but users can change this setting. Allow sites to download multiple files automatically Do not allow any site to download multiple files automatically Ask whenever a site wants to download multiple files automatically 1 2 3 Default clipboard setting Setting the policy to 2 blocks sites from using the clipboard site permission. Setting the policy to 3 or leaving it unset lets the user change the setting and decide if the clipboard APIs are available when a site wants to use one. This policy can be overridden for specific URL patterns using the ClipboardAllowedForUrls and ClipboardBlockedForUrls policies. This policy only affects clipboard operations controlled by the clipboard site permission, and does not affect sanitized clipboard writes or trusted copy and paste operations. Do not allow any site to use the clipboard site permission Allow sites to ask the user to grant the clipboard site permission 2 3 Default cookies setting Unless the RestoreOnStartup policy is set to permanently restore URLs from previous sessions, then setting CookiesSessionOnlyForUrls lets you make a list of URL patterns that specify sites that can and can\'t set cookies for one session. Leaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it\'s set. If not, the user\'s personal setting applies. URLs not covered by the patterns specified also result in the use of defaults. While no specific policy takes precedence, see CookiesBlockedForUrls and CookiesAllowedForUrls. URL patterns among these 3 policies must not conflict. Allow all sites to set local data Do not allow any site to set local data Keep cookies for the duration of the session 1 2 4 Default geolocation setting Setting the policy to 1 lets sites track the users\' physical location as the default state. Setting the policy to 2 denies this tracking by default. You can set the policy to ask whenever a site wants to track the users\' physical location. Leaving the policy unset means the AskGeolocation policy applies, but users can change this setting. Allow sites to track the users\' physical location Do not allow any site to track the users\' physical location Ask whenever a site wants to track the users\' physical location 1 2 3 Default idle detection setting Allows you to set whether websites are allowed to use the Idle Detection API. When this policy is set to 1 - AllowIdleDetection, websites can use the API without asking the user for permission. When this policy is set to 2 - BlockIdleDetection, websites can\'t use the API, regardless of the user\'s permission. When this policy is set to 3 - AskIdleDetection or not set, websites can\'t use the API without the user\'s permission. Allow sites to detect idle state without asking the user Do not allow any site to detect the user\'s idle state Ask every time a site wants to detect the user\'s idle state 1 2 3 Control use of JavaScript JIT Allows you to set whether Google Chrome will run the v8 JavaScript engine with JIT (Just In Time) compiler enabled or not. Disabling the JavaScript JIT will mean that Google Chrome may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Google Chrome to render web content in a more secure configuration. This policy can be overridden for specific URL patterns using the JavaScriptJitAllowedForSites and JavaScriptJitBlockedForSites policies. If this policy is left not set, JavaScript JIT is enabled. Allow any site to run JavaScript JIT Do not allow any site to run JavaScript JIT 1 2 Control use of JavaScript optimizers Allows you to set whether Google Chrome will run the v8 JavaScript engine with more advanced JavaScript optimizations enabled. Disabling JavaScript optimizations (by setting this policy\'s value to 2) will mean that Google Chrome may render web content more slowly. This policy can be overridden for specific URL patterns using the JavaScriptOptimizerAllowedForSites and JavaScriptOptimizerBlockedForSites policies. If this policy is left not set, JavaScript optimizations are enabled. Enable advanced JavaScript optimizations on all sites Disable advanced JavaScript optimizations on all sites 1 2 Default JavaScript setting Setting the policy to 1 lets websites run JavaScript. Setting the policy to 2 denies JavaScript. Leaving it unset allows JavaScript, but users can change this setting. Allow all sites to run JavaScript Do not allow any site to run JavaScript 1 2 Default notification setting Setting the policy to 1 lets websites display desktop notifications. Setting the policy to 2 denies desktop notifications. Leaving it unset means AskNotifications applies, but users can change this setting. Allow sites to show desktop notifications Do not allow any site to show desktop notifications Ask every time a site wants to show desktop notifications 1 2 3 Default pop-ups setting Setting the policy to 1 lets websites display pop-ups. Setting the policy to 2 denies pop-ups. Leaving it unset means BlockPopups applies, but users can change this setting. Allow all sites to show pop-ups Do not allow any site to show pop-ups 1 2 List of alternate URLs for the default search provider If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderAlternateURLs specifies a list of alternate URLs for extracting search terms from the search engine. The URLs should include the string \'{searchTerms}\'. Leaving DefaultSearchProviderAlternateURLs unset means no alternate URLs are used to extract search terms. Enable the default search provider Setting the policy to Enabled means a default search is performed when a user enters non-URL text in the address bar. To specify the default search provider, set the rest of the default search policies. If you leave those policies empty, the user can choose the default provider. Setting the policy to Disabled means there\'s no search when the user enters non-URL text in the address bar. The Disabled value is not supported by the Google Admin console. If you set the policy, users can\'t change it in Google Chrome. If not set, the default search provider is on, and users can set the search provider list. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Enable the default search provider Disable the default search provider Enable the default search provider and allow users to modify the search provier list True False None Default search provider encodings If DefaultSearchProviderEnabled is on, setting DefaultSearchProviderEncodings specifies the character encodings supported by the search provider. Encodings are code page names such as UTF-8, GB2312, and ISO-8859-1. They\'re tried in the order provided. Leaving DefaultSearchProviderEncodings unset puts UTF-8 in use. Parameter providing search-by-image feature for the default search provider If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURL specifies the URL of the search engine used for image search. (If DefaultSearchProviderImageURLPostParams is set, then image search requests use the POST method instead.) Leaving DefaultSearchProviderImageURL unset means no image search is used. If image search uses the GET method, then the URL must specify image parameters using a valid combination of the following placeholders: \'{google:imageURL}\', \'{google:imageOriginalHeight}\', \'{google:imageOriginalWidth}\', \'{google:processedImageDimensions}\', \'{google:imageSearchSource}\', \'{google:imageThumbnail}\', \'{google:imageThumbnailBase64}\'. Parameters for image URL which uses POST If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURLPostParams specifies the parameters during image search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as {imageThumbnail}, real image thumbnail data replaces it. Leaving DefaultSearchProviderImageURLPostParams unset means image search request is sent using the GET method. The URL must specify the image parameter using a valid combination of the following placeholders depending on what the search provider supports: \'{google:imageURL}\', \'{google:imageOriginalHeight}\', \'{google:imageOriginalWidth}\', \'{google:processedImageDimensions}\', \'{google:imageSearchSource}\', \'{google:imageThumbnail}\', \'{google:imageThumbnailBase64}\'. Default search provider name If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderName specifies the default search provider\'s name. Leaving DefaultSearchProviderName unset means the hostname specified by the search URL is used. Default search provider search URL If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURL specifies the URL of the search engine used during a default search. The URL should include the string \'{searchTerms}\', replaced in the query by the user\'s search terms. You can specify Google\'s search URL as: \'{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}\'. Parameters for search URL which uses POST If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURLPostParams specifies the parameters when searching a URL with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as \'{searchTerms}\', real search terms data replaces it. Leaving DefaultSearchProviderSearchURLPostParams unset means search requests are sent using the GET method. Default search provider suggest URL If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURL specifies the URL of the search engine to provide search suggestions. The URL should include the string \'{searchTerms}\', replaced in the query by the user\'s search terms. You can specify Google\'s search URL as: \'{google:baseURL}complete/search?output=chrome&q={searchTerms}\'. Parameters for suggest URL which uses POST If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURLPostParams specifies the parameters during suggestion search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as \'{searchTerms}\', real search terms data replaces it. Leaving DefaultSearchProviderSuggestURLPostParams unset unset means suggest search requests are sent using the GET method. Default sensors setting Setting the policy to 1 lets websites access and use sensors such as motion and light. Setting the policy to 2 denies access to sensors. When the policy is set to 3 it will ask the user when a site requests access to sensors if the tri-state feature flag is enabled, otherwise it will default to allowing access to sensors. Leaving it unset means AllowSensors applies, but users can change this setting. Allow sites to access sensors Do not allow any site to access sensors Ask whenever a site wants to access sensors 1 2 3 Control use of the Serial API Setting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports. Leaving it unset lets websites ask for access, but users can change this setting. Do not allow any site to request access to serial ports via the Serial API Allow sites to ask the user to grant access to a serial port 2 3 Control use of the Web Bluetooth API Setting the policy to 3 lets websites ask for access to nearby Bluetooth devices. Setting the policy to 2 denies access to nearby Bluetooth devices. Leaving the policy unset lets sites ask for access, but users can change this setting. Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API Allow sites to ask the user to grant access to a nearby Bluetooth device 2 3 Control use of the WebUSB API Setting the policy to 3 lets websites ask for access to connected USB devices. Setting the policy to 2 denies access to connected USB devices. Leaving it unset lets websites ask for access, but users can change this setting. Do not allow any site to request access to USB devices via the WebUSB API Allow sites to ask the user to grant access to a connected USB device 2 3 Control where Developer Tools can be used Setting the policy to 0 (the default) means you can access the developer tools and the JavaScript console, but not in the context of extensions installed by enterprise policy or, since version 114 and if this is a managed user, extensions built into the browser. Setting the policy to 1 means you can access the developer tools and the JavaScript console in all contexts, including that of extensions installed by enterprise policy. Setting the policy to 2 means you can\'t access developer tools, and you can\'t inspect website elements. This setting also turns off keyboard shortcuts and menu or context menu entries to open developer tools or the JavaScript console. As of Google Chrome version 99, this setting also controls entry points for the \'View page source\' feature. If you set this policy to \'DeveloperToolsDisallowed\' (value 2), users cannot access source viewing via keyboard shortcut or the context menu. To fully block source viewing, you must also add \'view-source:*\' to the URLBlocklist policy. As of Google Chrome version 119, this setting also controls whether developer mode for Isolated Web Apps can be activated and used. As of Google Chrome version 128, this setting will not control developer mode on extensions page if ExtensionDeveloperModeSettings policy is set. The availability of Developer Tools is determined in the following order of precedence: 1. If a URL matches a pattern in the DeveloperToolsAvailabilityAllowlist policy, Developer Tools are allowed. 2. If the DeveloperToolsAvailabilityAllowlist is set and the DeveloperToolsAvailabilityBlocklist is not, any URL not on the allowlist is blocked. 3. If a URL matches a pattern in the DeveloperToolsAvailabilityBlocklist policy, Developer Tools are blocked. 4. If a URL is not covered by the allowlist or blocklist, this policy (DeveloperToolsAvailability) is the fallback. Disallow usage of the Developer Tools on apps and extensions installed by enterprise policy or, since version 114 and if this is a managed user, extensions built into the browser. Allow usage of the Developer Tools in other contexts Allow usage of the Developer Tools Disallow usage of the Developer Tools 0 1 2 List of URL patterns for which Chrome DevTools are allowed to be opened This policy can be used to allow Chrome DevTools on specific URLs. URL patterns are matched against the URL of every frame on the page being inspected. The resulting behavior depends on whether the DeveloperToolsAvailabilityBlocklist policy is also set. If this policy is set and DeveloperToolsAvailabilityBlocklist is not, every frame\'s URL must match a pattern on this allowlist for Chrome DevTools to be allowed. If any frame\'s URL does not match, DevTools will be blocked for the entire page. For information on the URL format, see https://support.google.com/chrome/a?p=url_blocklist_filter_format. If both this and the DeveloperToolsAvailabilityBlocklist policies are set, this allowlist takes precedence. If a frame\'s URL matches a pattern on this allowlist, it will be allowed, even if it also matches a pattern in the blocklist. If a URL matches a pattern on the blocklist (but not the allowlist), it will be blocked. If a URL matches neither, the DeveloperToolsAvailability policy will be used as a fallback. If this policy is not set, the availability of Chrome DevTools is determined by the DeveloperToolsAvailabilityBlocklist and DeveloperToolsAvailability policies. This policy also applies to Chrome DevTools opened for extensions and web applications. Blanket host wildcards (i.e., \"*\" or \"[*]\") are not allowed; use the DeveloperToolsAvailability policy to enable the feature globally. This policy is limited to 1,000 entries. List of URL patterns for which Chrome DevTools are blocked This policy can be used to block Chrome DevTools on specific URLs. For information on the URL format, see https://support.google.com/chrome/a?p=url_blocklist_filter_format. URL patterns are matched against the URL of every frame on the page being inspected. The resulting behavior depends on whether the DeveloperToolsAvailabilityAllowlist policy is also set. If this policy is set and DeveloperToolsAvailabilityAllowlist is not, any frame\'s URL matching a pattern on this blocklist will block Chrome DevTools for the entire page. If a frame\'s URL doesn\'t match any pattern, the availability is determined by the DeveloperToolsAvailability policy. If both this and the DeveloperToolsAvailabilityAllowlist policies are set, the allowlist takes precedence. If a frame\'s URL matches a pattern on the allowlist, it will be allowed, even if it also matches a pattern in this blocklist. If a URL matches a pattern on this blocklist (but not the allowlist), it will be blocked. If a URL matches neither, the DeveloperToolsAvailability policy will be used as a fallback. If this policy is not set, the availability of Chrome DevTools is determined by the DeveloperToolsAvailabilityAllowlist and DeveloperToolsAvailability policies. This policy is limited to 1,000 entries. Disable CNAME lookup when negotiating Kerberos authentication Setting the policy to Enabled skips CNAME lookup. The server name is used as entered when generating the Kerberos SPN. Setting the policy to Disabled or leaving it unset means CNAME lookup determines the canonical name of the server when generating the Kerberos SPN. Disable CNAME lookup during Kerberos authentication Use CNAME lookup during Kerberos authentication True False Disable proceeding from the Safe Browsing warning page Setting the policy to Enabled prevents users from proceeding past the warning page the Safe Browsing service shows to the malicious site. This policy only prevents users from proceeding on Safe Browsing warnings such as malware and phishing, not for SSL certificate-related issues such as invalid or expired certificates. Setting the policy to Disabled or leaving it unset means users can choose to proceed to the flagged site after the warning appears. See more about Safe Browsing ( https://developers.google.com/safe-browsing ). Do not allow user to bypass Safe Browsing warning Allow user to bypass Safe Browsing warning True False Disable taking screenshots Setting the policy to Enabled disallows screenshots taken with keyboard shortcuts or extension APIs. Setting the policy to Disabled or not set allows screenshots. Note that on Microsoft® Windows®, macOS and Linux, this does not prevent screenshots that are taken with operating system or third party applications. Do not allow users to take screenshots or video recordings Allow users to take screenshots and video recordings True False Controls the mode of DNS-over-HTTPS Controls the mode of the DNS-over-HTTPS resolver. Please note that this policy will only set the default mode for each query. The mode may be overridden for special types of queries such as requests to resolve a DNS-over-HTTPS server hostname. The \"off\" mode will disable DNS-over-HTTPS. The \"automatic\" mode will send DNS-over-HTTPS queries first if a DNS-over-HTTPS server is available and may fallback to sending insecure queries on error. The \"secure\" mode will only send DNS-over-HTTPS queries and will fail to resolve on error. On Android Pie and above, if DNS-over-TLS is active, Google Chrome will not send insecure DNS requests. If this policy is unset, for managed devices DNS-over-HTTPS queries will not be sent. Otherwise, the browser may send DNS-over-HTTPS requests to a resolver associated with the user\'s configured system resolver. Disable DNS-over-HTTPS Enable DNS-over-HTTPS with insecure fallback Enable DNS-over-HTTPS without insecure fallback off automatic secure Specify URI template of desired DNS-over-HTTPS resolver The URI template of the desired DNS-over-HTTPS resolver. To specify multiple DNS-over-HTTPS resolvers, separate the corresponding URI templates with spaces. If the DnsOverHttpsMode is set to \"secure\" then this policy must be set and not empty. On Google ChromeOS only, either this policy or the DnsOverHttpsTemplatesWithIdentifiers must be set, otherwise the DNS resolution will fail. If the DnsOverHttpsMode is set to \"automatic\" and this policy is set then the URI templates specified will be used; if this policy is unset then hardcoded mappings will be used to attempt to upgrade the user\'s current DNS resolver to a DoH resolver operated by the same provider. If the URI template contains a dns variable, requests to the resolver will use GET; otherwise requests will use POST. Incorrectly formatted templates will be ignored. Allow reporting of domain reliability related data If this policy is set false, domain reliability diagnostic data reporting is disabled and no data is sent to Google. If this policy is set true or not set, domain reliability diagnostic data reporting will follow the behavior of MetricsReportingEnabled for Google Chrome or DeviceMetricsReportingEnabled for Google ChromeOS. Domain Reliability data may be sent to Google depending on Chrome User Metrics (UMA) policy Never send domain reliability data to Google True False Allow download restrictions Setting the policy means users can\'t bypass download security decisions. There are many types of download warnings within Chrome, which roughly break down into these categories (learn more about Safe Browsing verdicts https://support.google.com/chrome/?p=ib_download_blocked): * Malicious, as flagged by the Safe Browsing server * Uncommon or unwanted, as flagged by the Safe Browsing server * A dangerous file type (e.g. all SWF downloads and many EXE downloads) Setting the policy blocks different subsets of these, depending on it\'s value: 0: No special restrictions. Default. 1: Blocks malicious files flagged by the Safe Browsing server AND Blocks all dangerous file types. Only recommended for OUs/browsers/users that have a high tolerance for False Positives. 2: Blocks malicious files flagged by the Safe Browsing server AND Blocks uncommon or unwanted files flagged by the Safe Browsing server AND Blocks all dangerous file types. Only recommended for OUs/browsers/users that have a high tolerance for False Positives. 3: Blocks all downloads. Not recommended, except for special use cases. 4: Blocks malicious files flagged by the Safe Browsing server, does not block dangerous file types. Recommended. Note: These restrictions apply to downloads triggered from webpage content, as well as the Download link… menu option. They don\'t apply to the download of the currently displayed page or to saving as PDF from the printing options. Read more about Safe Browsing ( https://developers.google.com/safe-browsing ). No special restrictions. Default. Block malicious downloads and dangerous file types. Block malicious downloads, uncommon or unwanted downloads and dangerous file types. Block all downloads. Block malicious downloads. Recommended. 0 1 2 3 4 Enable or disable bookmark editing Setting the policy to True or leaving it unset lets users add, remove, modify, or upload bookmarks. Setting the policy to False means users can\'t add, remove, modify or upload bookmarks. They can still use existing bookmarks. Enable bookmark editing Disable bookmark editing True False Enables experimental policies Allows Google Chrome to load experimental policies. WARNING: Experimental policies are unsupported and subject to change or be removed without notice in future version of the browser! An experimental policy may not be finished or still have known or unknown defects. It may be changed or even removed without any notification. By enabling experimental policies, you could lose browser data or compromise your security or privacy. If a policy is not in the list and it\'s not officially released, its value will be ignored on Beta and Stable channel. If a policy is in the list and it\'s not officially released, its value will be applied. This policy has no effect on already released policies. Enable Google Cast Setting the policy to Enabled or leaving it unset turns on Google Cast, which users can launch from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the Cast toolbar icon. Setting the policy to Disabled turns off Google Cast. Allow users to use Google Cast Do not allow users to use Google Cast True False Enable TLS Encrypted ClientHello Encrypted ClientHello (ECH) is an extension to TLS to encrypt sensitive fields of the ClientHello and improve privacy. If this policy is not configured, or is set to enabled, Google Chrome will follow the default rollout process for ECH. If it is disabled, Google Chrome will not enable ECH. When the feature is enabled, Google Chrome may or may not use ECH depending on server support, availability of the HTTPS DNS record, or rollout status. ECH is an evolving protocol, so Google Chrome\'s implementation is subject to change. As such, this policy is a temporary measure to control the initial experimental implementation. It will be replaced with final controls as the protocol finalizes. Enable the TLS Encrypted ClientHello experiment Disable the TLS Encrypted ClientHello experiment True False External authentication app launch URLs Allows you to specify configs for authentication urls in Android WebView. These Authentication urls would be treated special by Android WebView, such that during authentication when webpage in Android WebView is navigated to authentication urls, corresponding Identity providers authenticator app that can handle this authentication URL would be launched. This flow of launching the Identity providers authenticator app would be used by the Identity providers to enable use cases like providing SSO across apps or provide better security by collecting zero trust device signals to understand device posture during authentication. If there is no valid app installed to handle authentication url on the device, navigation will continue in Android WebView. Authentication URL pattern has to be formatted according to https://support.google.com/chrome/a?p=url_blocklist_filter_format. Enables managed extensions to use the Enterprise Hardware Platform API Setting the policy to True lets extensions installed by enterprise policy use the Enterprise Hardware Platform API. Setting the policy to False or leaving it unset prevents extensions from using this API. Note: This policy also applies to component extensions, such as the Hangout Services extension. Allow managed extensions to use the Enterprise Hardware Platform API Do not allow managed extensions to use the Enterprise Hardware Platform API True False Explicitly allowed network ports There is a list of restricted ports built into Google Chrome. Connections to these ports will fail. This setting permits bypassing that list. The value is a comma-separated list of zero or more ports that outgoing connections will be permitted on. Ports are restricted to prevent Google Chrome being used as a vector to exploit various network vulnerabilities. Setting this policy may expose your network to attacks. This policy is intended as a temporary workaround for errors with code \"ERR_UNSAFE_PORT\" while migrating a service running on a blocked port to a standard port (ie. port 80 or 443). Malicious websites can easily detect that this policy is set, and for what ports, and use that information to target attacks. Each port here is labelled with a date that it can be unblocked until. After that date the port will be restricted regardless of this setting. Leaving the value empty or unset means that all restricted ports will be blocked. If there is a mixture of valid and invalid values, the valid ones will be applied. This policy overrides the \"--explicitly-allowed-ports\" command-line option. Configure allowed app/extension types Setting the policy controls which apps and extensions may be installed in Google Chrome, which hosts they can interact with, and limits runtime access. Leaving the policy unset results in no restrictions on the acceptable extension and app types. Extensions and apps which have a type that\'s not on the list won\'t be installed. Each value should be one of these strings: * \"extension\" * \"theme\" * \"user_script\" * \"hosted_app\" * \"legacy_packaged_app\" * \"platform_app\" See the Google Chrome extensions documentation for more information on these types. Versions earlier than 75 that use multiple comma separated extension IDs aren\'t supported and are skipped. The rest of the policy applies. Note: This policy also affects extensions and apps to be force-installed using ExtensionInstallForcelist. Note: This policy only applies to platforms that support extensions. Extension Theme User script Hosted app Legacy packaged app Platform app extension theme user_script hosted_app legacy_packaged_app platform_app Control the availability of developer mode on extensions page Control if users can turn on Developer Mode on chrome://extensions. If the policy is not set, users can turn on developer mode on extension page unless DeveloperToolsAvailability policy is set to DeveloperToolsDisallowed (2). If the policy is set to Allow (0), users can turn on developer mode on extensions page. If the policy is set to Disallow (1), users can not turn on developer mode on extensions page. If this policy is set, DeveloperToolsAvailability can no longer control extensions developer mode. Note: This policy only applies to platforms that support extensions. Allow the usage of developer mode on extensions page Do not allow the usage of developer mode on extensions page 0 1 Configure extension installation allow list Setting the policy specifies which extensions are not subject to the blocklist. A blocklist value of * means all extensions are blocked and users can only install extensions listed in the allow list. By default, all extensions are allowed. But, if you prohibited extensions by policy, use the list of allowed extensions to change that policy. Note: This policy only applies to platforms that support extensions. Configure extension installation blocklist Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if blocked, without a way for the user to enable them. Once an extension disabled due to the blocklist is removed from it, it will automatically get re-enabled. A blocklist value of \'*\' means all extensions are blocked by default. Extensions that are explicitly listed in the allowlist are allowed if they are signed (packed). All unpacked extensions are blocked. If this policy is left not set the user can install any extension in Google Chrome. Note: This policy only applies to platforms that support extensions. Configure the list of force-installed apps and extensions Setting the policy specifies a list of apps and extensions that install silently, without user interaction, and which users can\'t uninstall or turn off through the Google Chrome interface. Permissions are granted implicitly, including for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These 2 APIs aren\'t available to apps and extensions that aren\'t force-installed.) Although Google Chrome aims to prevent users from uninstalling these extensions, some operating systems make it impossible for Google Chrome to defend robustly against extensions being modified externally, so this prevention is best efforts. Leaving the policy unset means no apps or extensions are autoinstalled, and users can uninstall any app or extension in Google Chrome. This policy supersedes ExtensionInstallBlocklist policy. If a previously force-installed app or extension is removed from this list, Google Chrome automatically uninstalls it. The source code of any extension may be altered by users through developer tools, potentially rendering the extension dysfunctional. If this is a concern, set the DeveloperToolsDisabled policy. Each list item of the policy is a string that contains an extension ID and, optionally, an update URL separated by a semicolon (;). The extension ID is the 32-letter string found, for example, on chrome://extensions when in Developer mode. If specified, the update URL should point to an Update Manifest XML document ( https://developer.chrome.com/extensions/autoupdate ). The update URL should use one of the following schemes: http, https or file. By default, the Chrome Web Store\'s update URL is used. The update URL set in this policy is only used for the initial installation; subsequent updates of the extension use the update URL in the extension\'s manifest. The update url for subsequent updates can be overridden using the ExtensionSettings policy, see http://support.google.com/chrome/a?p=Configure_ExtensionSettings_policy. On Microsoft® Windows® instances, apps and extensions from outside the Chrome Web Store can only be forced installed if the instance is joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS instances, apps and extensions from outside the Chrome Web Store can only be force installed if the instance is managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Note: This policy doesn\'t apply to Incognito mode. Read about hosting extensions ( https://developer.chrome.com/extensions/hosting ). Note: This policy only applies to platforms that support extensions. Configure extension, app, and user script install sources Setting the policy specifies which URLs may install extensions, apps, and themes. Before Google Chrome 21, users could click on a link to a *.crx file, and Google Chrome would offer to install the file after a few warnings. Afterwards, such files must be downloaded and dragged to the Google Chrome settings page. This setting allows specific URLs to have the old, easier installation flow. Each item in this list is an extension-style match pattern (see https://developer.chrome.com/extensions/match_patterns). Users can easily install items from any URL that matches an item in this list. Both the location of the *.crx file and the page where the download is started from (the referrer) must be allowed by these patterns. ExtensionInstallBlocklist takes precedence over this policy. That is, an extension on the blocklist won\'t be installed, even if it happens from a site on this list. Note: This policy only applies to platforms that support extensions. Extension management settings Setting the policy controls extension management settings for Google Chrome, including any controlled by existing extension-related policies. This policy maps an extension ID or an update URL to its specific setting only. A default configuration can be set for the special ID \"*\", which applies to all extensions without a custom configuration in this policy. This policy can override per-extension config from legacy policies. Note that any per-ID extension setting from either ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionInstallBlocklist, or ExtensionSettings will only inherit \'installation_mode\' and \'update_url\' from the \"*\" defaults. It will not inherit any other properties. With an update URL, configuration applies to extensions with the exact update URL stated in the extension manifest ( http://support.google.com/chrome/a?p=Configure_ExtensionSettings_policy ). If the \'override_update_url\' flag is set to true, the extension is installed and updated using the \"update\" URL specified in the ExtensionInstallForcelist policy or in \'update_url\' field in this policy. The flag \'override_update_url\' is ignored if the \'update_url\' is a Chrome Web Store url. On Microsoft® Windows® instances, apps and extensions from outside the Chrome Web Store can only be forced installed if the instance is joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS instances, apps and extensions from outside the Chrome Web Store can only be force installed if the instance is managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Note: This policy only applies to platforms that support extensions. Specifies whether in-product Google Chrome surveys are shown to users. Google Chrome in-product surveys collect user feedback for the browser. Survey responses are not associated with user accounts. When this policy is Enabled or not set, in-product surveys may be shown to users. When this policy is Disabled, in-product surveys are not shown to users. This policy has no effect if MetricsReportingEnabled is set to Disabled, which disables in-product surveys as well. Enable in-product surveys Disable in-product surveys True False Settings for Chrome Finds Chrome Finds is an AI-based feature that helps users search for and understand content on the current web page. 0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below. 1 = Allow the feature to be used, but does not allow Google to improve models using users\' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by Google Admin console and for Education accounts managed by Google Workspace. 2 = Do not allow the feature. If the policy is unset, its behavior is determined by the GenAiDefaultSettings policy. For more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings. Allow Chrome Finds and improve AI models. Allow Chrome Finds without improving AI models. Do not allow Chrome Finds. 0 1 2 Force Google SafeSearch Setting the policy to Enabled means SafeSearch in Google Search is always active, and users can\'t change this setting. Setting the policy to Disabled or leaving it unset means SafeSearch in Google Search is not enforced. Force the use of SafeSearch in Google Search Do not enforce the use of SafeSearch in Google Search True False Controls whether unload event handlers can be disabled. unload event handlers are being deprecated. Whether they fire depends on the unload Permissions-Policy. Currently, they are allowed by policy by default. In the future they will gradually move to being disallowed by default and sites must explicitly enable them using Permissions-Policy headers. This enterprise policy can be used to opt out of this gradual deprecation by forcing the default to remain as enabled. Pages may depend on unload event handlers to save data or signal the end of a user session to the server. This is not recommended as it is unreliable and impacts performance by blocking use of BackForwardCache. Recommended alternatives exist, however the unload event has been used for a long time. Some applications may still rely on them. If this policy is set to false or not set, then unload events handlers will be gradually deprecated in-line with the deprecation rollout and sites which do not set Permissions-Policy header will stop firing `unload` events. If this policy is set to true then unload event handlers will continue to work by default. NOTE: This policy had an incorrectly documented default of `true` in M117. The unload event did and will not change in M117, so this policy has no effect in that version. Force unload event handlers to remain enabled by default during deprecation Allow unload event handlers to be disabled by default during deprecation True False Force minimum YouTube Restricted Mode Setting the policy enforces a minimum Restricted mode on YouTube and prevents users from picking a less restricted mode. If you set it to: * Strict, Strict Restricted mode on YouTube is always active. * Moderate, the user may only pick Moderate Restricted mode and Strict Restricted mode on YouTube, but can\'t turn off Restricted mode. * Off or if no value is set, Restricted mode on YouTube isn\'t enforced by Chrome. External policies such as YouTube policies might still enforce Restricted mode. Do not enforce Restricted Mode on YouTube Enforce at least Moderate Restricted Mode on YouTube Enforce Strict Restricted Mode for YouTube 0 1 2 Allow Gemini app integrations to directly act on specified sites Allows to set a list of URL patterns that specify on which sites Gemini app integrations can directly act on web pages. URLs matching neither the allowlist or the blocklist use GeminiActOnWebSettings. URLs matching both the allowlist and the blocklist are allowed. For detailed information on valid url patterns, please see https://support.google.com/chrome/a?p=url_blocklist_filter_format. Block Gemini app integrations to directly act on specified sites Allows to set a list of URL patterns that specify on which sites Gemini app integrations cannot directly act on web pages. URLs matching neither the allowlist or the blocklist use GeminiActOnWebSettings. URLs matching both the allowlist and the blocklist are allowed. For detailed information on valid url patterns, please see https://support.google.com/chrome/a?p=url_blocklist_filter_format. Allows Gemini app integrations to directly act on web pages Controls if the Gemini app is allowed to take action on the web pages on behalf of the user. 0/unset = Gemini app is allowed to take action on the web pages. 1 = Gemini app is not allowed to take action on the web pages. This policy has no effect when the Gemini app is disabled. For example, the Gemini app can be disabled by GeminiSettings policy. For more information on Gemini in Chrome, please see https://support.google.com/chrome/a/answer/16291696. Gemini\'s actuation is not available in all countries or all languages. Setting this policy does not guarantee the feature will be enabled; it remains subject to availability. For more info on the roll-out, check the Enterprise Release Notes: https://support.google.com/chrome/a/answer/7679408?hl=en Allow the Gemini app to take action on the web pages. Disallow the Gemini app to take action on the web pages. 0 1 Settings for Gemini integration This setting allows Gemini app integrations. 0 = Gemini integration will be available for users. 1 = Gemini integration will not be available for users. If the policy is unset, its behavior is determined by the GenAiDefaultSettings policy. For more information, please check the Help Center article https://support.google.com/chrome/a?p=gemini_in_chrome. Allow Gemini integrations. Do not allow Gemini integrations. 0 1 Settings for GenAI local foundational model Configure how Google Chrome downloads the foundational GenAI model and uses for inference locally. When the policy is set to Allowed (0) or not set, the model is downloaded automatically, and used for inference. When the policy is set to Disabled (1), the model will not be downloaded, and the existing model (if already downloaded) will be deleted. On desktop platforms, model downloading can also be disabled by setting ComponentUpdatesEnabled to false. Downloads model automatically Do not download model 0 1 Block geolocation on these sites Setting the policy lets you set a list of URL patterns that specify sites that are not allowed to access the user\'s geolocation, and are also prevented from requesting user permission to do so. Leaving the policy unset means DefaultGeolocationSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Enable globally scoped HTTP auth cache This policy configures a single global per profile cache with HTTP server authentication credentials. If this policy is unset or disabled, the browser will use the default behavior of cross-site auth, this behavior will be to scope HTTP server authentication credentials by top-level site, so if two sites use resources from the same authenticating domain, credentials will need to be provided independently in the context of both sites. Cached proxy credentials will be reused across sites. If the policy is enabled, HTTP auth credentials entered in the context of one site will automatically be used in the context of another. Enabling this policy leaves sites open to some types of cross-site attacks, and allows users to be tracked across sites even without cookies by adding entries to the HTTP auth cache using credentials embedded in URLs. This policy is intended to give enterprises depending on the legacy behavior a chance to update their login procedures, and will be removed in the future. Enable globally scoped HTTP authentication cache Disable globally scoped HTTP authentication cache True False List of names that will bypass the HSTS policy check Setting the policy specifies a list of hostnames that bypass preloaded HSTS upgrades from http to https. Only single-label hostnames are allowed in this policy, and this policy only applies to \"static\" HSTS-preloaded entries (for instance, \"app\", \"new\", \"search\", \"play\"). This policy does not prevent HSTS upgrades for servers that have \"dynamically\" requested HSTS upgrades using a Strict-Transport-Security response header. Supplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase. This policy only applies to the specific single-label hostnames specified, not to subdomains of those names. Use the Happy Eyeballs V3 algorithm This feature enables the Happy Eyeballs V3 algorithm to make connection attempts. See https://datatracker.ietf.org/doc/draft-pauly-happy-happyeyeballs-v3 for details. Setting the policy to Enabled means Google Chrome will use the Happy Eyeballs V3 algorithm for connection attempts. Setting the policy to Disabled turns off the Happy Eyeballs V3 algorithm. Not setting the policy, Google Chrome will turn on or off the Happy Eyeballs V3 algorithm based on chrome://flags/#happy-eyeballs-v3. This policy supports dynamic refresh. This policy is a temporary measure and will be removed in future versions of Google Chrome. Using the Happy Eyeballs V3 algorithm. Do not use the Happy Eyeballs V3 algorithm. Allow Google Chrome to decide True False None Show a view of Chrome history with groups of pages This policy controls the visibility of the Chrome history page organized into groups of pages. If the policy is set to Enabled, a Chrome history page organized into groups will be visible at chrome://history/grouped. If the policy is set to Disabled, a Chrome history page organized into groups will not be visible at chrome://history/grouped. If the policy is left unset, a Chrome history page organized into groups will be visible at chrome://history/grouped by default. Please note, if ComponentUpdatesEnabled policy is set to Disabled, but HistoryClustersVisible is set to Enabled or unset, a Chrome history page organized into groups will still be available at chrome://history/grouped, but may be less relevant to the user. Chrome history page organized into groups will be visible at chrome://history/grouped. Chrome history page organized into groups will not be visible at chrome://history/grouped. Chrome history page organized into groups will be visible at chrome://history/grouped by default. True False None Use New Tab Page as homepage Setting the policy to Enabled makes the New Tab page the user\'s homepage, ignoring any homepage URL location. Setting the policy to Disabled means that their homepage is never the New Tab page, unless the user\'s homepage URL is set to chrome://newtab. If you set the policy, users can\'t change their homepage type in Google Chrome. If not set, the user decides whether or not the New Tab page is their homepage. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Use New Tab Page as homepage Do not use New Tab Page as homepage Allow users to choose True False None Configure the home page URL Setting the policy sets the default homepage URL in Google Chrome. You open the homepage using the Home button. On desktop, the RestoreOnStartup policies control the pages that open on startup. If the homepage is set to the New Tab Page, by the user or HomepageIsNewTabPage, this policy has no effect. The URL needs a standard scheme, such as http://example.com or https://example.com. When this policy is set, users can\'t change their homepage URL in Google Chrome. Leaving both HomepageLocation and HomepageIsNewTabPage unset lets users choose their homepage. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. HTTP Allowlist Setting the policy specifies a list of hostnames or hostname patterns (such as \'[*.]example.com\') that will not be upgraded to HTTPS and will not show an error interstitial if HTTPS-First Mode is enabled. Organizations can use this policy to maintain access to servers that do not support HTTPS, without needing to disable HTTPS Upgrades and/or HTTPS-First Mode. Supplied hostnames must be canonicalized: Any IDNs must be converted to their A-label format, and all ASCII letters must be lowercase. Blanket host wildcards (i.e., \"*\" or \"[*]\") are not allowed. Instead, HTTPS-First Mode and HTTPS Upgrades should be explicitly disabled via their specific policies. Note: This policy does not apply to HSTS upgrades. Allow HTTPS-Only Mode to be enabled This policy controls whether users can enable HTTPS-Only Mode (Always Use Secure Connections) in Settings. HTTPS-Only Mode upgrades all navigations to HTTPS. If this setting is not set or set to \"allowed\", users will be allowed to enable HTTPS-Only Mode. If this setting is set to \"disallowed\", HTTPS-Only Mode will be disabled. If this setting is set to \"force_enabled\", HTTPS-Only Mode will be enabled in Strict mode. If this setting is set to \"force_balanced_enabled\", HTTPS-Only Mode will be enabled in Balanced mode. \"force_enabled\" is supported from M112 onwards, \"force_balanced_enabled\" is supported from M129 onwards. \"force_enabled\" and \"force_balanced_enabled\" can be recommended to users too. HTTPS-Only Mode will be set Strict or Balanced initially but users are allowed to change it. If you set this policy to a value that is not supported by the version of Chrome that receives the policy, Chrome will default to the allowed setting. The separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature. Do not restrict users\' HTTPS-Only Mode setting Disable HTTPS-Only Mode Enable HTTPS-Only Mode in Strict mode Enable HTTPS-Only Mode in Balanced Mode allowed disallowed force_enabled force_balanced_enabled Enable automatic HTTPS upgrades Google Chrome attempts to upgrade some navigations from HTTP to HTTPS, when possible. This policy can be used to disable this behavior. If set to \"true\" or left unset, this feature will be enabled by default. The separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature. See also the HttpsOnlyMode policy. HTTPS Upgrades may be applied depending on feature launch status. Disable HTTPS Upgrades. HTTPS Upgrades may be applied depending on feature launch status. True False None Enable IPv6 reachability check override Setting the policy to true overrides the IPv6 reachability check. This means that the system will always query AAAA records when resolving host names. It applies to all users and interfaces on the device. Setting the policy to false or leaving it unset does not overrides the IPv6 reachability check. The system only queries AAAA records when it is reachable to a global IPv6 host. Override the IPv6 reachability check. Always query AAAA record for host name resolution. Do not override the IPv6 reachability check. Only query AAAA record for host name resolution when the device is reachable to a global IPv6 host. True False Allow idle detection on these sites Allows you to set a list of URL patterns that specify the sites that are allowed to use the Idle Detection API witout asking the user. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. If this policy is not set, the global default value will be used for all sites, which is configured by the DefaultIdleDetectionSetting (Default idle detection setting) policy, if set, or by the user\'s personal configuration otherwise. Block idle detection on these sites Allows you to set a list of URL patterns that specify the sites that are not allowed to use the Idle Detection API. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. If this policy is not set, the global default value will be used for all sites, which is configured by the DefaultIdleDetectionSetting (Default idle detection setting) policy, if set, or by the user\'s personal configuration otherwise. Incognito mode availability Specifies whether the user may open pages in Incognito mode in Google Chrome. If \'Enabled\' is selected or the policy is left unset, pages may be opened in Incognito mode. If \'Disabled\' is selected, pages may not be opened in Incognito mode. If \'Forced\' is selected, pages may be opened ONLY in Incognito mode. Note that \'Forced\' does not work for Android-on-Chrome The IncognitoModeUrlAllowlist policy takes precedence over this policy and can re-enable Incognito mode for specific URLs. When Incognito mode is disabled by this policy when an allowlist is provided, Incognito mode is available only for URLs matching the allowlist, while all other pages are blocked. Note: On iOS, if the policy is changed during a session, it will only take effect on relaunch. Incognito mode available Incognito mode disabled 0 1 Allow access to a list of URLs in Incognito mode. Setting the policy provides access to the listed URLs in Incognito mode. Use it to open exceptions to certain URL patterns defined in IncognitoModeUrlBlocklist, using the format specified at ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). If both this policy and IncognitoModeUrlBlocklist are set, the allowlist takes precedence. If a URL matches a pattern on the allowlist, it will be allowed. If it matches a pattern on the blocklist (but not the allowlist), it will be blocked. If a URL matches neither, the general URLBlocklist/URLAllowlist policies will be used as a fallback. If this policy is set and IncognitoModeUrlBlocklist is not, any URL not on the allowlist will be blocked in Incognito mode. If IncognitoModeAvailability is set to disallow (value 1), but this policy is configured, Incognito mode will be available only for the URLs matching the allowlist. Leaving the policy unset allows no exceptions to IncognitoModeUrlBlocklist and IncognitoModeAvailability. This policy only affects Incognito mode. To allow URLs for all user profiles, please use the URLAllowlist policy. Blanket host wildcards (i.e., \"*\" or \"[*]\") are not allowed; use the IncognitoModeAvailability policy to enable the feature globally. This policy is limited to 1000 entries. Block access to a list of URLs in Incognito mode. Setting the IncognitoModeUrlBlocklist policy stops web pages with prohibited URLs from loading in Incognito mode. Administrators can specify the list of URL patterns to be blocked. See how to format a URL pattern ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). If both this and the IncognitoModeUrlAllowlist are set, the allowlist takes precedence. If a URL matches a pattern on the allowlist, it will be allowed. If it matches a pattern on the blocklist but not the allowlist, it will be blocked. If a URL matches neither, the general URLBlocklist/URLAllowlist policies will be used as a fallback. If the IncognitoModeUrlAllowlist policy is set and this policy is not, any URL not on the allowlist will be blocked in Incognito mode. If IncognitoModeAvailability is set to disallow (value 1), but the IncognitoModeUrlAllowlist policy is configured, Incognito mode will be available only for the URLs matching the allowlist. This policy only affects Incognito mode. To block URLs for all user profiles, please use the URLBlocklist policy. This policy is limited to 1000 entries. Control the IntensiveWakeUpThrottling feature. When enabled the IntensiveWakeUpThrottling feature causes JavaScript timers in background tabs to be aggressively throttled and coalesced, running no more than once per minute after a page has been backgrounded for 5 minutes or more. This is a web standards compliant feature, but it may break functionality on some websites by causing certain actions to be delayed by up to a minute. However, it results in significant CPU and battery savings when enabled. See https://bit.ly/30b1XR4 for more details. If this policy is set to enabled then the feature will be force enabled, and users will not be able to override this. If this policy is set to disabled then the feature will be force disabled, and users will not be able to override this. If this policy is left unset then the feature will be controlled by its own internal logic, which can be manually configured by users. Note that the policy is applied per renderer process, with the most recent value of the policy setting in force when a renderer process starts. A full restart is required to ensure that all loaded tabs receive a consistent policy setting. It is harmless for processes to be running with different values of this policy. Force throttling of background JavaScript timers Force no throttling of background JavaScript timers Allow throttling of background JavaScript timers to be controlled by Chrome logic and configured by users True False None Allow JavaScript on these sites Setting the policy lets you set a list of URL patterns that specify the sites that can run JavaScript. Leaving the policy unset means DefaultJavaScriptSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Block JavaScript on these sites Setting the policy lets you set a list of URL patterns that specify the sites that can\'t run JavaScript. Leaving the policy unset means DefaultJavaScriptSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Note that this policy blocks JavaScript based on whether the origin of the top-level document (usually the page URL that is also displayed in the address bar) matches any of the patterns. Therefore this policy is not appropriate for mitigating web supply-chain attacks. For example, supplying the pattern \"https://[*.]foo.com/\" will not prevent a page hosted on, say, https://example.com from running a script loaded from https://www.foo.com/example.js. Furthermore, supplying the pattern \"https://example.com/\" will not prevent a document from https://example.com from running scripts if it is not the top-level document, but embedded as a sub-frame into a page hosted on another origin, say, https://www.bar.com. Allow JavaScript to use JIT on these sites Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. JavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT enabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled. If this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise Javascript JIT is enabled for the site. Block JavaScript from using JIT on these sites Allows you to set a list of site url patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled. Disabling the JavaScript JIT will mean that Google Chrome may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Google Chrome to render web content in a more secure configuration. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. JavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitBlockedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT disabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled. If this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise JavaScript JIT is enabled for the site. Allow JavaScript optimization on these sites Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are enabled. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. JavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript optimizations enabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value. If this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise Javascript optimization is enabled for the site. Block JavaScript optimizations on these sites Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are disabled. Disabling JavaScript optimizations will mean that Google Chrome may render web content more slowly. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. JavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerBlockedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript optimizations disabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value. If this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise JavaScript optimization is enabled for the site. Enable read aloud (text distillation and text-to-speech synthesis) for web pages Setting the policy to be true allows users to have eligible web pages read aloud using text-to-speech. This is achieved by server side content distillation and audio synthesis. Setting to false disables this feature. If this policy is set to default or unset, read aloud is enabled. Always allow read aloud Never allow read aloud True False Allow sites to make network requests to local devices and local network endpoints. List of URL patterns. Network requests initiated from websites served by matching origins are not subject to Local Network Access checks. For origins not covered by the patterns specified here, the user\'s personal configuration will apply. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns/. See https://wicg.github.io/local-network-access/ for Local Network Access restrictions. There are multiple policies listing origins that impact requests to local device and local network endpoints. If an origin is matched by more than one of the following policies, the policies take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - LoopbackNetworkBlockedForUrls - LoopbackNetworkAllowedForUrls - LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls Block sites from making network requests to local devices and local network endpoints. List of URL patterns. Network requests initiated from websites served by matching origins are blocked from issuing Local Network Access requests. For origins not covered by the patterns specified here, the user\'s personal configuration will apply. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns/. See https://wicg.github.io/local-network-access/ for Local Network Access restrictions. There are multiple policies listing origins that impact requests to local device and local network endpoints. If an origin is matched by more than one of the following policies, the policies take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - LoopbackNetworkBlockedForUrls - LoopbackNetworkAllowedForUrls - LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls Override IP address space mappings This can be used to treat certain internal address ranges as \"public\" and thus not subject to Local Network Access checks. Conversely, this can be used to treat certain public address ranges that might be used internally as \"local\" so that they are protected by Local Network Access checks. IP address space overrides have two forms: [cidr]=[public|local|loopback] where [cidr] is a IP address range in CIDR notation (see section 3.1 of https://tools.ietf.org/html/rfc4632 for IPv4 and section 2.3 of https://tools.ietf.org/html/rfc4291 for IPv6). IPv6 addresses must be specified in URL-safe (bracketed) format. CIDR overrides apply to all ports. or [ip-address]:[port]=[public|local|loopback] For more information on Local Network Access, see https://wicg.github.io/local-network-access/ and https://developer.chrome.com/blog/local-network-access. This policy does not support dynamic refresh. Overrides from the command-line switch --ip-address-space-overrides take precedence over overrides set by this policy. Allow Local Network Access (LNA) requests in subframes without explicit delegation By default, the permissions for Local Network Access (LNA) are only allowed to be requested in cross-origin subframes if they are explicitly delegated. This policy can be used to override this default behavior so that LNA permissions are default inherited into subframes, unless explicitly denied in permissions policy. If this policy is set to enabled, then subframes are by default delegated all LNA permissions policy features and can make local network requests (triggering the permission prompt). If this policy is set to disabled or not set, then subframes must be explicitly delegated the permissions policy feature in order make local network requests and trigger the permission prompt. This policy applies to the permissions policy features \"local-network-access\", \"loopback-network\", and \"local-network\". For more information on Local Network Access, see https://wicg.github.io/local-network-access/ and https://developer.chrome.com/blog/local-network-access. For more information on permissions policy, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Permissions_Policy. Allow LNA requests in subframes without explicit delegation Do not allow LNA requests in subframes without explicit delegation True False Specifies whether to (temporarily) opt out of Local Network Access restrictions When this policy is set to Enabled, Local Network Access requests will only display warnings in Chrome DevTools due to Local Network Access checks failing. When this policy is set to Disabled or unset, Local Network Access requests will use the default handling of these requests. See https://wicg.github.io/local-network-access/ for Local Network Access restrictions. This enterprise policy is temporary, and will be removed after M163. Long term, the policy LocalNetworkAccessAllowedForUrls can be used to allowlist URL patterns that should be automatically granted the Local Network Access permission. Temporarily opt out of restrictions on requests to local network endpoints Use default behavior when determining if websites can make requests to local network endpoints True False Allow sites to make network requests to local network endpoints. List of URL patterns. Network requests initiated from websites served by matching origins to local network endpoints are not subject to Local Network Access checks. For origins not covered by the patterns specified here, the user\'s personal configuration will apply. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns/. See https://wicg.github.io/local-network-access/ for Local Network Access restrictions. There are multiple policies listing origins that impact requests to local network endpoints. If an origin is matched by more than one of the following policies, the policies take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls Block sites from making network requests to local network endpoints. List of URL patterns. Network requests initiated from websites served by matching origins to local network endpoints are blocked from issuing Local Network Access requests. For origins not covered by the patterns specified here, the user\'s personal configuration will apply. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns/. See https://wicg.github.io/local-network-access/ for Local Network Access restrictions. There are multiple policies listing origins that impact requests to local network endpoints. If an origin is matched by more than one of the following policies, the policies take precedence in the following order: - LocalNetworkBlockedForUrls - LocalNetworkAllowedForUrls - LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls Suppress lookalike domain warnings on domains This policy prevents the display of lookalike URL warnings on the sites listed. These warnings are typically shown on sites that Google Chrome believes might be trying to spoof another site the user is familiar with. If the policy is enabled and set to one or more domains, no lookalike warnings pages will be shown when the user visits pages on that domain. If the policy is not set, or set to an empty list, warnings may appear on any site the user visits. A hostname can be allowed with a complete host match, or any domain match. For example, a URL like \"https://foo.example.com/bar\" may have warnings suppressed if this list includes either \"foo.example.com\" or \"example.com\". Allow sites to make network requests to the local device. List of URL patterns. Network requests initiated from websites served by matching origins to the local device are not subject to Local Network Access checks. For origins not covered by the patterns specified here, the user\'s personal configuration will apply. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns/. See https://wicg.github.io/local-network-access/ for Local Network Access restrictions. There are multiple policies listing origins that impact requests to the local device. If an origin is matched by more than one of the following policies, the policies take precedence in the following order: - LoopbackNetworkBlockedForUrls - LoopbackNetworkAllowedForUrls - LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls Block sites from making network requests to the local device. List of URL patterns. Network requests initiated from websites served by matching origins to the local device are blocked from issuing Local Network Access requests. For origins not covered by the patterns specified here, the user\'s personal configuration will apply. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns/. See https://wicg.github.io/local-network-access/ for Local Network Access restrictions. There are multiple policies listing origins that impact requests to the local device. If an origin is matched by more than one of the following policies, the policies take precedence in the following order: - LoopbackNetworkBlockedForUrls - LoopbackNetworkAllowedForUrls - LocalNetworkAccessBlockedForUrls - LocalNetworkAccessAllowedForUrls Managed Bookmarks Setting the policy sets up a list of bookmarks where each one is a dictionary with the keys \"name\" and \"url\". These keys hold the bookmark\'s name and target. Admins can set up a subfolder by defining a bookmark without a \"url\" key, but with an additional \"children\" key. This key also has a list of bookmarks, some of which can also be folders. Chrome amends incomplete URLs as if they were submitted through the address bar. For example, \"google.com\" becomes \"https://google.com/\". Users can\'t change the folders the bookmarks are placed in (though they can hide it from the bookmark bar). The default folder name for managed bookmarks is \"Managed bookmarks\" but it can be changed by adding a new sub-dictionary to the policy with a single key named \"toplevel_name\" with the desired folder name as its value. Managed bookmarks are not synced to the user account and extensions can\'t modify them. Maximal number of concurrent connections per proxy server for non-WebSocket requests Setting the policy specifies the maximal number of simultaneous connections per proxy server for non-WebSocket requests. To modify WebSocket request limits, see MaxConnectionsPerProxyForWebSocket. Leaving the policy unset means a default of 128 is used. Some web apps are known to consume many connections with hanging GETs, so setting a value below 128 may lead to browser networking hangs if there are too many web apps with hanging connections open. Some proxy servers can\'t handle a high number of concurrent connections per client, which is solved by setting this policy to a lower value. The value should be equal to or higher than 6. Setting a value below that limit will cause 6 to be used. Lower below the default (128) at your own risk. The value should be equal to or lower than 256 (99 in Google Chrome 147 and earlier). Setting a value above that limit will cause 256 (99 in Google Chrome 147 and earlier) to be used. Raise above the default (128) at your own risk. Please note that the enforced limits are impacted by AllowSocketPoolSizeRandomizationForProxies. Maximal number of concurrent connections per proxy server for WebSocket requests Setting the policy specifies the maximal number of simultaneous connections per proxy server for WebSocket requests. To modify non-WebSocket request limits, see MaxConnectionsPerProxy. Leaving the policy unset means a default of 128 is used. Some web apps are known to consume many connections with hanging GETs, so setting a value below 128 may lead to browser networking hangs if there are too many web apps with hanging connections open. Some proxy servers can\'t handle a high number of concurrent connections per client, which is solved by setting this policy to a lower value. The value should be equal to or higher than 6. Setting a value below that limit will cause 6 to be used. Lower below the default (128) at your own risk. The value should be equal to or lower than 256. Setting a value above that limit will cause 256 to be used. Raise above the default (128) at your own risk. Please note that the enforced limits are impacted by AllowSocketPoolSizeRandomizationForProxies. Enable reporting of usage and crash-related data When this policy is Enabled, anonymous reporting of usage and crash-related data about Google Chrome to Google is recommended to be enabled by default. Users will still be able to change this setting. When this policy is Disabled, anonymous reporting is disabled and no usage or crash data is sent to Google. Users won\'t be able to change this setting. When this policy is not set, users can choose the anonymous reporting behavior at installation or first run, and can change this setting later. (For Google ChromeOS, see DeviceMetricsReportingEnabled.) On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Enable reporting of usage and crash-related data Disable reporting of usage and crash-related data Allow users to choose True False None Show content suggestions on the New Tab page Setting the policy to True or leaving it unset displays autogenerated content suggestions on the New Tab page, based on the user\'s browsing history, interests, or location. Setting the policy to False prevents autogenerated content suggestions from appearing on the New Tab page. Show content suggestions on the New Tab page Do not show content suggestions on the New Tab page True False Allow users to customize the background on the New Tab page If the policy is set to false, the New Tab page won\'t allow users to customize the background. Any existing custom background will be permanently removed even if the policy is set to true later. If the policy is set to true or unset, users can customize the background on the New Tab page. Note: On Android, the policy is applied to browser only after restart. Users can customize the New Tab page background Users can not customize the New Tab page background True False Enable network prediction This policy controls network prediction in Google Chrome. It controls DNS prefetching, TCP, and SSL preconnection and prerendering of webpages. If you set the policy, users can\'t change it. Leaving it unset turns on network prediction, but the user can change it. Predict network actions on any network connection Predict network actions on any network that is not cellular. (Deprecated in 50, removed in 52. After 52, if value 1 is set, it will be treated as 0 - predict network actions on any network connection.) Do not predict network actions on any network connection 0 1 2 Allow notifications on these sites Setting the policy lets you set a list of URL patterns that specify the sites that can display notifications. Leaving the policy unset means DefaultNotificationsSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Block notifications on these sites Setting the policy lets you set a list of URL patterns that specify the sites that can\'t display notifications. Leaving the policy unset means DefaultNotificationsSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Enable NTLMv2 authentication. Setting the policy to Enabled or leaving it unset turns NTLMv2 on. Setting the policy to Disabled turns NTLMv2 off. All recent versions of Samba and Microsoft® Windows® servers support NTLMv2. This should only be turned off for backward compatibility as it reduces the security of authentication. Turn NTLMv2 on Turn NTLMv2 off True False Enable system DNS resolution outside of the network service Setting this policy to true causes system DNS resolution (getaddrinfo()) to possibly run outside of the network process, depending on system configuration and feature flags. Setting this policy to false causes system DNS resolution (getaddrinfo()) to run in the network process rather than the browser process. This may force the network service sandbox to be disabled, degrading the security of Google Chrome. If this policy is not set, system DNS resolution may run in the network service, outside of the network service, or partially inside and partially outside, depending on system configuration and feature flags. System DNS resolution may be run in or out of the network process depending on system configuration and feature flags. System DNS resolution will be run in the network process. System DNS resolution may be run in or out of the network process, or partially in and partially out of the network process, depending on system configuration and feature flags. True False None Origins or hostname patterns for which restrictions on insecure origins should not apply Setting the policy specifies a list of origins (URLs) or hostname patterns (such as *.example.com) for which security restrictions on insecure origins won\'t apply. Patterns are only accepted for hostnames; URLs/origins with schemes must be exact strings. Organizations can specify origins for legacy applications that can\'t deploy TLS or set up a staging server for internal web development, so developers can test out features requiring secure contexts without having to deploy TLS on the staging server. This policy also prevents the origin from being labeled \"Not Secure\" in the address bar. Setting a list of URLs in this policy amounts to setting the command-line flag --unsafely-treat-insecure-origin-as-secure to a comma-separated list of the same URLs. The policy overrides the command-line flag and UnsafelyTreatInsecureOriginAsSecure, if present. For more information on secure contexts, see Secure Contexts ( https://www.w3.org/TR/secure-contexts ). Choose whether Blob URLs are partitioned during fetching and navigations This policy controls whether Blob URLs are partitioned during fetching and navigation. If this policy is set to Enabled or not set, Blob URLs will be partitioned. If this policy is set to Disabled, Blob URLs won\'t be partitioned. If you must use the policy, please file a bug at Google Chrome explaining your use case. The policy is scheduled to be offered through Google Chrome version 146, after which the old implementation will be removed. NOTE: Only newly-started renderer processes will reflect changes to this policy while the browser is running. For detailed information on third-party storage partitioning, please see https://developers.google.com/privacy-sandbox/cookies/storage-partitioning. Partition Blob URLs during fetching and navigation. Do not partition Blob URLs during fetching and navigation. True False Enable leak detection for entered credentials Setting the policy to Enabled lets users have Google Chrome check whether usernames and passwords entered were part of a leak. Setting the policy to Disabled does not let users have this functionality. If the policy is set, users can\'t change it in Google Chrome. If not set, credential leak checking is allowed, but the user can turn it off. Enable password leak detection Disable password leak detection Allow the user to decide True False None Enable saving passwords to the password manager This policy controls the browser\'s ability to automatically remember passwords on websites and save them in the built-in password manager. It does not limit access or change the contents of passwords saved in the password manager and possibly synchronized to the Google account profile and Android. Setting the policy to Enabled means users have Google Chrome remember passwords and provide them the next time they sign in to a site. Setting the policy to Disabled means users can\'t save new passwords, but previously saved passwords will still work. If the policy is set, users can\'t change it in Google Chrome. If not set, the user can turn off password saving. Enable saving passwords using the password manager Disable saving passwords using the password manager True False Enable sharing user credentials with other users Setting the policy to Enabled lets users send to and receive from family members (according to Family Service) their passwords. When the policy is Enabled or not set, there is a button in the Password Manager allowing to send a password. The received passwords are stored into user\'s account and are available in the Password Manager. Setting the policy to Disabled means users can\'t send passwords from Password Manager to other users, and can\'t receive passwords from other users. The feature is not available if synchronization of Passwords is turned off (either via user settings or SyncDisabled policy is Enabled). Managed accounts aren\'t eligible to join or create a family group and therefore cannot share passwords. Enable sharing user credentials Disable sharing user credentials True False Allow websites to query for available payment methods. Allows you to set whether websites are allowed to check if the user has payment methods saved. If this policy is set to disabled, websites that use PaymentRequest.canMakePayment or PaymentRequest.hasEnrolledInstrument API will be informed that no payment methods are available. If the setting is enabled or not set then websites are allowed to check if the user has payment methods saved. Allow websites to check if the user has payment methods saved Always tell websites that no payment methods are saved True False Enables the concept of policy atomic groups Setting the policy to Enabled means policies coming from an atomic group that don\'t share the source with the highest priority from that group get ignored. Setting the policy to Disabled means no policy is ignored because of its source. Policies are ignored only if there\'s a conflict, and the policy doesn\'t have the highest priority. If this policy is set from a cloud source, it can\'t target a specific user. Enable policy atomic groups Disable policy atomic groups True False Allow merging dictionary policies from different sources Setting the policy allows merging of selected policies when they come from different sources, with the same scopes and level. This merging is in the first level keys of the dictionary from each source. The key coming from the highest priority source takes precedence. Use the wildcard character \'*\' to allow merging of all supported dictionary policies. If a policy is in the list and there\'s conflict between sources with: * The same scopes and level: The values merge into a new policy dictionary. * Different scopes or level: The policy with the highest priority applies. If a policy isn\'t in the list and there\'s conflict between sources, scopes, or level, the policy with the highest priority applies. Managed user manual exception URLs Power management on the login screen Extension management settings Key Permissions Power management settings when the user becomes idle Screen brightness percent Screen lock delays ContentPackManualBehaviorURLs DeviceLoginScreenPowerManagement ExtensionSettings KeyPermissions PowerManagementIdleSettings ScreenBrightnessPercent ScreenLockDelays Allow merging list policies from different sources Setting the policy allows merging of selected policies when they come from different sources, with the same scopes and level. Use the wildcard character \'*\' to allow merging of all list policies. If a policy is in the list and there\'s conflict between sources with: * The same scopes and level: The values merge into a new policy list. * Different scopes or level: The policy with the highest priority applies. If a policy isn\'t in the list and there\'s conflict between sources, scopes, or level, the policy with the highest priority applies. Allow pop-ups on these sites Setting the policy lets you set a list of URL patterns that specify the sites that can open pop-ups. Leaving the policy unset means DefaultPopupsSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Block pop-ups on these sites Setting the policy lets you set a list of URL patterns that specify the sites that can\'t open pop-ups. Leaving the policy unset means DefaultPopupsSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Allow precise geolocation on these sites Setting the policy lets you set a list of URL patterns that specify sites that are allowed to access the user\'s high accuracy geolocation without first having to request the user\'s permission to do so. Leaving the policy unset means DefaultGeolocationSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Prefer specific encryption cipher algorithms for TLS This policy configures Google Chrome to order its preferred encryption ciphers in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime. Setting this policy does not guarantee that any specific algorithms will be negotiated. This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them. Setting the policy to \'cnsa\' configures Google Chrome to prefer ciphers required for compliance with the Commercial National Security Algorithm Suite versions 1.0 and 2.0 (CNSA 1.0 and 2.0). Not setting the policy, or setting it to \'default\', configures Google Chrome to use its default ciphers. Setting this policy is not required for security. The default cryptography used by Google Chrome is strong enough to withstand a brute force attack using the entire power of the Sun. Setting this policy will cause Google Chrome to be slower when accessing websites. This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS. Prefer ciphers satisfying the requirements of CNSA 1.0 and 2.0 Use Google Chrome\'s default cipher order cnsa default Prefer specific key exchange algorithms for TLS This policy configures Google Chrome to order its preferred key agreement algorithms (supported groups) in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime. Setting this policy does not guarantee that any specific algorithms will be negotiated. This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them. Setting the policy to \'cnsa2\' configures Google Chrome to prefer key exchange methods required for compliance with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). Not setting the policy, or setting it to \'default\', configures Google Chrome to use its default key exchange methods. Setting this policy is not required for security. The default cryptography used by Google Chrome is strong enough to withstand a brute force attack using the entire power of the Sun. Setting this policy will cause Google Chrome to be slower when accessing websites. This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS. Prefer key exchange methods satisfying the requirements of CNSA 2.0 Use Google Chrome\'s default supported groups cnsa2 default Allow SpeculationRules prefetch to ServiceWorker-controlled URLs SpeculationRules prefetch can be issued to URLs that are controlled by ServiceWorker. However, legacy code did not allow it and canceled the prefetch requests. This policy enables to control the behavior. Setting this policy to Enabled or not set allows SpeculationRules prefetch to ServiceWorker-controlled URLs (if the PrefetchServiceWorker feature flag is enabled). This is the current default behavior and is aligned with the specifications. Setting this policy to Disabled disallows SpeculationRules prefetch to ServiceWorker-controlled URLs. This is the legacy behavior. This policy is intended to be temporary and will be removed in the future. SpeculationRules prefetch can be sent to ServiceWorker-controlled URLs. SpeculationRules prefetch cannot be sent to ServiceWorker-controlled URLs (legacy behavior). True False Enable printing Setting the policy to Enabled or leaving it unset lets users print in Google Chrome, and users can\'t change this setting. Setting the policy to Disabled means users can\'t print from Google Chrome. Printing is off in the three dots menu, extensions, and JavaScript applications. Enable printing Disable printing True False Ask where to save each file before downloading Setting the policy to Enabled means users are asked where to save each file before downloading. Setting the policy to Disabled has downloads start immediately, and users aren\'t asked where to save the file. Leaving the policy unset lets users change this setting. Ask the user where to save the file before downloading Do not ask the user (downloads start immediately) Allow the user to decide True False None Allows web pages to use identifiers for the purpose of protected content playback If the policy is set to true or unset, the use of protected content identifiers is allowed, which can help enable higher quality of protected content playback. If the policy is set to false, protected content identifiers are not allowed to be used. Allow the use of protected content identifiers with sites, which can help enable higher quality of protected content playback. Disable the use of protected content identifiers with sites, which might lead to lower quality of protected content playback. True False Proxy settings Setting the policy configures the proxy settings for Chrome and ARC-apps, which ignore all proxy-related options specified from the command line. Leaving the policy unset lets users choose their proxy settings. Setting the ProxySettings policy accepts the following fields: * ProxyMode, which lets you specify the proxy server Chrome uses and prevents users from changing proxy settings * ProxyPacUrl, a URL to a proxy .pac file, or a PAC script encoded as a data URL with MIME type application/x-ns-proxy-autoconfig * ProxyPacMandatory, which prevents the network stack from falling back to direct connections with invalid or unavailable PAC script * ProxyServer, a URL of the proxy server * ProxyBypassList, a list of hosts for which the proxy will be bypassed The ProxyServerMode field is deprecated in favor of the ProxyMode field. For ProxyMode, if you choose the value: * direct, a proxy is never used and all other fields are ignored. * system, the systems\'s proxy is used and all other fields are ignored. * auto_detect, all other fields are ignored. * fixed_servers, the ProxyServer and ProxyBypassList fields are used. * pac_script, the ProxyPacUrl, ProxyPacMandatory and ProxyBypassList fields are used. Note: For more detailed examples, visit The Chromium Projects ( https://www.chromium.org/developers/design-documents/network-settings/#command-line-options-for-proxy-settings ). Enable QR Code Generator This policy enables the QR Code generator feature in Google Chrome. If you enable this policy or don\'t configure it, the QR Code Generator feature is enabled. If you disable this policy, the QR Code Generator feature is disabled. The QR Code Generator feature is enabled. The QR Code Generator feature is disabled. True False Control Accept-Language Reduction The Accept-Language HTTP request header and the JavaScript navigator.languages getter are planned for reduction for privacy reasons. To facilitate testing and ensure compatibility, this policy allows you to enable or disable the Accept-Language Reduction feature. If this policy is set to enabled or left unset, Accept-Language Reduction will be applied through field trials. If this policy is set to disabled, field trials will not be able to activate Accept-Language Reduction. For more information about this feature, please visit: https://github.com/explainers-by-googlers/reduce-accept-language. NOTE: Only newly-started renderer processes will reflect changes to this policy while the browser is running. Enable Accept-Language Reduction Disable Accept-Language Reduction True False Restrict accounts that are visible in Google Chrome Contains a list of patterns which are used to control the visibility of accounts in Google Chrome. Each Google account on the device will be compared to patterns stored in this policy to determine the account visibility in Google Chrome. The account will be visible if its name matches any pattern on the list. Otherwise, the account will be hidden. Use the wildcard character \'*\' to match zero or more arbitrary characters. The escape character is \'\\\', so to match actual \'*\' or \'\\\' characters, put a \'\\\' in front of them. If this policy is not set, all Google accounts on the device will be visible in Google Chrome. Restrict Background Fetch API when called from a Service Worker This policy controls whether background fetch requests from Service Workers are restricted. If a feature that downloads files in the background is affected, this policy may be relevant. If this policy is set to Enabled, or left unset, the restriction is active, and background fetch requests from Service Worker contexts may be blocked. If this policy is set to Disabled, the restriction is bypassed, allowing all Service Workers to make background fetch requests. This enterprise policy is temporary, and will be removed after M152. Enabled: Background Fetch from Service Workers is restricted. Disabled: Background Fetch from Service Workers is allowed without restrictions. True False Allow proceeding from the SSL warning page Setting the policy to Enabled or leaving it unset lets users click through warning pages Google Chrome shows when users navigate to sites that have SSL errors. Setting the policy to Disabled prevent users from clicking through any warning pages. Allow users to click through SSL warning pages Prevent users from clicking through SSL warning pages True False Allow proceeding from the SSL warning page on specific origins If SSLErrorOverrideAllowed is Disabled, setting the policy lets you set a list of origin patterns that specify the sites where a user can click through warning pages Google Chrome shows when users navigate to sites that have SSL errors. Users will not be able to click through SSL warning pages on origins that are not on this list. If SSLErrorOverrideAllowed is Enabled or unset, this policy does nothing. Leaving the policy unset means SSLErrorOverrideAllowed applies for all sites. For detailed information on valid input patterns, please see https://chromeenterprise.google/policies/url-patterns/. * is not an accepted value for this policy. This policy only matches based on origin, so any path in the URL pattern is ignored. Configure the list of domains on which Safe Browsing will not trigger warnings. Setting the policy to Enabled means Safe Browsing will trust the domains you designate. It won\'t check them for dangerous resources such as phishing, malware, or unwanted software. Safe Browsing\'s download protection service won\'t check downloads hosted on these domains. Its password protection service won\'t check for password reuse. Leaving the policy unset means default Safe Browsing protection applies to all resources. This policy does not support regular expressions; however, subdomains of a given domain are allowlisted. Fully qualified domain names (FQDNs) are not required. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Enable Safe Browsing Extended Reporting Setting the policy to Enabled turns on Google Chrome\'s Safe Browsing Extended Reporting, which sends some system information and page content to Google servers to help detect dangerous apps and sites. Setting the policy to Disabled means reports are never sent. If you set this policy, users can\'t change it. If not set, users can decide whether to send reports or not. See more about Safe Browsing ( https://developers.google.com/safe-browsing ). Enable reporting of system information and page content to help improve Safe Browsing Disable reporting of system information and page content which are used to help improve Safe Browsing Allow the user to decide True False None Safe Browsing Protection Level Allows you to control whether Google Chrome\'s Safe Browsing feature is enabled and the mode it operates in. If this policy is set to \'NoProtection\' (value 0), Safe Browsing is never active. If this policy is set to \'StandardProtection\' (value 1, which is the default), Safe Browsing is always active in the standard mode. If this policy is set to \'EnhancedProtection\' (value 2), Safe Browsing is always active in the enhanced mode, which provides better security, but requires sharing more browsing information with Google. If you set this policy as mandatory, users cannot change or override the Safe Browsing setting in Google Chrome. If this policy is left not set, Safe Browsing will operate in Standard Protection mode but users can change this setting. See https://support.google.com/chrome?p=safe_browsing_preferences for more info on Safe Browsing. Safe Browsing is never active. Safe Browsing is active in the standard mode. Safe Browsing is active in the enhanced mode. This mode provides better security, but requires sharing more browsing information with Google. 0 1 2 Allow Safe Browsing Proxied Real Time Checks This controls whether Safe Browsing\'s standard protection mode is allowed to send partial hashes of URLs to Google through a proxy via Oblivious HTTP in order to determine whether they are safe to visit. The proxy allows browsers to upload partial hashes of URLs to Google without them being linked to the user\'s IP address. The policy also allows browsers to upload the partial hashes of URLs with higher frequency for better Safe Browsing protection quality. This policy will be ignored if Safe Browsing is disabled or set to enhanced protection mode. Setting the policy to Enabled or leaving it unset allows the higher-protection proxied lookups. Setting the policy to Disabled disallows the higher-protection proxied lookups. Partial hashes of URLs will be uploaded to Google directly with much lower frequency, which will degrade protection. Allow higher-protection proxied lookups Don\'t allow higher-protection proxied lookups True False Control SafeSites adult content filtering. Setting the policy controls the SafeSites URL filter, which uses the Google Safe Search API to classify URLs as pornographic or not. When this policy is set to: * Do not filter sites for adult content, or not set, sites aren\'t filtered * Filter sites for adult content, pornographic sites are filtered The policy applies to both the URL the user navigates to and to iframes. The URLAllowlist policy takes precedence over this policy and can be used to override verdicts from the Google Safe Search API. Do not filter sites for adult content Filter sites for adult content 0 1 Allow Same Origin Tab capture by these origins Setting the policy lets you set a list of URL patterns that can capture tabs with their same Origin. Leaving the policy unset means that sites will not be considered for an override at this level of capture. Note that windowed Chrome Apps with the same origin as this site will still be allowed to be captured. If a site matches a URL pattern in this policy, the following policies will not be considered: TabCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. This policy only matches based on origin, so any path in the URL pattern is ignored. Disable saving browser history Setting the policy to Enabled means browsing history is not saved, tab syncing is off and users can\'t change this setting. Setting the policy to Disabled or leaving it unset saves browsing history. Disable saving browser history Enable saving browser history True False Allow or deny screen capture If enabled or not configured (default), a Web page can use screen-share APIs (e.g., getDisplayMedia() or the Desktop Capture extension API) to prompt the user to select a tab, window or desktop to capture. When this policy is disabled, any calls to screen-share APIs will fail with an error; however this policy is not considered (and a site will be allowed to use screen-share APIs) if the site matches an origin pattern in any of the following policies: ScreenCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins, TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins. Allow sites to prompt the user to share a video stream of their screen Do not allow sites to prompt the user to share a video stream of their screen True False Allow Desktop, Window, and Tab capture by these origins Setting the policy lets you set a list of URL patterns that can use Desktop, Window, and Tab Capture. Leaving the policy unset means that sites will not be considered for an override at this level of Capture. This policy is not considered if a site matches a URL pattern in any of the following policies: WindowCaptureAllowedByOrigins, TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins. If a site matches a URL pattern in this policy, the ScreenCaptureAllowed will not be considered. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. This policy only matches based on origin, so any path in the URL pattern is ignored. Enable scrolling to text specified in URL fragments This feature allows for hyperlinks and address bar URL navigations to target specific text within a web page, which will be scrolled to once the loading of the web page is complete. If you enable or don\'t configure this policy, web page scrolling to specific text fragments via URL will be enabled. If you disable this policy, web page scrolling to specific text fragments via URL will be disabled. Allow sites to scroll to specific text fragments via URL Do not allow sites to scroll to specific text fragments via URL True False Enable content sharing with Google AI Mode and Lens integrations This policy controls sharing of page and file content with Google AI Mode and Lens through Google Chrome side panel or tabs. Note that this policy doesn\'t affect Google AI Mode on the web. It only controls how users can share information with it when using Google Chrome. 0 = users can share page or file content with Google AI Mode. 1 = users cannot share page or file content with Google AI Mode. The entry points for sharing context and the side panel will be disabled or hidden. This policy will be ignored when Google Search is not users\' default search engine as the feature is disabled. This policy is independent of the AIModeSettings policy. The AIModeSettings policy only controls entry points on omnibox or NTP search box, while this policy controls context sharing through side panel or tabs. This policy also doesn\'t control Google Gemini integration which can be disabled by GeminiSettings. If this policy is unset, its behavior is determined by the GenAiDefaultSettings policy. For more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings. Allow content sharing with Google AI Mode integrations. Do not allow content sharing with Google AI Mode integrations. 0 1 Enable search suggestions Setting the policy to True turns on search suggestions in Google Chrome\'s address bar. Setting the policy to False turns off these search suggestions. Suggestions based on bookmarks or history are unaffected by the policy. If you set the policy, users can\'t change it. If not set, search suggestions are on at first, but users can turn them off any time. Enable search suggestions Disable search suggestions Allow the user to decide True False None Allow access to sensors on these sites Setting the policy lets you set a list of URL patterns that specify the sites that can access sensors like motion and light sensors. Leaving the policy unset means DefaultSensorsSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. If the same URL pattern exists in both this policy and the SensorsBlockedForUrls policy, the latter is prioritized and access to motion or light sensors will be blocked. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Block access to sensors on these sites Setting the policy lets you set a list of URL patterns that specify the sites that can\'t access sensors like motion and light sensors. Leaving the policy unset means DefaultSensorsSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. If the same URL pattern exists in both this policy and the SensorsAllowedForUrls policy, this policy is prioritized and access to motion or light sensors will be blocked. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Automatically grant permission to sites to connect all serial ports. Setting the policy allows you to list sites which are automatically granted permission to access all available serial ports. The URLs must be valid, otherwise the policy is ignored. Only the origin (scheme, host and port) of the URL is considered. On Google ChromeOS, this policy only applies to affiliated users. This policy overrides DefaultSerialGuardSetting, SerialAskForUrls, SerialBlockedForUrls and the user\'s preferences. Allow the Serial API on these sites Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a serial port. Leaving the policy unset means DefaultSerialGuardSetting applies for all sites, if it\'s set. If not, users\' personal settings apply. For URL patterns which do not match the policy SerialBlockedForUrls (if there is a match), DefaultSerialGuardSetting (if set), or the users\' personal settings take precedence, in that order. If URL patterns conflict with SerialBlockedForUrls they will be ignored. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Block the Serial API on these sites Setting the policy lets you list the URL patterns that specify which sites can\'t ask users to grant them access to a serial port. Leaving the policy unset means DefaultSerialGuardSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. For URL patterns which do not match the policy SerialAskForUrls (if there is a match), DefaultSerialGuardSetting (if set), or the users\' personal settings take precedence, in that order. If URL patterns conflict with SerialAskForUrls this policy will take precedence. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Allow ServiceWorker to dispatch navigation requests without waiting for its startup https://github.com/WICG/service-worker-auto-preload The ServiceWorkerAutoPreload feature dispatches a network request for a main resource at the same time it begins the ServiceWorker bootstrap process. Setting the policy to Enabled or leaving it unset means Google Chrome enables ServiceWorkerAutoPreload. The navigation request is automatically dispatched while starting the ServiceWorker in some scenarios, e.g. ServiceWorker is not running, If it is disabled, Google Chrome will not enable ServiceWorkerAutoPreload. The navigation request is dispatched always after starting the ServiceWorker. This policy is a temporary measure to control the feature and will be removed in M154. Enable ServiceWorkerAutoPreload Disable ServiceWorkerAutoPreload True False Allow ServiceWorker to control srcdoc iframes https://github.com/w3c/ServiceWorker/issues/765 asks srcdoc iframe with the \"allow-same-origin\" sandbox attribute to be under ServiceWorker control. Setting the policy to Enabled or leaving it unset means Google Chrome makes srcdoc iframes with \"allow-same-origin\" sandbox attributes to be under ServiceWorker control. Setting the policy to Disabled leaves the srcdoc iframe not controlled by ServiceWorker. This policy is intended to be temporary and will be removed in 2026. ServiceWorker can control srcdoc iframes ServiceWorker won\'t control srcdoc iframes True False Make SharedWorker blob URL behavior aligned with the specification Upon https://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers should inherit controllers for the blob URL. However, existing code allows only DedicatedWorkers to inherit the controller, and SharedWorkers do not inherit the controller. Setting the policy to Enabled or leaving it unset means Google Chrome inherit the controller if a blob URL is used as a SharedWorker URL. Setting the policy to Disabled leaves the behavior not aligned with the specification as-is. This policy is intended to be temporary and will be removed in the future. A blob URL SharedWorker inherits a controller. A blob URL SharedWorker does not inherit a controller. (legacy behavior) True False Enable extended lifetime for SharedWorkers SharedWorkers can have an extended lifetime if the \"extendedLifetime\" option is set to true in the SharedWorker constructor. If this policy is set to Enabled or left unset, SharedWorkers can have an extended lifetime. If this policy is set to Disabled, SharedWorkers cannot have an extended lifetime, even if the option is set to true. This policy is intended to be temporary and will be removed in the future. SharedWorkers can have an extended lifetime. SharedWorkers cannot have an extended lifetime. True False Allow the shopping list feature to be enabled This policy controls the availability of the shopping list feature. If enabled, users will be presented with UI to track the price of the product displayed on the current page. The tracked product will be shown in the bookmarks side panel. If this policy is set to Enabled or not set, the shopping list feature will be available to users. If this policy is set to Disabled, the shopping list feature will be unavailable. The shopping list feature will be available to users. The shopping list feature will not be available to users. True False Show Home button on toolbar Setting the policy to Enabled shows the Home button on Google Chrome\'s toolbar. Setting the policy to Disabled keeps the Home button from appearing. If you set the policy, users can\'t change it in Google Chrome. If not set, users chooses whether to show the Home button. Show the Home button on the toolbar Hide the Home button from the toolbar Allow the user to decide True False None Enable Site Isolation for every site Setting the policy to Enabled isolates all sites on Android, such that each site runs in its own process, and it prevents users from opting out. A site is a scheme plus eTLD+1 (e.g., https://example.com). Note that Android isolates certain sensitive sites by default starting in Google Chrome version 77, and this policy extends that default site isolation mode to apply to all sites. Setting the policy to Disabled turns off any form of site isolation, including isolation of sensitive sites and field trials of IsolateOriginsAndroid, SitePerProcessAndroid, and other site isolation modes. Users can still turn the policy on manually. Leaving the policy unset means users can change this setting. IsolateOriginsAndroid might also be useful for isolating specific origins at a finer granularity than site (e.g., https://a.example.com). Note: Support for isolating every site on Android will improve, but currently it may cause performance problems, especially on low-end devices. This policy applies only to Chrome on Android running on devices with strictly more than 1 GB of RAM. To isolate specific sites while limiting performance impact for users, use IsolateOriginsAndroid with a list of the sites you want to isolate. To apply the policy on non-Android platforms, use SitePerProcess. Require site isolation for all websites Disable site isolation for all websites, but allow the user to enable it Allow the user to decide True False None Enable Standardized Browser Zoom Behavior This policy enables conformance to the newly-adopted specification of CSS zoom. When this policy is Enabled or unset, the CSS \"zoom\" property will adhere to the specification: https://drafts.csswg.org/css-viewport/#zoom-property When Disabled, the CSS \"zoom\" property will fall back to its legacy pre-standardized behavior. This policy is a temporary reprieve to allow time to migrate web content to the new behavior. There is also an origin trial (\"DisableStandardizedBrowserZoom\") that corresponds to the behavior when this policy is Disabled. This policy will be removed and the \"Enabled\" behavior made permanent in milestone 134. Enabled: CSS zoom conforms to the standard specification. Disabled: CSS zoom preserves its legacy pre-standard behavior. True False Control whether storage quota APIs will return static values When enabled, the storage quota APIs will return a static value equal to usage + min(10 GiB, disk rounded up to the nearest 1 GiB). When disabled, the storage quota APIs will generally return a dynamic value proportional to the total space available on the device, regardless of usage. If unset, the storage quota APIs will use the default Chrome behavior. Sites with unlimited storage permissions are unaffected by this setting. Enforced quota is also unaffected. Storage quota APIs return static values. Storage quota APIs return dynamic values. Storage quota APIs return values based on feature launch process. True False None Enable strict MIME type checking for worker scripts This policy enables strict MIME type checking for worker scripts. When enabled or unset, then worker scripts will use strict MIME type checking for JavaScript, which is the new default behaviour. Worker scripts with legacy MIME types will be rejected. When disabled, then worker scripts will use lax MIME type checking, so that worker scripts with legacy MIME types, e.g. text/ascii, will continue to be loaded and executed. Browsers traditionally used lax MIME type checking, so that resources with a number of legacy MIME types were supported. E.g. for JavaScript resources, text/ascii is a legacy supported MIME type. This may cause security issues, by allowing to load resources as scripts that were never intended to be used as such. Chrome will transition to use strict MIME type checking in the near future. The enabled policy will track the default behaviour. Disabling this policy allows administrators to retain the legacy behaviour, if desired. See https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguage for details about JavaScript / ECMAScript media types. Scripts for workers (Web Workers, Service Workers, etc.) require a JavaScript MIME type, like text/javascript. Worker scripts with legacy MIME types, like text/ascii, will be rejected. Scripts for workers (Web Workers, Service Workers, etc.) use lax MIME type checking. Worker scripts with legacy MIME types, like text/ascii, will work. True False Suppress JavaScript Dialogs triggered from different origin subframes As described in https://www.chromestatus.com/feature/5148698084376576 , JavaScript modal dialogs, triggered by window.alert, window.confirm, and window.prompt, will be blocked in Google Chrome if triggered from a subframe whose origin is different from the main frame origin. This policy allows overriding that change. If the policy is set to enabled or unset, JavaScript dialogs triggered from a different origin subframe will be blocked. If the policy is set to disabled, JavaScript dialogs triggered from a different origin subframe will not be blocked. This policy will be removed from Google Chrome in the future. Block JavaScript dialogs triggered from a different origin subframe. Allow JavaScript dialogs triggered from a different origin subframe. True False List of types that should be excluded from synchronization If this policy is set all specified data types will be excluded from synchronization both for Chrome Sync as well as for roaming profile synchronization. This can be beneficial to reduce the size of the roaming profile or limit the type of data uploaded to the Chrome Sync Servers. The current data types for this policy are: \"apps\", \"autofill\", \"bookmarks\", \"extensions\", \"preferences\", \"passwords\", \"payments\", \"productComparison\", \"readingList\", \"tabs\", \"themes\", \"typedUrls\", \"wifiConfigurations\". Those names are case sensitive! Notes: Dynamic Policy Refresh is supported only in Google Chrome version 123 and later. Disabling \"autofill\" also disables \"payments\". \"typedUrls\" refers to all browsing history. Enable TLS 1.3 Early Data TLS 1.3 Early Data is an extension to TLS 1.3 to send an HTTP request simultaneously with the TLS handshake. If this policy is not configured, Google Chrome will follow the default rollout process for TLS 1.3 Early Data. If it is enabled, Google Chrome will enable TLS 1.3 Early Data. If it is disabled, Google Chrome will not enable TLS 1.3 Early Data. When the feature is enabled, Google Chrome may or may not use TLS 1.3 Early Data depending on server support. TLS 1.3 Early Data is an established protocol. Existing TLS servers, middleboxes, and security software are expected to either handle or reject TLS 1.3 Early Data without dropping the connection. However, devices that do not correctly implement TLS may malfunction and disconnect when TLS 1.3 Early Data is in use. If this occurs, administrators should contact the vendor for a fix. This policy is a temporary measure to control the feature and will be removed afterwards. The policy may be enabled to allow you to test for issues and disabled while issues are being resolved. Enable the TLS 1.3 Early Data Disable the TLS 1.3 Early Data True False Allow Tab capture by these origins Setting the policy lets you set a list of URL patterns that can use Tab Capture. Leaving the policy unset means that sites will not be considered for an override at this level of capture. Note that windowed Chrome Apps will still be allowed to be captured. This policy is not considered if a site matches a URL pattern in the SameOriginTabCaptureAllowedByOrigins policy. If a site matches a URL pattern in this policy, the following policies will not be considered: WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. This policy only matches based on origin, so any path in the URL pattern is ignored. Settings for 3rd party AI Mode integrations in the address bar and New Tab page search box. This policy controls 3rd party AI Mode integrations in the address bar and the New Tab page search box. To access this feature, a 3rd party search engine that supports AI Mode must be set as the user\'s default search engine. 0 = The feature will be available to users. 1 = The feature will not be available to users. If the policy is unset, its behavior is determined by the GenAiDefaultSettings policy. Allow 3rd party AI Mode integrations. Do not allow 3rd party AI Mode integrations. 0 1 Allow using Third-Party Password Managers in Google Chrome on Android Setting the policy to true lets users use a third-party password manager. That password manager will handle saving and filling for all password, payment and autofill data. When the policy is true or not set, a setting will allow to switch between Google Chrome\'s buit-in password manager and the password manager configured in Android settings. Since Google Chrome uses the same data as Autofill with Google, the setting can only be changed to use third-party password managers if a manager other than Autofill with Google is configured in Android\'s system settings. Setting the policy to false means Google Chrome will always use the built-in password manager. This policy doesn\'t affect third-party password managers that use accessibility APIs. Allow using third-party password manager in Chrome Block switching to a third-party password manager True False Configuring the ToS behavior during first-run for CCT By default the Terms of Service are shown when CCT is first-run. Setting this policy to SkipTosDialog will cause the Terms of Service dialog to not appear during the first-run-experience or subsequent runs. Setting this policy to StandardTosDialog or leaving it unset will cause the Terms of Service dialog to appear during the first-run-experience. The other caveats are: - This policy only works on fully managed Android devices that can be configured by Unified Endpoint Management vendors. - If this policy is SkipTosDialog the BrowserSignin policy will have no effect. - If this policy is SkipTosDialog metrics​ will not be sent to the server. - If this policy is SkipTosDialog the browser will have limited functionality. - If this policy is SkipTosDialog admins must communicate this to end users of the device. Use default browser behavior, shows the ToS and waits for the user to accept. Automatically skips ToS and loads the browser. 1 2 Enable Translate Setting the policy to True provides translation functionality when it\'s appropriate for users by showing an integrated translate toolbar in Google Chrome and a translate option on the right-click context menu. Setting the policy to False shuts off all built-in translate features. If you set the policy, users can\'t change this function. Leaving it unset lets them change the setting. Always offer translation Never offer translation Allow the user to decide True False None Allow access to a list of URLs Setting the policy provides access to the listed URLs, as exceptions to URLBlocklist. See that policy\'s description for the format of entries of this list. For example, setting URLBlocklist to * will block all requests, and you can use this policy to allow access to a limited list of URLs. Use it to open exceptions to certain schemes, subdomains of other domains, ports, or specific paths, using the format specified at ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). The most specific filter determines if a URL is blocked or allowed. The URLAllowlist policy takes precedence over URLBlocklist. This policy is limited to 1,000 entries. This policy also allows enabling the automatic invocation by the browser of external application registered as protocol handlers for the listed protocols like \"tel:\" or \"ssh:\". Leaving the policy unset allows no exceptions to URLBlocklist. From Google Chrome version 92, this policy is also supported in the headless mode. Block access to a list of URLs Setting the URLBlocklist policy stops web pages with prohibited URLs from loading. Administrators can specify the list of URL patterns to be blocked. If left unset, no URLs are blocked in the browser. Up to 1,000 exceptions can be defined in URLAllowlist. See how to format a URL pattern ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). Note: This policy does not apply to in-page JavaScript URLs with dynamically loaded data. If you blocked example.com/abc, then example.com could still load it using XMLHTTPRequest. Additionally, this policy does not prevent web pages from updating the URL shown in the omnibox to a blocked one using the JavaScript History API. From Google Chrome version 73, you can block javascript://* URLs. But, this only affects JavaScript entered in the address bar or, for example, bookmarklets. From Google Chrome version 92, this policy is also supported in the headless mode. From Google Chrome version 147, the wildcard * on its own does not apply to internal chrome:// URLs. To block these, you must explicitly use the chrome://* pattern. Note: Blocking internal chrome://* and chrome-untrusted://* URLs can lead to unexpected errors or can be circumvented in some cases. Instead of blocking certain internal URLs, see if there are more specific policies available. For example: - Instead of blocking chrome://settings/certificates, use CACertificateManagementAllowed. - Instead of blocking chrome-untrusted://crosh, use SystemFeaturesDisableList. - Instead of blocking devtools://*, use one of the DeveloperToolsAvailability, DeveloperToolsAvailabilityAllowlist or DeveloperToolsAvailabilityBlocklist policies. Enable URL-keyed anonymized data collection Setting the policy to Enabled means URL-keyed anonymized data collection, which sends URLs of pages the user visits to Google to make searches and browsing better, is always active. Setting the policy to Disabled results in no URL-keyed anonymized data collection. If this policy is left unset, the user will be able to change this setting manually. In Google ChromeOS Kiosk, this policy doesn\'t offer the option to \"Allow the user to decide\". If this policy is unset for Google ChromeOS Kiosk, URL-keyed anonymized data collection is always active. When set for Google ChromeOS Kiosk, this policy enables URL-keyed metrics collection for kiosk apps. URL-keyed anonymized data collection is always active URL-keyed anonymized data collection is never active Allow the user to decide True False None Allow user feedback Setting the policy to Enabled or leaving it unset lets users send feedback to Google through Menu > Help > Report an Issue or key combination. Setting the policy to Disabled means users can\'t send feedback to Google. Allow users to file feedback Prevent users from filing feedback True False The virtual keyboard resizes the layout viewport by default Setting the policy to True causes the virtual keyboard to resize the layout viewport by default. Other states (False/unset) have no effect. Note that this only affects the default resizing behavior: if a page requests a specific behavior using a <meta> tag or the Virtual Keyboard API, then that requested behavior will still apply. Note also that this is an \"escape hatch\" policy that\'s intended to be short-lived. The default virtual keyboard resize behavior is changed to resize the layout viewport The default virtual keyboard resize behavior is not modified True False Allowed Origins for Proxied WebAuthn Requests from Remote Desktop Applications. A list of origins of remote desktop client apps that may execute WebAuthn API requests that originate from a browsing session on a remote host. Any origin configured in this policy can make WebAuthn requests for Relying Party IDs (RP IDs) that it would normally not allowed to be able to claim. Only valid HTTPS origins are allowed. Wildcards are not supported. Any invalid entries are ignored. This policy only applies to affiliated users. Allow collection of WebRTC event logs from Google services Setting the policy to Enabled means Google Chrome can collect WebRTC event logs from Google services such as Hangouts Meet and upload them to Google. These logs have diagnostic information for debugging issues with audio or video meetings in Google Chrome, such as the time and size of RTP packets, feedback about congestion on the network, and metadata about time and quality of audio and video frames. These logs have no audio or video content from the meeting. To make debugging easier, Google might associate these logs, by means of a session ID, with other logs collected by the Google service itself. Setting the policy to Disabled results in no collection or uploading of such logs. Leaving the policy unset on versions up to and including M76 means Google Chrome defaults to not being able to collect and upload these logs. Starting at M77, Google Chrome defaults to being able to collect and upload these logs from most profiles affected by cloud-based, user-level enterprise policies. From M77 up to and including M80, Google Chrome can also collect and upload these logs by default from profiles affected by Google Chrome on-premise management. Allow WebRTC event log collection from Google services Do not allow WebRTC event log collection from Google services True False Restrict the range of local UDP ports used by WebRTC If the policy is set, the UDP port range used by WebRTC is restricted to the specified port interval (endpoints included). If the policy is not set, or if it is set to the empty string or an invalid port range, WebRTC is allowed to use any available local UDP port. Automatically grant permission to these sites to connect to USB devices with the given vendor and product IDs. Setting the policy lets you list the URL patterns that specify which sites are automatically granted permission to access a USB device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the policy to be valid. Each item in the devices field can have a vendor_id and product_id field. Omitting the vendor_id field will create a policy matching any device. Omitting the product_id field will create a policy matching any device with the given vendor ID. A policy which has a product_id field without a vendor_id field is invalid. The USB permission model will grant the specified URL permission to access the USB device as a top-level origin. If embedded frames need to access USB devices, the \'usb\' feature-policy header should be used to grant access. The URL must be valid, otherwise the policy is ignored. Deprecated: The USB permission model used to support specifying both the requesting and embedding URLs. This is deprecated and only supported for backwards compatibility in this manner: if both a requesting and embedding URL is specified, then the embedding URL will be granted the permission as top-level origin and the requesting URL will be ignored entirely. This policy overrides DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls and the user\'s preferences. This policy only affects access to USB devices through the WebUSB API. To grant access to USB devices through the Web Serial API see the SerialAllowUsbDevicesForUrls policy. Allow WebUSB on these sites Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a USB device. Leaving the policy unset means DefaultWebUsbGuardSetting applies for all sites, if it\'s set. If not, users\' personal settings apply. URL patterns must not conflict with WebUsbAskForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Block WebUSB on these sites Setting the policy lets you list the URL patterns that specify which sites can\'t ask users to grant them access to a USB device. Leaving the policy unset means DefaultWebUsbGuardSetting applies for all sites, if it\'s set. If not, the user\'s personal setting applies. URL patterns can\'t conflict with WebUsbAskForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Allow creating WebXR\'s \"immersive-ar\" sessions Configures whether the sites that the user navigates to are allowed to create immersive Augmented Reality sessions using WebXR Device API. When this policy is unset or enabled, the WebXR Device API will accept \"immersive-ar\" during session creation, thus allowing the users to enter Augmented Reality experiences. When this policy is disabled, the WebXR Device API will reject requests to create sessions with mode set to \"immersive-ar\". The existing \"immersive-ar\" sessions (if any) will not be terminated. For more details about \"immersive-ar\" sessions, please see WebXR Augmented Reality Module specification. Allow creating WebXR\'s \"immersive-ar\" sessions Prevent creating WebXR\'s \"immersive-ar\" sessions True False Allow Window and Tab capture by these origins Setting the policy lets you set a list of URL patterns that can use Window and Tab Capture. Leaving the policy unset means that sites will not be considered for an override at this level of Capture. This policy is not considered if a site matches a URL pattern in any of the following policies: TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins. If a site matches a URL pattern in this policy, the following policies will not be considered: ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. This policy only matches based on origin, so any path in the URL pattern is ignored. Control the availability of the XSLT feature This policy controls the availability of the XSLT feature (the XSLTProcessor Javascript API and the XSL processing instruction). If this policy is set to Enabled, XSLT will be available, regardless of the default state of the feature in the browser. If this policy is set to Disabled, XSLT will be unavailable, regardless of the default state of the feature in the browser. If this policy is left unset, XSLT availability will be determined by the browser\'s default settings and field trials. This policy is a temporary measure, and will be removed in M164. Enabled: XSLT is explicitly enabled. Disabled: XSLT is explicitly disabled. Default: XSLT availability will be determined by browser defaults and field trials. True False None