Restrictions

Introduction

With Chromebooks evolving to become a part of the corporare workforce, it has become necessary to mandate certain device functionality, to ensure data privacy as well as improved productivity. Restrictions lets you achieve this by enabling/disabling certain Chromebook features, pertaining to the needs of the organization.

Profile Description

Profile Settings	Description
Guest Mode	Allow/Restrict users from signing in as a guest through guest mode. Using Guest mode lets a user browse the web without having to sign in. Browsing history from the previous user's session is not shown. However, some settings like the saved Wifi network, or passwords, will be retained on the device even when Guest mode is enabled. Learn more about Guest Mode.
Ephemeral Mode	Allow/Restrict erasing of all local user information and associated settings every time a user signs out, using ephemeral mode. When ephemeral mode is applied to a device, browsing information will not be stored on the device after the user logs out. This data can be synced to the users account if needed, by enabling 'Chrome sync'. However, downloads, files stored in the system's local drive, will be stored on the device, even after the user logs out. Learn more about Ephemeral Mode.
Forced Re-enrollment	Enabling force re-enrollment ensures that even if the device is hard reset, the management from MDM cannot be removed from the device. The management enforced on the device can only be removed by the admin from the MDM server. When the device is manually enrolled again, it will be reachable to the MDM server.
Redirect to SAML	Allow/Restrict direct entry to SAML SSO IdP page, for the users.
Tranfer SAML cookies	Allow/Restrict transfer of cookies(set by a SAML IdP) to users' profiles. If enabled, cookies are transferred during every SAML-authenticated user login.
Virtual Machines for running Linux apps	Allow/Restrict users from installing Virtual Machines on managed Chromebook to run Linux apps.
Display username and Avatar on sign in screen	Allow/Restrict the username and Avatar from being displayed on the sign in screen.
User(s) allowed to sign in	Specify the list of users, allowed to sign in and use the managed device.
Auto-complete domain name when logging in	Specify the list of users, allowed to sign in and use the managed device.
TIMEZONE SETTINGS
Timezone	Specify if you want to manually specify the timezone or have it detected automatically.
Select Timezone	Specify the timezone manually or specify settings for automatic selection.

Auto Update Expiration (AUE):

Chrome OS devices are subject to regular OS updates from Google, until they reach an expiration date called the Auto Update Expiration (AUE) date. After this date, the devices will no longer receive automated OS updates. The AUE is different for different Chrome OS device models. Refer this link for more information on AUE.