Restrict primary accounts in Google Chrome

Intriguing! This is for new installs or new sign-in attempts only? If Chrome's already installed and signed into, pushing out this configuration would have no effect on those situations, right? 

Good question. if Chrome is already installed and logged in, synchronization will be forcibly turned off if the login domain is not on the list, but all current data(bookmarks, history, etc.) will be retained.

Aha yes I created the configuration profile in our sandbox, signed into a Google account (not in a restricted to domain) in Chrome on a test Mac, then scoped the profile to the Mac, and upon restarting Chrome, it was signed out of the Google account. This is awesome, thanks so much for posting this!

Is there a way to restrict the sign-in all together? 

If you want to restrct the sign-in domain of the google account, you need use AllowedDomainsForApps key.

https://chromeenterprise.google/policies/#AllowedDomainsForApps

Here’s my configuration profile plist file:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>RestrictSigninToPattern</key> <string>.*@YourDomainName.org</string> <key>AllowedDomainsForApps</key> <string>YourDomainName.org</string> </dict> </plist>

This allows the user to login with their personal gmail accounts but they can’t do much with it. They can’t enable sync and they can’t use any of the Apps like; Gmail, Drive, Chat, extra…

Only your allowed domain listed in the plist file can do all the above as normal. Hope this helps!