Restrict primary accounts in Google Chrome

[Steven_Xu]

To prevent user from syncing Chrome data with their personal google account, a custom setting for Google Chrome can be set and deployed by Jamf Pro. 

Preference Domain: com.google.Chrome

Plist file content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>RestrictSigninToPattern</key>
    <string>(?:.*@domain1.com|.*@domain2.com)</string>
</dict>   
</plist>

let's check the managed chrome policy status and the sync result.

[czarmark]

Intriguing! This is for new installs or new sign-in attempts only? If Chrome's already installed and signed into, pushing out this configuration would have no effect on those situations, right? 

[Steven_Xu]

Good question. if Chrome is already installed and logged in, synchronization will be forcibly turned off if the login domain is not on the list, but all current data(bookmarks, history, etc.) will be retained.

[czarmark]

Aha yes I created the configuration profile in our sandbox, signed into a Google account (not in a restricted to domain) in Chrome on a test Mac, then scoped the profile to the Mac, and upon restarting Chrome, it was signed out of the Google account. This is awesome, thanks so much for posting this!

[khinkelman]

Is there a way to restrict the sign-in all together? 

[Steven_Xu]

If you want to restrct the sign-in domain of the google account, you need use AllowedDomainsForApps key.

https://chromeenterprise.google/policies/#AllowedDomainsForApps