⚙️🪟💻🔓CP - Google Chrome - Enable Password Manager
The counter-policy to the block. It does not just remove the restriction, it says the opposite out loud, so the manager actually comes back on for the approved few.
What this policy is about 🔓
This is the deliberate exception to ⚙️🪟💻CP - Google Chrome - Disable Password Manager, and it exists because of one Intune fact that trips everyone up: exclusion is not the same as re-enabling.
Say you disable the Chrome password manager everywhere (good), and one team genuinely relies on it (fine), so you pull their devices out of the block. Still off. The policy value already applied, and simply removing the assignment does not flip it back. To actually switch the manager on again you assign a policy that sets the opposite value, explicitly. This is that policy.
It sets both settings back to Enabled, which also brings leak detection back for these devices, exactly what you want if Chrome really is their password manager.
Whenever a device-scoped setting has an exception group, it needs a matching policy that resets the value. Assign this to the 🛡️🪟💻👈🔓⚙️Group - Chrome Password Manager Allowed group and the manager comes back cleanly, no reimaging, no registry surgery.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Google \ Google Chrome \ Password manager.
| Setting | Value |
|---|---|
| Enable saving passwords to the password manager | Enabled |
| Enable leak detection for entered credentials | Enabled |
| Assignment, include | 🛡️🪟💻👈🔓⚙️Group - Chrome Password Manager Allowed |
| Assignment, exclude | None (only the approved exception group receives this) |
Setting both back to Enabled is what actively overrides the disabled state, which is the only thing that truly lifts it.
Caveats ⚠️
Assign it narrowly or you have unblocked the fleet. This belongs on the approved exception group only. Point it any wider and you have quietly re-enabled the browser vault for everyone, undoing the baseline.
It is only half the pair. This does nothing useful without the Disable baseline in place; the two are designed and reviewed together.
Governance is the real control. The technology is trivial; the risk is human. Every member of the group needs a documented reason, written customer approval, and a place in a regular review, or it becomes shadow IT with extra steps.
License and reversibility. Included in Business Premium. Clean-revert: unassign and those devices fall back under the disable baseline.
🔗 Related
- ⚙️🪟💻CP - Google Chrome - Disable Password Manager: the default this policy carves an exception out of.
- 🛡️🪟💻👈🔓⚙️Group - Chrome Password Manager Allowed: the documented group this is assigned to.
Want control? Start with the disable baseline. Want an exception? Use this, narrowly, with the paperwork to back it up. 🔓