⚙️🪟💻CP - Google Chrome - Security Baseline
The one profile that turns a consumer browser into a managed one. Locks the connection, the sign-in, the autofill, and the extension store all at once.
What this policy is about 🛡️
Chrome ships tuned for a consumer, not a managed fleet. It will sign the browser into a personal Google account, autofill a credit card, trust an outdated TLS version, and install any extension the user clicks. This baseline closes all of that in one profile: a hardened connection, no browser sign-in, no credit-card autofill, a shrunken attack surface, and an extension store that is blocked by default.
The extension piece is the keystone. Setting the installation blocklist to * blocks every extension, which is what makes the Allowed Extensions allow list actually mean something. Without this baseline, that allow list is decoration.
Each setting here is defensible on its own, but the point is the whole. A browser that is hardened on TLS but wide open on extensions is not hardened. This profile sets the floor for every managed Chrome install so nobody has to remember the list.
Why this matters 🕵️
The browser is where the work actually happens, and it is the single richest target on the device. A stale TLS handshake, a rogue extension reading every page, a personal Google sign-in syncing corporate bookmarks and passwords outward, Basic auth handing credentials over the wire in near-plaintext: each is a quiet, ordinary way for data to leave. None of them look like an attack until they are one.
Setting a baseline means every managed Chrome starts from the same locked posture, and the only browsers that deviate are the ones you deliberately excepted.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Google \ Google Chrome.
Connection and isolation
| Setting | Value |
|---|---|
| Minimum SSL version enabled | TLS 1.2 |
| Allow proceeding from the SSL warning page | Disabled |
| Require Site Isolation for every site | Enabled |
| Allow insecure websites to make requests to more-private network endpoints | Disabled |
HTTP authentication
| Setting | Value |
|---|---|
| Allow Basic authentication for HTTP | Disabled |
| Supported authentication schemes | ntlm, negotiate |
Browser identity and data
| Setting | Value |
|---|---|
| Browser sign in settings | Disable browser sign-in |
| Enable AutoFill for credit cards | Disabled |
Attack surface
| Setting | Value |
|---|---|
| Block Browser Legacy Extension Points | Enabled |
| WebAssembly modules sent cross-origin | Disabled |
| Force WebSQL in third-party contexts to be re-enabled | Disabled |
| Allow user-level Native Messaging hosts (installed without admin permissions) | Disabled |
Extensions
| Setting | Value |
|---|---|
| Configure extension installation blocklist | Enabled |
| Extension IDs the user should be prevented from installing | * (block all) |
Assignment: include All devices; exclude standard exclusion groups only.
Caveats ⚠️
The block-all extension setting is the load-bearing one. * blocks every extension, so anything users genuinely need must be named in the Allowed Extensions allow list or force-installed via Forced Extensions. Ship the block without the allow list and you have broken every legitimate add-on at once.
Disable browser sign-in is not the same as blocking Google accounts. Users can still sign in to Google websites; they just cannot sign the browser into a profile that syncs. That is the intended line: use Google services, do not turn the corporate browser into a personal one.
Basic auth and legacy TLS breakages surface fast. An internal appliance stuck on TLS 1.1 or HTTP Basic auth will stop working. That is the baseline doing its job, but inventory those legacy endpoints before rollout so the helpdesk is not surprised.
Versioned by design. Chrome adds and renames policies with major releases, so this baseline moves with the browser. When you bump the profile to a newer Chrome version, re-check that each setting still exists under the same name.
License and reversibility. Included in Business Premium. Clean-revert: unassign and Chrome returns to its unmanaged defaults on the next policy refresh.
🔗 Related
- ⚙️🪟🧑💼CP - Google Chrome - Allowed Extensions: the allow list this baseline's block-all makes meaningful.
- ⚙️🪟💻CP - Google Chrome - Forced Extensions: the extensions you install for users regardless of the block.
- ⚙️🪟💻CP - Google Chrome - Disable Password Manager: keeps corporate passwords out of the browser vault.
Chrome does not ship enterprise-ready; it ships enthusiast-ready. This is the profile that grows it up. 🛡️