ChromeOS & O365 - Live Q&A Jun 23

17. What are the high-level prerequisites and deployment steps needed to get a ChromeOS and Microsoft 365 integration up and running?

1. Before you begin! Make sure that you have an active, domain-verified (matching Entra ID) Google Admin Console, you have ChromeOS upgrades to manage your devices, you have enrolled the devices, and you have enough Cloud Identity users.

           At a glance:

• Create an Enterprise Application in Entra ID
• Assign users / groups
• Configure SSO on Entra ID and Google
• Enable SAML sign-on for ChromeOS devices

           For more guidance review this help centre article.

17. Beyond basic identity federation, what optional settings and advanced configurations should we consider in the Google Admin Console to optimize the initial login flow and maintain credential harmony between ChromeOS and Microsoft?

1. Some include:

• Configuring user auto-provisioning: Automate user creation and lifecycle management from Entra ID to Google.
• Setting up cookie transfer: Allow seamless authentication to Microsoft 365 web apps immediately after logging into the device.
• Keeping (device) password in sync: Ensure the local ChromeOS device password updates automatically when a user changes their Microsoft password.
• Redirecting users to Microsoft by default or setup username passthrough: Speed up the sign-in flow by bypassing the Google login screen entirely.
• Sign-in screen refresh: Force the device to refresh the login page to capture any updated identity policies or branding changes instantly.

           For more guidance review this help centre article.

17. What are our deployment options for OneDrive and Office file management, and what does the setup look like if IT handles it?

1. When it comes to OneDrive and Office file management on ChromeOS, you have two primary paths depending on how much control you want over the user experience. Your options are:

• Let users configure it themselves
• Pre-configure OneDrive and Office file management for everyone (Recommended for enterprise consistency)

           For more guidance on the latter, review this help centre article.

17. Once the core integration is done, are there any quick wins for improving daily productivity for our users right from their browser?

1. Yes! Microsoft 365 cards on New Tab: You can set up Calendar and file suggestions on the New Tab page for your users, this way Chrome will show them their upcoming meetings or suggested files. For more guidance review this help centre article.

17. Can we use Microsoft Intune to manage our ChromeOS devices, and what does that integration actually look like?

1. Yes, Intune is an approved inventory management partner. Your ChromeOS devices will appear directly within the Intune console.

• Remote Actions Available: You will have access to specific remote options, including restart, disable, deprovision, and wipe.
• No Policy Management: Direct policy and configuration management must still be done via the Google Admin Console; Intune handles inventory and basic commands, not policy enforcement.
• The Connection: Intune connects directly to the Google Admin console to sync this device data.

           For more guidance on the latter, review this Microsoft article.

17. Beyond setting up the operating system itself, what security controls, endpoint policies, and data protection features can we actually manage at the user profile and browser level once our ChromeOS and M365 SSO integration is live?

1. Google Chrome browser can be managed by your company, allowing you to manage extensions for your users, enable Security insights, set policies, let users sync their bookmarks to their corporate account, isolate or disable personal accounts, prevent data loss, control use of company information on genAI platforms, block malicious sites or entire categories and much more. Your users can leverage the same SSO setup to login to their profile in Chrome and you can manage that profile, along with the Browser for devices you own.

           For more guidance review this help centre article.