How to change the keyboard layout in managed chromebooks?
We currently have around 100 Chromebooks that we use for exams. I have now been asked to make it possible for participants to change the keyboard layout. Most use the German keyboard, but a few want to write with an English or French layout. What do I need to set in the management console so that participants can change the layout on their devices?
Standardised fleet or multi-vendor strategy: where do you land in 2026?
Hey everyone, In a recent discussion, we talked about how teams are using automatic enrollment to deploy and scale ChromeOS fleets more easily — whether that’s zero-touch for new devices or Flex for existing hardware. That got me thinking about another decision many admins are navigating right now: how they’re thinking about fleet strategy as they plan for 2026. Some organisations prefer a highly standardised fleet, sticking to one vendor or model to keep things predictable — from user experience and support, to lifecycle planning. Others lean towards a multi-vendor approach, mixing devices (and sometimes ChromeOS Flex) to stay flexible on procurement, optimise costs, or extend the life of existing hardware. Both approaches can work well on ChromeOS, but the trade-offs are something to take into consideration. I’d be interested to hear from the community: Do you lean more towards a standardised fleet, a multi-vendor strategy, or a mix of both? What factors tend to drive that decision in your environment (scale, cost, supply chain, sustainability, support)? Has your approach changed over time as ChromeOS and Flex have evolved? As always, there’s no one-size-fits-all answer — it’d just be great to learn how others are thinking about this for the year ahead.Update: Device Enrollment Limits - OU Level
Hi everyone, Back in November, we introduced the Device Enrollment Limits TT, designed to help admins better manage ChromeOS license consumption by setting enrollment caps at the Organizational Unit (OU) level. Since then, the feature has continued to evolve, so I wanted to share a quick update with what’s changed. A quick recap LimitOU (Device Enrollment Limits) allows IT Admins to set specific device enrollment caps at the Organizational Unit (OU) level. This prevents a single OU from exhausting the organization's total license pool. What’s new? Delegated admin support - Originally a Superadmin-only tool during the Q3 2025 Trusted Tester (TT) phase, the feature now supports delegated permissions. The Help Center for the TT has been updated accordingly. Granular control - Admins can now manage enrollment limits without requiring full system-wide administrative privileges. Allowlist Requirement: Due to the complexity of the Admin Console integration, the feature requires manual enablement for specific customer domains so members can just respond to the post and request to be added to this trusted tester if they wish. How to Apply Once more, if you are an administrator and would like to be included in this Trusted Tester program to try out Device Enrollment Limits and provide valuable feedback, please simply post a comment below to express your interest!
Join the ChromeOS Device Enrollment Limits TT
We are excited to announce an opportunity to join a new Trusted Tester program for a feature coming to ChromeOS that will help administrators manage device licensing more effectively: Device Enrollment Limits. What is the Feature? Currently, there is no easy way to prevent one team or organizational unit (OU) from consuming too many device licenses, which can leave other parts of your organization short. The ChromeOS TT for Device Enrollment Limits is designed to give you, as an administrator, more control over license consumption within your OUs. This pre-General Availability (GA) pilot will allow you to: Set specific enrollment limits per OU. Ensure fair access to licenses across your organization. Optimize resource allocation and prevent overconsumption. Once you request to be part of the TT (more details below) and we set you up for it, you'll find and manage this feature in the Google Admin Console under Devices > Chrome > Reports. For more information, head on over to our Product Hub for a Q&A blog post on this Trusted Tester. How to Apply If you are an administrator and would like to be included in this Trusted Tester program to try out Device Enrollment Limits and provide valuable feedback, please simply post a comment below to express your interest! We will reach out to you directly with the next steps.
Best practices for deploying WireGuard VPN across managed ChromeOS devices (system-wide or via Admin Console)
Hello, We currently manage a growing fleet of ChromeOS devices (Chromebooks and Chromeboxes) through our Google Workspace domain. All devices are enrolled, updated to the latest ChromeOS version, and centrally configured via the Admin Console. Our VPN of choice is WireGuard, which ChromeOS now supports natively. We followed Google’s official documentation to configure WireGuard per user: Configure VPNs on ChromeOS (Google Support) The challenge we are running into is scalability: configuring WireGuard individually on a per-user basis is becoming increasingly tedious as our organization grows. Ideally, we would like to achieve one of the following: - System-wide tunnel setup - Assign a WireGuard key per device, rather than per user. This would allow the VPN configuration to apply regardless of who logs into the machine. - Admin Console integration - Ability to push or preconfigure WireGuard VPN settings (similar to how Wi-Fi networks or other VPN types can be managed centrally). From what I understand, the Admin Console allows pushing some network settings, but WireGuard does not currently appear as a supported option. We also explored the possibility of using an Android VPN app as a workaround. However, the Android subsystem seems to create its own isolated IP pool, which breaks certain use cases for us — e.g., we need internal VPN IP addresses for DNS resolution and internal resource access, which doesn’t work properly when tunneled through the Android environment. So my questions are: Is there currently any way to enforce or distribute WireGuard VPN configurations via the Admin Console? If not, is there a recommended workaround to achieve system-wide VPN coverage (device-level rather than user-level)? More generally, what is the best practice for deploying WireGuard in centrally-managed ChromeOS environments today? I realize WireGuard support on ChromeOS is still relatively new and limited to certain devices, but we’ve been using it successfully with most of our devices. We’re just looking for the most scalable and officially supported way to roll this out across our managed devices. Thanks in advance for any insights!New user guides: ChromeOS policies
Hey everyone, Just wanted to let you know we've published two new articles in the User Guide section of the community, designed to help you master ChromeOS policies! These new guides dive deep into the specific steps for applying policies across your fleet: Setting ChromeOS device policies: Learn how to configure policies that apply to your managed ChromeOS devices, regardless of who is signed in. Setting ChromeOS user and browser policies: Get the details on configuring policies that apply to specific users when they sign in, as well as policies for the Chrome browser across different operating systems. All comments and feedback are welcome! Please let us know if these guides help streamline your policy setup. What other ChromeOS topics would you like to see covered in our next user guides?
