Restrict primary accounts in Google Chrome for Mac

The following document helps IT administrators restrict primary accounts on Google Chrome for Mac by specifying which Google accounts can be set as the browser’s primary accounts.

Primary accounts in Chrome are the Google Accounts chosen during the Sync opt-in flow. The primary account syncs browsing data, such as bookmarks, browsing history, settings, open tabs, passwords, payment information, saved addresses, phone numbers, and more. When a user logs into their Google Account in Chrome, their browser data is synced with any device where they are logged in with the same Google Account, providing a unified user experience. To protect browsing data on organizational devices, Chrome browsers on macOS devices can limit data synchronization to specific domains using a configuration profile. This means only Google Accounts associated with the specified domain can sync their browsing data, ensuring a controlled synchronization experience within the browser ecosystem.
With the help of Hexnode UEM, you can remotely restrict primary accounts on Chrome browsers to the specified domains for multiple macOS devices by deploying a configuration profile.

Restrict primary accounts to allowed domains

To restrict primary accounts on Google’s Chrome browser to a set of specified domains using the following configuration profile, the Chrome browser on the user’s devices must be managed by the organization. Refer enroll cloud-managed Chrome browsers for more info.

Sample configuration profile

The following sample configuration profile can restrict synchronization of browsing data on managed Chrome browsers for all the accounts with usernames matching the pattern “maxiclouddb.com” domain.

The above configuration profile uses the RestrictSigninToPattern key to set “maxiclouddb.com” as an authorized domain for the primary accounts in the managed Chrome browser.

The input format for the RestrictSigninToPattern key follows a specific structure. For instance, if the domain name is itletters24.com, the input for the key should be provided as *@itletters24.com. This configuration ensures that only Google Accounts associated with the specified domain can sync data to the browser on the device.

What happens at the device end?

Once the custom configuration profile is installed on the macOS device, the option to sync data will be turned off for all currently signed-in accounts in the managed Chrome browser. The option to turn on sync data will only be available for accounts associated with the specified domain. If an unauthorized account attempts to sync data, an error message stating that the organization does not allow that account to synchronize data on the device will be displayed, as shown in the image below.