Why is Chrome sign-in blocked on managed devices?

Skie for Enterprise · Updated

Short answer

Skie blocks signing in to Chrome so a student cannot attach a personal Google profile to the browser, which would bring its own settings and history. The block is on by default for managed Chrome. Browsing continues normally, just without a signed-in profile.

When someone signs in to Chrome, the browser can pull in that account's preferences, extensions and sync data. On a shared or school-owned device this blurs who controls the browser. A personal profile can also carry settings the school did not choose.

Skie disables Chrome sign-in with a device owner policy on Chrome stable, beta, dev and canary. The sign-in prompt does not appear. This does not touch Google Play: apps still come from the Play Store under the organisation's allow list.

The block is also a practical safeguard against data leaving the device. Together with sync disabled, passwords, bookmarks and history are not shared to a personal account. The child's personal data stays on their own accounts and the school's data stays on school devices.

A device must be freshly set up or reset to become managed, and any Google account has to be removed first, because Android only allows device-owner management on a device that has not been set up. So a managed device does not carry the student's old accounts to begin with.

If a teacher asks whether students can use their own Google account in the browser for school work, the answer is no. Use the school's learning apps from the app list instead.