Google Workspace Endpoint Management: Chrome, Android, and iOS Policy Guide

Endpoint management in Google Workspace gives IT admins control over the devices that access your organization’s data: Android phones, iPhones, Windows and Mac computers, and Chromebooks. Without endpoint controls, any device can open Gmail and Drive, whether or not it’s encrypted, patched, or lost in a taxi.

This guide covers which management level your edition includes, how to set up Android, iOS, Windows, Chrome browser, and ChromeOS management, endpoint verification and Context-Aware Access, device approvals and remote actions, and a recommended baseline.

---

Management Levels by Edition

Google endpoint management comes in three feature sets. Licensing is per user, not per device.

Context-Aware Access (covered below) is available only in Enterprise Standard and Plus, Frontline Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus, and Cloud Identity Premium, not Business editions.

Choosing basic or advanced

---

Turning On Management

Admin Console → Devices → Mobile & endpoints → Settings → Universal settings → General → Mobile management

Choose Basic, Advanced, or Custom (different levels for different platforms) for each organizational unit. Advanced management requires users to install management software or profiles, so announce it before switching it on.

---

Android Management

Work profile for personal devices

On personal (BYOD) Android phones, a work profile keeps work apps and data separate and encrypted. IT manages only the work profile; personal apps, photos, and messages stay private.

Admin Console → Devices → Mobile & endpoints → Settings → Android → Work profile → Work Profile Setup:

• User opt-in: users choose whether to create a work profile
• Enforce: users must create a work profile to sync work data
• Disable: no work profiles

For most organizations, Enforce on BYOD Android devices is the right default.

The management app

Current Android devices are managed with the Android Device Policy app; some older devices use the legacy Google Apps Device Policy app. Users are prompted to install it when they add their work account.

Key Android settings

The Android settings page groups policies into sections:

Password requirements are set separately under the mobile password settings.

Managing Android apps

Use Web and mobile apps to publish approved apps from managed Google Play, push required apps to the work profile, and block unapproved ones. Private apps and web apps can also be distributed to work profiles.

---

iOS Management

Basic management

With basic management, iPhones and iPads that sync work accounts can be required to use a passcode, and admins can remove the work account remotely.

Advanced management

1. Turn on advanced management for the OU
2. Set up an Apple push certificate in the Admin console (this links Google endpoint management to Apple’s push service; renew it yearly)
3. Users install the Google Device Policy app and its configuration profile when they add their account

Advanced management adds iOS app management for public apps, managed Wi-Fi and VPN configuration, and device-level controls. For company-owned iPhones, the Enterprise feature set adds company-owned device management and private iOS apps, and Apple Business Manager integration enables automated enrollment.

Renew the Apple push certificate on time. If it expires, managed iOS devices stop receiving policy updates and you may need to re-enroll them.

---

Windows and Mac Computers

Windows

• Google Credential Provider for Windows (GCPW) (Fundamental) lets users sign in to Windows 10/11 with their Workspace account
• Windows device management (Advanced) pushes Windows settings such as BitLocker and Windows updates from the Admin console, and supports remote wipe

Chrome browser on any computer

Chrome Enterprise Core (formerly Chrome Browser Cloud Management) applies policies to Chrome on Windows, Mac, and Linux. Enroll browsers with an enrollment token, or apply user policies when people sign in to Chrome with their Workspace account:

Admin Console → Devices → Chrome → Settings → Users & browsers

Use it to force-install or block extensions, require Safe Browsing, manage updates, block risky sites, and control password manager and download behavior, even on devices you don’t otherwise manage.

Endpoint verification

The Endpoint Verification Chrome extension reports device details such as OS version, encryption, screen lock, and whether the device is company-owned. It’s usually on by default, and you control it under Devices → Mobile & endpoints → Settings → Universal → Data access. Endpoint verification is what lets Context-Aware Access check the security of desktop devices.

---

ChromeOS Devices

Chromebooks are the most tightly managed endpoints in the Google ecosystem, but managing ChromeOS devices requires a Chrome Enterprise Upgrade (or Chrome Education Upgrade) license for each device in addition to Workspace.

Enrolling Chromebooks

• Manual: on the sign-in screen, before anyone signs in, press Ctrl + Alt + E and sign in with an account allowed to enroll devices
• Zero-touch enrollment: devices bought from participating resellers enroll automatically when first connected to the internet

Recommended ChromeOS device settings

Admin Console → Devices → Chrome → Settings → Device

---

Context-Aware Access

On supported editions, Context-Aware Access controls access to Workspace apps based on who the user is, where they are, and the security status of their device.

Access levels can use:

• IP address ranges (for example, office networks)
• Device policy and OS: encryption, screen lock, company-owned, OS version
• Geographic origin: the country of the request
• Custom attributes through advanced expressions

Device checks need software on the device: Chrome with the Endpoint Verification extension on desktops, and basic or advanced management on mobile. IP and location checks need nothing installed.

Example policy: allow Drive and Gmail on desktops only if the device is encrypted and has a screen lock; allow the Admin console only from company-owned devices.

Context-Aware Access is the Google Workspace counterpart to conditional access in Microsoft Entra ID. Start in monitor mode where available, review which users would be blocked, then enforce.

---

Device Approvals and Remote Actions

Device approvals (Advanced)

Require admin approval before a new mobile device can sync work data. It adds friction, so it’s best for high-risk OUs (executives, finance) or company-owned devices only.

Remote actions

Admin Console → Devices → Mobile & endpoints → Devices → select the device:

Confirm whether a device is personal or company-owned before wiping it completely.

---

Recommended Endpoint Baseline

Review the device inventory monthly: remove devices that haven’t synced in months, and follow up on devices reported as compromised or out of policy.

---

Rollout Plan

1. Week 1: turn on basic management for everyone and Endpoint Verification for desktops; communicate the change
2. Week 2: pilot advanced management with IT staff on Android and iOS, including the Apple push certificate
3. Weeks 3–4: roll out advanced management by department; enforce work profiles on BYOD Android
4. Weeks 5–6: add Chrome browser policies and, on supported editions, Context-Aware Access in monitor mode
5. Ongoing: move Context-Aware Access to enforcement once reports show few unintended blocks

---

Conclusion

Endpoint management is the boundary between a controlled Google Workspace environment and one where company data sits on any device. Start with basic management and Endpoint Verification for everyone, move to advanced management for work profiles and full device control, manage Chrome browsers everywhere, and use Context-Aware Access on supported editions to make app access depend on device security.

Chromebooks with Chrome Enterprise Upgrade offer the tightest control with the least effort: a strong option for teams that can standardize on ChromeOS.

---

Official Google documentation:

• Compare Google endpoint management feature sets
• Apply settings for Android mobile devices
• Protect your business with Context-Aware Access
• Chrome Enterprise Core guide
• Turn endpoint verification on or off

Related reading:

• Googlebook and Google Meet Hardware on Android: what Google’s ChromeOS-to-Android shift means for laptops and meeting rooms.
• Google Workspace Admin Security: 10-Point Hardening Guide: endpoint controls are a key hardening category.
• Google Workspace SSO: SAML Setup Guide: combine SSO with device checks for stronger sign-in security.
• Google Workspace Business Plans Comparison: advanced endpoint management features vary by plan.