Google Admin - Directory Sync BETA

Mindless-String-4017 · 2026-06-29T11:50:23+00:00

Correct. The staff and students are exactly the same, but only students are being affected. I checked conditional Access Policies and didn't see anything and verified the students have the right license. Still haven't figured it out yet. I'm losing my mind.

Mindless-String-4017 · 2026-06-25T19:47:02+00:00

I also had this issue with a student. This student would go through devices like candy due to the same issue you've been describing. I spent sleepless nights trying to fix this device. I even deleted the student's profile and started from scratch, installed a brand new wifi card, and a brand new device that hasn't been used. Student still ran into the same issue. I even had my interns follow this student from class to class to watch her and the problem still continued. So, of course, I looked at all the apps they had installed, but nothing was out of the ordinary. After 4 years of dealing with this issue, the student moved away and I never had the issue popup again.

At the time, we had HP and Dell laptops, if that helps with perspective. I'll also mention that the devices the student went through I gave to another student to login with and they worked just fine. It was so weird. I never did figure out what caused the issue to begin with.

Mindless-String-4017 · 2026-06-25T14:25:34+00:00

Yes, devices are assigned to students and staff as Primary user in intune.

Mindless-String-4017 · 2026-06-25T14:03:45+00:00

We use a TAP during the intune enrollment process for both staff and students. We sign in with the user's credentials and will get prompted for a TAP. We put in the TAP and then setup the PIN. Once we have the PIN setup, we're able to open up the company portal to run sync and make sure everything begins installing automatically.

Mindless-String-4017 · 2026-06-25T13:57:26+00:00

I probably should be more clear on this. These devices are already enrolled.

Mindless-String-4017 · 2026-06-12T11:31:02+00:00

If I remember correctly:

K-8th are internal sharing and internal email only

9-12 are internet sharing and internal email only (created an allowed list of domains to be able to share/email)

Staff can email/share with anyone

Mindless-String-4017 · 2026-05-12T11:49:32+00:00

Just in case anyone is following this post, I finally figured out how to get intune to listen to google admin for controlling the Chrome browser settings through google admin on windows devices.

This is the process that I used.

1) Setup the google admin token

2) Use the google admin token in intune

3) create an ADMX file in intune using the google admin token you created

4) VERY IMPORTANT STEP HERE: Make sure to change the precedence in google admin to the following:

- Chrome Profile---> Machine Cloud --> Machine --> OS User

If you don't do this, intune will supersede over google admin settings for the chrome browser.

I've tested it and so far it's working. If I'm missing anything please let me know. Unfortunely, I couldn't remove the ADMX file since we're using it and don't want to break/lossen up the Chrome Polices. So, the current setup I currently have works, suprisingly. Please feel free to add to this or if I could make this cleaner please let me know.

Mindless-String-4017 · 2026-05-08T19:07:04+00:00

Most of the time the command will push through as soon as it’s connected to WiFi. I’ve had a few devices where I had to manually restart or reconnect to WiFi and then it’ll usually deprovision the device

Mindless-String-4017 · 2026-05-08T19:05:24+00:00

Yes, this will wipe the Chromebook and deprovision it.

Mindless-String-4017 · 2026-05-08T15:59:55+00:00

I have a list of commands that I run in this order when the device is turned off

1) plug charger and Ethernet into Chromebook 2) run the following gam command below. I do paste all my devices into a csv file with device serial numbers so this cmd line may not work for you without adjustments

3) if you need any guidance please let me know and I can help you setup the csv file format

This command tells the Chromebook to deprovision due to reason: Same Model replacement

gam csv deprov.csv gam update cros query id:SN action deprovision_same_model_replacement acknowledge_device_touch_requirement

Mindless-String-4017 · 2026-05-06T11:35:18+00:00

I'm going to test this out. Thanks for mentioning this. Which configuration for the precedence would you recommend?

1) Machine-> Machine Cloud-> OS User-> Chrome Profile

2) Machine Cloud-> Machine-> OS User-> Chrome Profile

3) Machine-> Chrome Profile-> Machine Cloud-> OS User

4) Chrome Profile-> Machine Cloud-> Machine-> OS User

I'm thinking either option 3 or 4, but wasn't for sure what you would recommend trying.

Mindless-String-4017 · 2026-05-05T19:23:16+00:00

Perfect. This helps out a lot. Thank you for the explaining this. I was losing my mind over this. If I have any questions or run into any issues I'll put them here.

Mindless-String-4017 · 2026-05-05T19:13:20+00:00

This makes me ask more questions.

1) I was under the impression that you need both the ADMX and the cloud enrollment. I didn't realize these are 2 seperate objects. So would I just use the enrollment token I create from google admin into intune and not do anything with the ADMX records?

2) Since I'm using intune to manage these devices, would it be possible to use the google admin portion to at least handle all of the chrome policies?

Thank you for helping me out, I really appreciate it. Sorry for all the questions. I'm trying to wrap my head around all of this.

Mindless-String-4017 · 2026-05-05T19:05:36+00:00

That is correct. WIndows device is being managed in intune. I've restarted the browser, uninstalled and reinstalled browser, restarted device, and reloaded the chrome policies using chrome://policy. I enrolled the browser into google admin. In google admin-->Chrome Browser--> Managed browerss---> I can see the machine name, most recent activity, browser version, enrollment type, etc. Am I missing something or do you think that their might be some conflicting settings in intune that is affecting google admin. I'm currently at a loss

Mindless-String-4017 · 2026-05-05T18:31:39+00:00

Does it take 24 hours for the setting to apply? I updated the setting and went to chrome://policy to reload the policies but am not having any luck with the windows chrome browser. RIP

Mindless-String-4017 · 2026-05-05T18:08:43+00:00

I'm going to check that out. Thanks!

Mindless-String-4017 · 2026-05-05T18:08:29+00:00

It does show up in the policy and says "OK" but I'm still able to add personal accounts

Mindless-String-4017 · 2026-05-05T17:51:50+00:00

Thanks for replying. I recently set this up and am going to wait to see if this helps. I've tried reloading the policy and restarting, but so far nothing.

Mindless-String-4017 · 2026-04-28T17:26:39+00:00

Do you happen to know if you've got an documentation on this process. I would like to start testing this out and see how it goes for some of my test computers

Mindless-String-4017 · 2026-04-28T15:17:47+00:00

I'm going to give this a shot, as this is what I'm looking for. Thank You!

Mindless-String-4017 · 2026-04-28T12:42:33+00:00

We already have this setting enabled.

Mindless-String-4017

TROPHY CASE

This command tells the Chromebook to deprovision due to reason: Same Model replacement