# Chrome integration with MDM using G Suite ## Pre-requisites: 1. To manage Chrome OS devices in MDM, you need to have either **Enterprise Standard** or **Enterprise Plus** or **Education Plus (for schools/universities)** Google workspace license. 2. Verify the Workspace Admins licenses in the [Google Admin Console](https://support.google.com/a/answer/33387?hl=en) under **Billing > Subscriptions**. 3. To **Purchase or Upgrade** the licence, follow [Google’s official licensing guide](https://admin.google.com). These licenses enable MDM integration for bulk enrollment, policy enforcement, security controls, and auto-syncing, so Chromebooks added in Google Admin instantly reflect in the MDM Console. ## Procedure - [Step #1: Configure Google Admin Console](#step-1-configure-google-admin-console) - [Step #2: Integrate with MDM](#step-2-integrate-with-mdm) ### Step #1: Configure Google Admin Console - Login to the [Google Admin Console](https://admin.google.com) with your admin credentials and select **Devices**. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chromebook_mdm_1.png) - If the Chrome device has not been added previously, click on **Start Trial** under the **Chrome Devices** option. Once enrolled in the trial, navigate back to the devices page. - Select **Chrome -> Apps & extensions -> Users & browsers** from the left pane. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chromebook_mdm_2.png) - Click on **Settings** from the dropdown menu. Under **User & Browser settings**, navigate to **Chrome Management - Partner Access**. - Select **Enable Chrome Management - Partner Access** and agree to the given Terms and Conditions. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chromebook_mdm_5.png) ![ ](https://www.manageengine.com/mobile-device-management/help/images/chromebook_mdm_7.png) - Click on **Save** to save the user settings. - Click on **Device Settings** and navigate to **Chrome Management - Partner Access**. - Select **Enable Chrome Management - Partner Access** and agree to the given terms and conditions. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chromebook_mdm_6.png) - Click on **Save** to save the device settings. - To enable **Chrome Policy API**, login to the [Google Cloud Console](https://console.cloud.google.com/) using your admin account. - Go to **API & Services > Library**. - In the search bar, type **Chrome Policy API** to check if it is enabled. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome-policy-api.png) - In the search bar, type **Admin SDK API** to check if it is enabled. ![ ](https://www.manageengine.com/mobile-device-management/help/images/admin-sdk-api.png) ### Step #2: Integrate with MDM - On the MDM server, click on the **Enrollment** tab from the top menu and select **Chromebook Enrollment**, present under **Chrome OS**. - If you've already integrated G Suite in Android Enterprise you can go directly to step 3. If not, click on **Configure Now** and provide the **domain** registered with G Suite as well as the **domain admin account**. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_configuregspace.png) - In case of MDM On-Premise, if OAuth is not configured, you will get an error message saying **"OAuth App details are not yet configured".** - Click on **here** to configure OAuth. You will be prompted to enter the Client ID and Client Secret. [How to obtain Client ID and Client Secret?](https://mecms.manageengine.com/manageengine/mobile-device-management/help/enrollment/integrate_gsuite_mdm_chromebooks.html#How%20to%20obtain%20Client%20ID%20and%20Client%20Secret) - Once you have entered the Client ID and Client Secret, click on **Integrate** to complete Chrome integration using G Suite. You can now enroll Chromebooks using MDM. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_integrate.png) **Note:** After integration, all the org units and users will be synced from the Google Admin Console and will be displayed in our MDM server. ## How to obtain Client ID and Client Secret - Log in to the [Google Console](https://console.cloud.google.com/) with your G Suite admin account. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_1.png) - Click on **Select Project -> New Project** and enter the required details. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_2.png) - Navigate to **APIs & services -> Credentials -> Create Credentials -> OAuth Client ID**. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_3.png) ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_4.png) - If you are configuring OAuth Authentication for the first time, you have to set up your **OAuth Consent Screen**. - On the left panel, click on **OAuth Consent Screen**, and choose the User Type as **Internal**. - Click on **Create**. - Enter the app name, support email, and developer contact information, then click on **Save and Continue**. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_9.png) - Navigate to **APIs & services -> Credentials -> Create Credentials -> OAuth Client ID**. - Select **Web Application** as the Application type. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_5.png) - Enter **https://www.manageengine.com/ems/OAuthAuthorization.html** as Authorized redirect URIs and click on **Create**. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_6.png) ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_7.png) - A new set of **Client ID and Client Secret** will be generated. Copy and paste them back on the MDM server. ![ ](https://www.manageengine.com/mobile-device-management/help/images/chrome_enrollment_8.png) - Once you have entered the Client ID and Client Secret, click on **Integrate**. Now the OAuth will be successfully configured on the MDM server. ## Troubleshooting tips ### Unable to see the Device management options Confirm your license tier supports Chrome OS management (e.g., upgrade to Enterprise Standard). ### Unable to apply policies Check if the Chromebook’s organizational unit (OU) has the correct license assigned. ### Unable to Integrate G Suite with MDM If you are unable to integrate G Suite with MDM, follow the steps mentioned below: 1. Sign in to the account which is already integrated and remove the access. 2. Go to this [page](https://myaccount.google.com/permissions) and log in to the account. 3. In case of MDM Cloud, select **Manageengine MDM** and for On-Premise, select the app name which you have created on the Google Admin Console. Now click on **Remove access**. ![ ](https://www.manageengine.com/mobile-device-management/images/faq_GW_int.png) Now the G Suite will get successfully integrated with MDM.