This post assumes you know how to create an application deployment and Configuration profile in Intune.

Deploying Google Chrome

We’ve got two main (in my opinion, excluding third parties like PMPC) options for deploying the application from Intune.

• MSI: Manually download and package the Google Chrome Enterprise MSI from here. This option lets you manage everything about the deployment, custom install commands/scripts, versioning etc. Good option for more control.
• Enterprise App Catalog: I’d recommend this option. Microsoft manages the app packaging and updates, which just leaves you to manage the group assignments. Plus the apps are going to work with Autopilot without any magic sauce on your part.

If you go with the MSI route for more flexibility. I would strongly advise adding to the install and uninstall commands (that Intune will often generate for you with MSIs) the logging switch. Makes troubleshooting much easier.

# Install Command
msiexec /i "GoogleChromeStandaloneEnterprise64.msi" /quiet /norestart L*V "C:\Windows\Temp\Chrome_Install.log"

# Uninstal Command
msiexec /i "GoogleChromeStandaloneEnterprise64.msi" /quiet /norestart L*V "C:\Windows\Temp\Chrome_Uninstall.log"

Testing Chrome Policies Locally

Intune takes its time with deploying these kinds of things, so being able to test policy settings yourself straight away is a major boon.

Checking Deployment Policies

Intune writes Chrome polices directly to the registry, so you can check them by using Regedit, PowerShell or directly in the Chrome browser.

Registry locations:

Device policies: HKLM:\SOFTWARE\Policies\Google\Chrome User policies: HKCU:\SOFTWARE\Policies\Google\Chrome

Using PowerShell:

# Device policies
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Chrome'

# User policies
Get-ItemProperty 'HKCU:\SOFTWARE\Policies\Google\Chrome'

In the Chrome Browser:

Open Chrome and navigate to chrome://policy to view the applied policies.

Adding and Removing Settings

This is purely for testing, I would not suggest deploying the policy settings like this.

You can do this within Regedit or PowerShell, I don’t think you can do it from the browser.

I’d suggest navigating to chrome://policy in Chrome, then check the box to show policies without a value in the top right. Then you can click on the policy name to open a page about that setting and it’s accepted values.

Once you know what you want to add, you can open Regedit and add the key or use the PowerShell command below:

Below I’m disabling incognito mode as an example.

$PolicyPath = 'HKLM:\SOFTWARE\Policies\Google\Chrome'

# Set policy
Set-ItemProperty -Path $PolicyPath -Name 'IncognitoModeAvailability' -Value 1 -Type DWord

# Remove policy (return to default)
Remove-ItemProperty -Path $PolicyPath -Name 'IncognitoModeAvailability' -ErrorAction SilentlyContinue

When you’re ready, head over to Intune and create a new configuration profile to apply the settings you’ve tested.