As an admin, you can use the Google Admin console to set up Chrome profiles so users can sign into Chrome browser with their third-party credentials—such as Microsoft Entra ID—on any Windows, Mac, or Linux computer. Note : To create an OpenID Connect (OIDC) app you must have a Microsoft Azure account with an Application Administrator or Cloud Application Administrator role. 1. Register the OIDC app In the Microsoft Azure portal, go to the Microsoft Entra ID service . On the left, select App registrations New registration . On the app registration page, enter the following: Give the application an appropriate name, like Chrome Profile Enrollment . For Supported account type , choose the directory type that best suits your current organization. For Redirect URI , leave this blank. Click Register . After the application is created, the application registration’s configuration page will open. Note: If the configuration page does not open, you can navigate to it by going to the Microsoft Entra ID home page , selecting App registrations All applications and then selecting the application you just created. Give the application an appropriate name, like Chrome Profile Enrollment . For Supported account type , choose the directory type that best suits your current organization. For Redirect URI , leave this blank. Click Register . After the application is created, the application registration’s configuration page will open. Note: If the configuration page does not open, you can navigate to it by going to the Microsoft Entra ID home page , selecting App registrations All applications and then selecting the application you just created. From the Overview page, copy the Application (client) ID and Directory (tenant) ID to use in later steps. 2. Configure authentication and redirect URIs Still on the app’s Overview page: Go to Manage Authentication Platform configurations . Click Add a platform . Enter this Redirect URI : https://chromeenterprise.google/profile-enrollment/register-handler Click Configure or Save. 3. Generate the client secret Still on the app’s Overview page: Go to Manage Certificates & secrets . On the Client secrets tab, click + New client secret . Enter a relevant description, like Chrome Enrollment App Secret . Select an appropriate expiration period—for example, 6 months or 1 year—and plan for rotation. Important : To prevent outages, contact the relevant admins and notify them of this expiration date. Important : To prevent outages, contact the relevant admins and notify them of this expiration date. Click Add and copy the client secret value for use in later steps. Important : This value only displays once and can't be retrieved later, so store it securely. Important : This value only displays once and can't be retrieved later, so store it securely. 4. Identify the issuer URL Still on the app’s Overview page: Go to Manage Endpoints . Find OpenID Connect metadata document and copy this URI for use in later steps. Note : The URI is the Issuer URL that you will use for the Universal Enrollment connector setup in the Google Admin console. For this, you only need the base URL for the connector—for example, https://login.microsoftonline.com/{tenant-id}/v2.0 . Note : The URI is the Issuer URL that you will use for the Universal Enrollment connector setup in the Google Admin console. For this, you only need the base URL for the connector—for example, https://login.microsoftonline.com/{tenant-id}/v2.0 . 5. Configure claims for email and enrollment token Still on the app’s Overview page, for standard email claim: Go to Manage Token configuration . Click + Add optional claim . Select ID as the token type. Select the optional claims that best suit your user attributes. For example, email , preferred_username , upn , and so on. Note : If prompted, enable the Microsoft Graph email permission. Note : If prompted, enable the Microsoft Graph email permission. Note : You must be a super admin to add new provider configurations. For details about the super admin role, see Pre-built administrator roles . Sign in with an administrator account to the Google Admin console. If you aren’t using an administrator account, you can’t access the Admin console. If you aren’t using an administrator account, you can’t access the Admin console. Go to Menu Chrome browser > Connectors . Requires having the Chrome administrator privilege . Requires having the Chrome administrator privilege . (Optional) If you’re configuring Chrome Enterprise connectors settings for the first time, follow the prompts to turn on Chrome Enterprise Connectors. At the top, click New provider configuration . In the panel that appears on the right, select the Universal Enrollment connector. Enter the configuration details using the values recorded in Step 1: Create an OIDC app in Microsoft Entra ID . Configuration name: Enter a descriptive name. Client ID: Enter the Application (client) ID you copied when registering the OIDC app. Client secret: Enter the value that you copied when generating the client secret. Issuer URL: Enter the base URL you copied when identifying the Issuer URL. For example, https://login.microsoftonline.com/{tenant-id}/v2.0 . Email claim name: Enter the preferred unique user attribute. For example, email , preferred_username , upn , and so on. Enrollment Token claim name: Enter roles. Configuration name: Enter a descriptive name.

Client ID: Enter the Application (client) ID you copied when registering the OIDC app. Client secret: Enter the value that you copied when generating the client secret. Issuer URL: Enter the base URL you copied when identifying the Issuer URL. For example, https://login.microsoftonline.com/{tenant-id}/v2.0 . Email claim name: Enter the preferred unique user attribute. For example, email , preferred_username , upn , and so on. Enrollment Token claim name: Enter roles. After validation is completed, click Add configuration . Still in the Google Admin console: Generate an enrollment token. See Generate enrollment token . Copy the token to use in the next step. Return to the Microsoft Azure portal . Go to App registrations Microsoft Entra ID App registration . On the app Overview page, go to Manage App roles . Click Create app role . Fill in the values as follows: Display name and Description: Enter a descriptive name for enrollment. Value : Enter the enrollment token you copied from the Admin console in Step 3: Generate an enrollment token . Click Enable to validate the app role. Display name and Description: Enter a descriptive name for enrollment. Value : Enter the enrollment token you copied from the Admin console in Step 3: Generate an enrollment token . Click Enable to validate the app role. Click Apply or Save . From the homepage, go to Enterprise Applications . Select your Registered Enrollment Application : Assign users and groups. Add user/group. Select the necessary user or groups for enrollment. Either Microsoft 365 or Security groups are ok. Assign users and groups. Add user/group. Select the necessary user or groups for enrollment. Either Microsoft 365 or Security groups are ok. Click Select to confirm and then click Assign . Return to the Google Admin console Go to Menu Chrome browser > Connectors . Requires having the Chrome administrator privilege . Requires having the Chrome administrator privilege . Select your identity-based enrollment connector. From the Details side panel, copy the enrollment URL. Open Chrome browser (version 134 or later). Navigate to the enrollment URL. This will redirect you to your IdP sign-in page. Accept the profile creation when Chrome prompts for consent. After configuration is complete, share the URL with your users so that they can create profiles on their own. You can enforce the usage of Chrome Work Profile by creating access policies in Microsoft Conditional Access. Your enterprise resources will only be accessible from profiles managed by your organization. For more details, see Configure Chrome browser to provision its own client certificate . Return to the Microsoft Azure portal . Go to Manage Authentication Platform configurations . Click Add a platform . In the Implicit grant and hybrid flows section, check Access token and ID token , then click Save . On the left, open API permissions . Select Add a permission , then select the Microsoft Graph API . Select Delegated permissions and choose the email , openid and profile permissions. Make sure the default User.Read permission is still enabled. Click Add permissions . On the left, click Token configuration . Select Add optional claim . For token type, select ID . and select the auth_time and upn claims. Click Add . In the Implicit grant and hybrid flows section, check Access token and ID token , then click Save . On the left, open API permissions . Select Add a permission , then select the Microsoft Graph API . Select Delegated permissions and choose the email , openid and profile permissions. Make sure the default User.Read permission is still enabled. Click Add permissions . Select Delegated permissions and choose the email , openid and profile permissions. Make sure the default User.Read permission is still enabled. Click Add permissions . On the left, click Token configuration . Select Add optional claim . For token type, select ID . and select the auth_time and upn claims. Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated. Was this helpful? Need more help? Try these next steps: