How to Configure Google Chrome SSO with Azure AD Using Microsoft Intune

First, you need to download the Chrome ADMX templates that contain the policy definitions for Chrome SSO configuration. These templates are essential for creating the SSO policy in Intune.

Navigate to the Chrome Enterprise website and locate the policy templates section. You'll need to accept the terms and download the following files:

• Google.admx and Google.adml
• Chrome.admx and Chrome.adml
• GoogleUpdate.admx and GoogleUpdate.adml

Download these files to a local folder on your administrative workstation. The ADMX files contain the policy definitions, while the ADML files contain the language-specific text for the policies.

Now you'll import the Chrome ADMX templates into Intune to make the Chrome policies available for configuration. This step is crucial because without importing these templates, the SSO policy options won't appear in Intune.

Open the Microsoft Intune admin center and navigate to:

Devices > Manage devices > Configuration > Import ADMX tab

Click + Import and upload each ADMX file along with its corresponding ADML file. You need to import them one by one:

1. Select Google.admx and Google.adml
2. Click Import and wait for completion
3. Repeat for Chrome.admx and Chrome.adml
4. Finally, import GoogleUpdate.admx and GoogleUpdate.adml

With the ADMX templates imported, you can now create a device configuration policy that will enable Chrome SSO with Entra ID. This policy will be deployed to your target devices.

In the Intune admin center, navigate to:

Devices > Manage devices > Configuration > Create > New policy

Configure the policy settings as follows:

• Platform: Windows 10 and later
• Profile type: Templates
• Template name: Imported Administrative templates

Click Create to proceed to the policy configuration wizard.

In the Basics tab, provide:

• Name: "Enable SSO for Chrome with Entra ID using Intune"
• Description: "Configures Chrome to automatically sign in users with their Entra ID credentials"

Click Next to continue to the configuration settings.

This is the core step where you'll configure the actual SSO setting that enables automatic sign-in to Microsoft cloud identity providers in Chrome.

In the Configuration settings tab, use the search function to locate the SSO policy:

Search: "Allow Automatic Sign"

Navigate to the policy location:

Computer Settings > Google Chrome > Microsoft® Active Directory® management settings

Find and select "Allow automatic sign-in to Microsoft® cloud identity providers"

Configure the policy as follows:

• Set the policy to Enabled
• In the dropdown, select "Enable Microsoft® cloud authentication"
• Click OK to save the setting

Click Next to proceed to scope tags configuration.

Now you'll assign the policy to the appropriate device groups and configure any necessary scope tags for your organization's management structure.

In the Scope tags section:

• Add scope tags if your organization uses them for role-based access control
• If you don't use scope tags, leave this section as default
• Click Next

In the Assignments section, configure the target devices:

• Click + Add groups under "Included groups"
• Select device groups containing Entra ID Joined devices
• Ensure the selected groups contain devices that meet the prerequisites

Review your assignments and click Next to proceed to the final review.

Complete the policy creation and monitor its deployment to ensure successful application across your target devices.

In the Review + create section:

• Review all policy settings for accuracy
• Verify the assignment scope matches your requirements
• Click Create to deploy the policy

Monitor the policy deployment:

Devices > Monitor > Device configuration > [Your Policy Name]

Check the deployment status and look for any devices showing "Error" or "Conflict" status. The policy typically takes 15-30 minutes to apply to devices after creation.

After the policy has been applied, verify that Chrome is properly configured for SSO on your target devices. This verification ensures the policy is working correctly.

On a target device, open Google Chrome and navigate to:

chrome://policy

Look for the following policy in the list:

• Policy name: CloudAPAuthEnabled
• Value: 1 (or true)
• Status: OK

Additionally, check the Windows Event Viewer for confirmation:

Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin

Look for Event ID 814 with the message containing:

CloudAPAuthEnabled value="1"

The final step is to test the SSO functionality to ensure users can seamlessly access Microsoft cloud services through Chrome without additional authentication prompts.

To test SSO functionality:

1. Ensure the user has a work or school account added to Windows (Settings > Accounts > Access work or school)
2. Open Chrome and navigate to a Microsoft cloud service like:

https://portal.office.com
https://portal.azure.com
https://admin.microsoft.com

The user should be automatically signed in without being prompted for credentials. If prompted, the SSO configuration may not be working correctly.

Troubleshooting common issues:

• Still prompted for credentials: Verify the device is properly Entra ID joined and the user account is synchronized
• Policy not applying: Check device enrollment status in Intune and ensure Chrome is updated to the latest version
• CloudAPAuthEnabled not showing: Verify ADMX templates were imported correctly and the policy was assigned to the correct device groups