Google Admin Console Settings: Best Practices for Education

The Google Admin console has many features and functionalities, which can seem daunting at first. As a certified Google partner, Promevo is here to help guide you through the best practices for using the Admin console in the educational setting. As an educational leader, it’s important to configure Google settings so students are protected and can safely use their devices for learning and collaboration.

If you need a quick refresher on getting started with the Google Admin console, check out our beginner’s guide.

User Settings

The first set of educational best practices for Admin console focuses on User settings. The User settings section of the Admin console allows you to manage user-based settings on the Chrome browser and Chrome devices

To navigate to User settings from the Admin console homepage, click Menu > Devices > Chrome > Settings > User and Browser.

Incognito Mode

This setting determines if students can use Incognito Mode on Chrome. Setting this policy to “Disallow Incognito Mode” prevents users from opening new incognito windows. We recommend disabling this so you can monitor student activity.


Incognito mode settings in the Google Admin Console user and browser settings


Browser History

This setting controls whether Chrome saves a student’s browsing history or if students can clear browser data, including their viewing and download history. We recommend updating the settings to save browser history and disabling clearing history so admins can ensure students stay on track. 


Browser history and clear browser history settings in the Google Admin Console


This setting decides whether websites can track a student’s physical location. We recommend denying geolocation so a student’s location is never shared or tracked. 


Geolocation setting in the Google Admin Console

External Storage Devices

This setting controls whether employees can use Chrome devices to transfer data to external drives, like USB flash drives, external hard drives, optical storage, Secure Digital (SD) cards, and other memory cards. If you set this policy to “Disallow external storage” and a user attempts to connect an external drive, Chrome notifies the user that the policy is in effect. Disabling external storage devices helps keep your organization’s data safe and secure.



External storage devices setting in the Google Admin Console

Safe Search and Restricted Mode

This setting specifies whether Google Safe Search or YouTube Restricted Mode is turned on for users. We recommend changing this setting to “Always Use Safe Search for Google Web Search Queries” and enforcing at least Moderate Restricted Mode or Strict Restricted Mode on Youtube. This protects students from accessing potentially harmful or inappropriate videos.  


SafeSearch and restricted mode setting in the Google Admin Console

URL Blocking

This setting prevents Chrome browsers from accessing specific URLs. To configure the policy, enter up to 1,000 URLs on separate lines. Each URL must have a valid hostname (such as, an IP address, or an asterisk (*) in place of the host. The asterisk is a wildcard, representing all hostnames and IP addresses. We recommend blacklisting inappropriate or distracting URLs, so students stay focused. For example, to block users from accessing Facebook, type in in the text box.



URL blocking setting in the Google Admin Console

Managed Bookmarks and Bookmark Bar

This setting allows you to push a preset list of bookmarks to users on Chrome on desktop and mobile devices. These bookmarks will appear in a folder on Chrome's bookmark bar. You may want to create bookmarks for your school’s online portal or websites your students use often. Promevo recommends enabling the bookmark bar and disabling bookmark editing so that students can’t delete or change the bookmarks you choose.



Bookmark settings in the Google Admin Console

Video Input

This setting specifies whether websites can access a built-in Chrome webcam. We recommend disabling video input so your students can’t use the webcam. However, this does not disable the webcam for Google Voice and video chat. 

Safe Browsing Protection Level

Available on Android devices, ChromeOS devices, iOS devices, and Chrome browser for Windows, Mac, and Linux. Safe Browsing Protection Level specifies whether Google Safe Browsing is turned on for users. Safe Browsing in Chrome helps protect users from websites that may contain malware or phishing content.

If you select Safe Browsing it’s active in the enhanced mode, it provides better security, but requires sharing more browsing information with Google. By default, allow user to decide is selected and users can turn on or off Safe Browsing. If you choose to activate Safe Browsing, users cannot change or override that setting in Google Chrome.

Apps & Extensions

To get to this section, select Menu > Devices > Chrome > Apps & Extensions > Users & Browsers.

By default, users can download any Chrome web app or extension they want. This setting allows you to block students and teachers from installing certain types of apps. Your admin can also choose which apps and extensions are force-installed. We recommend having the admin pick which specific apps and extensions they would like students and teachers to have access to and block the rest. For example, if a teacher wants to block students from using the preset calculator app during a test, an admin can do that here. Make sure to have your admin check the reviews on the extension before adding it because some extension makers will spam the user.

You can learn more about the different types of apps and extensions here: Extensions, Theme, Google Apps Script, Hosted App, Legacy Packaged App, and Chrome Packaged App.



Block all other apps and extensions setting in the Google Admin Console

Device Settings

The next set of education best practices for Admin console focuses on Device settings. To navigate to Device settings from the Admin console homepage, click Menu > Devices > Chrome > Settings > Device.

Forced Re-enrollment

Forced re-enrollment ties the device to your domain no matter what. By default, this is set to “Force device to re-enroll into this domain after wiping.” To turn this off, select “Device is not forced to re-enroll after wiping.” This prevents students from wiping the device and enrolling it into a new domain.



Forced re-enrollment setting in the Google Admin Console


Disabled Device Return Instructions

This setting controls the custom text on the disabled device screen. We recommend you include a return address and contact phone number in your message so that users who see this screen can return the device to your school.


Disabled device return instructions in the Google Admin Console

Guest Mode

This setting controls whether guest browsing is allowed on managed Chrome devices. If you select “Allow guest mode” (the default), the main sign-in screen lets a person sign in as a guest. If you select “Do not allow guest mode,” a user must sign in using a Google Account or Google Workspace account. When a user signs in using guest mode, your organization's policies are not applied, so we recommend turning this setting off.



Guest mode setting in the Google Admin Console

Restriction

This setting lets you control which users have permission to sign in to a managed Chrome device. The default “Restrict sign-in to list of users” is selected. If the textbox is empty, any user with a Google Account or Google Workspace account can sign in. However, if you include a list of usernames (domain email separated by commas) in the text box, only the named users can sign in. We recommend filling out the textbox with the wildcard * so that only users within your domain can sign in. This will restrict students from signing in with personal accounts.

User and Device Reporting

User and device reporting gives administrators insightful statistics about devices, data usage, Telemetry API and more.  It’s recommended that you enable all ChromeOS device information reporting to properly manage devices in your network.  Some functions of user device and reporting include:

  • Report device OS information - Provides information such as OS version, boot mode, and update status for enrolled ChromeOS devices.
  • Report device hardware information - Provides information such as product data, system information, and timezone status for enrolled ChromeOS devices.
  • Report device telemetry - Provides information about CPU, memory, storage, and graphics for enrolled ChromeOS devices.
  • Report device user tracking - States whether recent users of a ChromeOS device are tracked or not.
  • Inactive device reports - Detailed reports about inactive devices in your domain including total number of inactive devices, inactive date range, and detailed information about each device.
  • Anonymous metric reporting - States whether a ChromeOS device sends Google usage statistics and crash reports in the event of a system or browser failure. 

The Google Admin console keeps you in charge of your school’s digital domain. With these best practices for Admin console, you can quickly and effectively manage students’ accounts and devices, so they’re focused and protected. Then, your organization can focus on what matters most: learning and collaborating using intuitive technology.


Why Promevo?

At Promevo, we assist educators and schools as they work to implement Chromebooks and Google for Education tools. Our experts are committed to helping educators empower and enhance learning experiences with tools that work for everyone.

Not only does Promevo provide support for Google for Education, but we also offer a wide selection of Chrome devices so our clients can find what works best. We’re here to guide you through the purchasing process so you feel confident in making the best decision for students, educators, and everyone else.

Ready to get started? Browse our selection of Chrome devices today, or contact our team for help getting started with Google for Education.


Frequently Asked Questions

How do I access Google Admin?

To access the Google Admin console, go to Then, enter your admin username and password to sign in.

How do I change my Google Admin settings?

You must be signed in as a Super Admin in the Admin console to change administrator settings. Once you’re signed in, go to the Menu, then click “Account,” then “Admin roles.” From here, click the role you want to edit. You can choose from two options:

  • Click “Edit Role Info” to edit the name or description of the role.
  • Click “Privileges” to edit the privileges associated with this role.

Then, click “Save.”

Can Google Admin see a user password?

Google admins cannot see user passwords. However, some administrators do have the ability to delete, rename, or reset passwords.

How do I get Google Admin on my phone?

To set up the Google Admin app, you’ll need to enable API access for your organization by following these instructions. Then, install the Google Admin app from your app store. If you haven’t done so already, add your administrator account to your device:

  1. On your device, open Settings and find the Accounts section.
  2. Tap “Add account” and follow the instructions.