I85PREP
⌘ K
ChromeOS Administrator study materials
ChromeOS Administrator study resources

ChromeOS Administrator: User, Identity, and Policy Management

ChromeOS Administrator · Work through your exam, one topic at a time.

All guide sections

User, Identity, and Policy Management

What this domain tests

This domain tests how Google Workspace identity, organizational units, groups, admin roles, and authentication controls determine what a user can access on ChromeOS and in Google services. Expect policy inheritance, SSO, two-step verification, and user lifecycle questions.

Core rules

  • The Admin console OU tree is the primary policy boundary. Settings inherit from parent to child; child OU settings override parent settings. Moving a user changes effective policy after propagation.
  • Identity can come from Google Workspace accounts, SAML SSO, or a third-party IdP. SSO profiles are assigned to OUs and affect sign-in; they do not grant Admin console privileges.
  • Admin roles include super admin, delegated admin, and custom roles. Apply least privilege. Reserve super admin for break-glass use and audit admin activity.
  • User lifecycle states differ: suspend blocks sign-in but retains data; archive supports retention for former employees; delete is irreversible after retention. Transfer Drive data before deletion.
  • Enforce 2SV and prefer security keys for high-risk roles. Context-aware access uses access levels based on user, device, and IP signals to gate Workspace apps.
  • Groups can target some settings and access, but membership changes can take time to propagate. Managed guest sessions and kiosks are device-level identities, not normal user accounts.

Worked example

A contractor needs Drive but not Gmail. Create a Contractors OU, disable Gmail, enable Drive, enforce 2SV, and apply a context-aware access level requiring a managed ChromeOS device. Place the contractor in that OU. When the contract ends, suspend the account; do not delete until Drive data is transferred. Why it works: OU inheritance applies the app restrictions, context-aware access adds device trust, and suspension preserves data while blocking sign-in.

Traps that cost marks

  • Confusing suspend, archive, and delete, then losing data or leaving access open.
  • Assuming SSO automatically grants admin rights or removes the need for Admin console roles.
  • Using a super admin account for daily work.
  • Moving a user between OUs and expecting old policies to persist.
  • Forgetting group sync delay when a policy is group-targeted.
  • Overlooking that a child OU override can defeat a parent-level restriction.