Chrome Enterprise

Chromebook management, through the Google Admin SDK rather than a dedicated MDM product.

Chromebooks are most of the fleet in a great many primary schools, and without this connector those schools could log a repair against a serial number and get nothing back: no model, no assigned user, no enrolment state.


Category	MDM
Authentication	Service account with domain-wide delegation
Reaches	`oauth2.googleapis.com`, `admin.googleapis.com`
Needs an agent	No
Demo mode	Yes

Capabilities

device.lookupBySerial, device.get, device.listForUser, device.searchSerial, device.sendCommand

Creating the service account

This is the same authentication flow as Google Workspace and Google Sheets. If you have already done it for one of those, you can reuse the service account and only need to add the scope.

Google Cloud console, in a project for your school.
IAM and Admin, Service Accounts, Create service account.
- Name it plugboard.
- No project roles are needed.
Open the service account, then Keys, Add key, Create new key, JSON. Download it. You need two values from inside: client_email and private_key.
On the service account’s Details page, copy the Unique ID (a long number). This is the client id for delegation.

Granting domain-wide delegation

Google Admin console, Security, Access and data control, API controls, Domain-wide delegation, Add new.
Client ID: the Unique ID from step 4.

OAuth scopes: add the read-only scope, and the read-write scope only if you want device actions.

https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly

https://www.googleapis.com/auth/admin.directory.device.chromeos

Authorise.

The scope is read-only by default. Disabling or powerwashing a device needs the read-write scope, and a school that has not granted it gets a clear refusal rather than a confusing Google error about insufficient permission.

Configuring it in Plugboard

Admin, Connectors, Chrome Enterprise, Configure.

Settings

Field	Default	Value
`customerId`	`my_customer`	`my_customer` resolves to the account the service account belongs to. Leave it unless you have a reason
`adminEmail`	empty	An administrator to impersonate. Domain-wide delegation acts as this person
`allowDeviceActions`	`false`	Allow disabling and powerwashing. Needs the read-write scope granted above
`demoMode`	`false`	Return fixture data

adminEmail matters. Delegation means the service account acts as somebody, and that somebody needs the rights in the Admin console. Use a dedicated administrator account instead of a person who might leave.

Credentials

Field	Value
`clientEmail`	`client_email` from the downloaded JSON
`privateKey`	`private_key` from the JSON, including the BEGIN and END lines

Paste the private key exactly as it appears, newlines and all.

Save and test.

What Chrome returns

Field	Notes
Serial number	The lookup key
Model
Device id
Annotated user	Whoever is recorded against it in the Admin console
Status	The single most common “it will not turn on” is a disabled Chromebook
Org unit path	Which OU the device sits in
OS version
Asset id	The annotated asset id
Last sync

Chrome has no warranty data, so those fields are honestly null rather than guessed.

The status field earns its place. A Chromebook that was disabled, usually months ago, presents to a student as a device that will not start. Seeing DISABLED on the repair record answers the ticket before anyone opens the lid.

Device actions

With allowDeviceActions on and the read-write scope granted, the device page can disable and powerwash.

Powerwash destroys local data. On a Chromebook that is usually less dramatic than on a laptop, because the data lives in the account, but it is still not reversible. The device.manage permission gates it.

Troubleshooting

Symptom	Cause
`unauthorized_client`	Delegation was not authorised for this client id, or the scope string does not match exactly
`403` with “not authorized to access this resource”	`adminEmail` is not an administrator, or is empty
Device actions refused by Plugboard	`allowDeviceActions` is off. This is the deliberate refusal, not a Google error
Device actions rejected by Google	The read-write scope was not granted in delegation
`invalid_grant`	The private key is malformed. Paste it complete, including BEGIN and END lines
Everything returns sample Chromebooks	`demoMode` is still on

Running it alongside another MDM

Very common. Chrome Enterprise for Chromebooks, Jamf or Mosyle for Apple, Intune for Windows. Configure all three; a device resolves through whichever knows it.