Students may try to bypass restrictions or monitoring of their devices by logging into a Chromebook with their personal Gmail account. You can prevent this by setting Google Admin to only allow logins from users in your domain.
- Login to your Google Admin Console
- Choose Device Management
- Choose "Chrome Management" from the left menu
Choose Device Settings
Decide which devices you wish to restrict to domain logins only. Note that you are looking for the OU with the devices, not the OU with the student login IDs. If you wish to do this for your entire organization, leave the root organization selected. If you wish to do this for only devices in a specific OU, navigate your organization structure on the left and click the OU where you'd like for the setting to take effect. Once you're selected the correct OU, scroll down to the "Sign-In Settings" area and look for the section "Sign-in Restriction". Choose "Restrict Sign-in to list of users:". In the box for allowed usernames, enter the wildcard (asterisk), then the @ symbol, then your domain name. For example: *@myschool.org. The wildcard means that any username at your domain will be able to login. Click Save to save your settings.
Tip: In addition to this restriction, you might also want o set the devices so they don't display the user names and photos of each user who has used the device. This is convenient when devices are in a shared-use environment rather than 1:1.