Students may try to bypass restrictions or monitoring of their devices by logging into a Chromebook with their personal Gmail account. You can prevent this by setting Google Admin to only allow logins from users in your domain.
- Login to your Google Admin Console
- Choose Device Management
- Choose "Chrome Management" from the left menu
Choose Device Settings
Decide which devices you wish to restrict to domain logins only. Note that you are looking for OUs with devices, not OUs with student login IDs. If you wish to do this for your entire organization, leave the root organization selected. If you wish to do this only for devices in a specific OU, navigate to your organization structure on the left and click the OU where you'd like for the setting to take effect. Once you've selected the correct OU, scroll down to the "Sign-In Settings" area and look for the "Sign-in Restriction" section. Choose "Restrict Sign-in to the list of users:". In the box for allowed usernames, enter the wildcard (asterisk), then the @ symbol, then your domain name. For example *@myschool.org. The wildcard means that any username in your domain will be able to log in. Click Save to save your settings.
Tip: In addition to this restriction, you might also want to set the devices so they don't display the user names and photos of each user who has used the device. This is convenient when devices are in a shared-use environment rather than 1:1.