The Linux Google Chrome Browser Policy lets administrators configure Incognito availability, third-party cookies, background operation, and eligible browser sign-in accounts on enrolled Linux devices.

Swif delivers this policy through its Linux agent. It supports company-owned and BYOD devices.

The current version replaces Enable Incognito Mode Only with Incognito Mode Availability, which provides three choices: Available, Disabled, and Forced. It also adds Restrict Sign-in to Pattern.

Important: Entering a nonempty sign-in pattern also configures Swif to require browser sign-in. Use Chrome 145 or later on Linux for this requirement, and test existing profiles before deployment.

Google lists Linux support for forced browser sign-in starting with Chrome 145. Earlier versions should not be relied on to enforce the sign-in requirement that Swif adds with a nonempty pattern. Google: BrowserSignin policy definition

The Swif definition does not specify a distribution or architecture. Test your Linux distribution and Chrome installation method before expanding deployment. Do not assume identical behavior in Chromium, other Chromium-based browsers, or alternative browser packages.

These are the defaults shown in the Swif policy definition. A configured value is not necessarily equivalent to leaving the corresponding Chrome policy unmanaged.

Controls whether users can open pages in Incognito mode.

Google's corresponding IncognitoModeAvailability values are 0, 1, and 2. Restart Chrome after changing this setting. Google: Incognito policy definition

Incognito limits browsing information retained locally after the session ends. It does not erase downloaded files or saved bookmarks, hide activity from websites or network operators, or replace a managed shared-device configuration. All Incognito windows must close to end the session. Google: Browse in Incognito mode

If required business or security extensions are part of your deployment, verify their behavior in Incognito before selecting Forced.

Controls cookies set by third-party elements embedded in a webpage.

Off is not an unmanaged setting. Applying false explicitly allows third-party cookies through this control.

This Chrome policy does not apply in Incognito mode, where third-party cookies are blocked and exceptions are handled at the site level. Google: Third-party cookie policy definition

Test embedded applications and authentication flows before enabling blocking. Some services depend on cross-site cookies. Chrome supports separate cookie exceptions, but this Swif policy does not expose an exception list. Google: Allow or restrict third-party cookies

Controls whether Chrome's background mode is enabled.

When enforced, users cannot change the setting in Chrome. Background mode supports eligible background activity; it does not guarantee that every extension runs continuously. Google also allows users to close the background process from its system tray icon. Google: Background mode policy definition

Verify behavior in the Linux desktop environment used by your employees.

Uses a regular expression to determine which Google accounts may become Chrome's primary browser account.

For example, to permit accounts in example.com, enter:

Replace example.com with the intended Google account domain. The escaped dot matches a literal period, and the anchors match the complete address.

To permit two domains:

Enter the expression directly in the Swif field, without surrounding quotation marks. Use a single backslash before each literal dot as shown above.

Chrome rejects a primary browser account that does not match the expression. This setting targets the browser's primary Google account; it is not a general restriction on every account used inside websites. Google: Sign-in pattern policy definition

When saving the policy, Swif handles the pattern as follows:

There is no separate Browser Sign-in selector in this policy. A broad pattern such as .* still triggers the sign-in requirement because it is nonempty.

Forced sign-in can lock existing unsigned profiles until the required sign-in flow is completed. Google also changes the default Guest mode behavior to disabled. Browser sign-in does not by itself mean Chrome Sync is enabled. Google: BrowserSignin policy definition

Before deployment, confirm that users can authenticate with an allowed account. Clearing the pattern later does not guarantee that another management source will stop requiring sign-in; verify the effective policies after the change.

If background mode is enabled, closing the last window may leave Chrome running. Fully exit Chrome when a restart is required.

This example is for a company-owned device where users should browse with an approved primary account.

Replace the domain and use Chrome 145 or later. Confirm that an approved account works and a nonmatching primary account is rejected. Test access to required applications as well as Chrome's sign-in prompt.

This configuration does not provide website account isolation or a complete data-loss-prevention solution.

The policy supports BYOD, but its settings can affect personal browsing. Requiring a company primary account, disabling Incognito, or enforcing cookie behavior may change how employees use Chrome on their own devices.

Review the effective policy scope and explain the changes before assignment. Leave the sign-in pattern empty if this policy should not require browser sign-in. Verify other management sources as well.

After the device checks in and Chrome restarts:

Check for errors, unsupported settings, and conflicting sources. Confirm the behavior in the affected user's browser, including Incognito access, account selection, and business application sign-in. Google's policy viewer identifies the source and scope of effective policies. Google: View current Chrome policies

Confirm that the latest configuration reached the device, Google Chrome is installed, and Chrome was fully restarted. Check chrome://policy for missing values or errors.

For standard Linux installations, mandatory Chrome policy files use:

Check for competing configuration tools or duplicate JSON settings. Google warns that conflicting values in multiple policy files have undefined behavior. Google: Set policies on Linux

Alternative packages may use different paths or access restrictions. Verify the browser installation method rather than assuming all packages consume the same host configuration.

A nonempty Restrict Sign-in to Pattern also enables forced sign-in in Swif. Review the field, including broad expressions such as .*.

If forced sign-in is no longer intended, clear the field, save the policy, let the device check in, and restart Chrome. Verify that the effective BrowserSignin requirement is gone.

Check the Chrome version. Linux support for BrowserSignin = 2 starts with Chrome 145. Confirm the effective value and restart Chrome after correcting the configuration.

Check the complete email address against the pattern. Confirm the domain spelling, escaped dots, and anchors, and remove accidental quotes or extra backslashes. Test every intended domain before broad deployment.

The pattern controls Chrome's primary browser account. It does not constitute a universal block on personal website accounts. Use the relevant application or identity controls for that requirement.

Check whether third-party cookie blocking caused the issue. Test the affected flow in regular browsing and review other cookie policies. Remember that Incognito handles third-party cookies separately.

This is expected when background mode is enabled. If it is disabled but processes remain, review the effective policy and any desktop startup configuration or other software launching Chrome.

Test whether the extension supports and is allowed to run in Incognito. Do not assume its normal-window behavior carries over. Use Available or Disabled if your validated workflow requires regular browsing.

Edit the settings or remove the assignment, allow the device to check in, and fully restart Chrome. Verify the resulting values in chrome://policy.

Removing this Swif assignment does not guarantee restoration of every previous preference. Other platform or cloud policies may remain effective.