How to Enable Auto-Updates for Google Chrome Using Microsoft Intune
Configure automatic Chrome updates on managed Windows devices using Microsoft Intune by importing Chrome and Google Update ADMX templates and deploying an update policy override profile.
- Difficulty
- Intermediate
- Time required
- 20 minutes
- Steps
- 6
- Platform
- Intune
Table of contents
Quick Answer
Go to the stepsDownload Chrome and Google Update ADMX templates from Google's enterprise site plus the Windows ADMX from Microsoft. Import them into Intune in dependency order: windows.admx, google.admx, chrome.admx, GoogleUpdate.admx. Create an Imported Administrative Templates profile and enable Update policy override under Google Update > Applications > Google Chrome, set to Always allow updates.
- Download Chrome ADMX templates and Google Updater ADMX from Google's enterprise site.
- Download Windows ADMX from Microsoft or copy from C:\Windows\PolicyDefinitions.
- Import into Intune in order: windows.admx, google.admx, chrome.admx, GoogleUpdate.admx.
- Create an Imported Administrative Templates profile; enable Update policy override > Always allow updates.
- Assign to device groups and verify at chrome://policy/ on target devices.
Intune admin center > Devices > Configuration > Import ADMX / Create > New policy > Imported Administrative TemplatesExpected result: Chrome automatically downloads and installs updates on managed devices. Verify at chrome://policy/ where UpdatePolicy shows value 1.
Key takeaways
- You'll learn how to download and import Chrome ADMX templates into Intune, create a configuration profile that enforces automatic Chrome updates, and verify the policy on managed devices.
- Chrome updates automatically by default, but users or other policies can disable the update mechanism. Enforcing auto-updates through Intune ensures all managed devices receive security patches consistently.
- Import Chrome ADMX templates into Intune (with windows.admx first) and enable Update policy override > Always allow updates to enforce automatic Chrome updates across managed Windows devices.
Introduction
Google Chrome receives frequent security updates, sometimes multiple times per month. By default, Chrome updates itself silently in the background. But in enterprise environments, users or conflicting policies can disable this behavior, leaving devices vulnerable.
Microsoft Intune lets you enforce Chrome's auto-update behavior by importing Google's ADMX administrative templates and configuring the Update policy override setting. This gives you the same control as traditional Group Policy but delivered through the cloud to any Intune-managed Windows device.
The process involves four key steps: downloading the ADMX template files from Google and Microsoft, importing them into Intune in the correct order (Windows templates first, then Google templates), creating a configuration profile with the update policy, and deploying it to your device groups.
Who this is for: IT administrators managing Windows devices through Microsoft Intune who need to enforce automatic Google Chrome updates.
Before you start
- Access
- Access to the Microsoft Intune admin center at intune.microsoft.com with Intune Administrator or Global Administrator role.
- Required roles
- Intune Administrator or Global Administrator
- Required licenses
- Microsoft Intune Plan 1
- Environment
- Windows 10 or later enrolled in Intune. Google Chrome installed on target devices. Any edition except Windows Home.
- Vendor
- Microsoft
- Tested environment
- Verified against Google Chrome Enterprise documentation and Intune ADMX import procedures, July 2026.
- Administrator permissions required
Steps verified against current Google Chrome Enterprise documentation and Intune ADMX import procedures.
The ADMX import and profile creation take about 20 minutes. Policy application to devices takes 1 to 8 hours.
Warning: Windows ADMX must be imported first
The Google Chrome and Google Update ADMX files depend on the Windows ADMX namespace (Microsoft.Policies.Windows). You must import windows.admx before importing any Google templates, or you'll get a NamespaceMissing error.
Note: Two separate downloads from Google
You need two downloads from Google's enterprise site: the Chrome ADM/ADMX templates (contains google.admx and chrome.admx) and the Google Updater ADMX template update (contains GoogleUpdate.admx). These are separate ZIP files.
1Download Chrome and Google Update ADMX templates
Obtain the ADMX template files needed to manage Chrome update policies through Intune.
Navigate to chromeenterprise.google/browser/download/. Download two items: Chrome ADM/ADMX templates (from Policy templates dropdown) and Google Updater ADMX template update (from Update management templates dropdown). Extract both ZIP files.
You also need the Windows ADMX templates. Copy windows.admx and windows.adml from C:\Windows\PolicyDefinitions on any Windows 10/11 device, or download the Windows Administrative Templates from Microsoft's download center.
Expected result: You have four ADMX files: windows.admx, google.admx, chrome.admx, GoogleUpdate.admx, plus their matching .adml files.
Note
The Chrome ADMX and Google Update ADMX come from separate downloads on Google's enterprise site. Always download the latest templates for compatibility with current Chrome versions.
2Import ADMX templates into Intune in the correct order
Upload the ADMX templates into Intune so Chrome update policies become available.
Intune admin center > Devices > Configuration > Import ADMXIn the Intune admin center at intune.microsoft.com, go to Devices > Configuration. Click Import ADMX, then + Import. Import files in this exact dependency order: (1) windows.admx + windows.adml, (2) google.admx + google.adml, (3) chrome.admx + chrome.adml, (4) GoogleUpdate.admx + GoogleUpdate.adml.
Wait for each import to show Available status before importing the next one. If you skip the Windows template, you'll get NamespaceMissing:Microsoft.Policies.Windows. If you skip google.admx, you'll get NamespaceMissing:Google.Policies.
Expected result: All four ADMX imports show Available status. Google, Chrome, and Google Update policy folders appear when creating a profile.
Note
If the Google ADMX import fails with a namespace error, verify you imported google.admx (the base Google template) before chrome.admx and GoogleUpdate.admx. The dependency chain is: Windows > Google > Chrome/GoogleUpdate.
3Create the Chrome auto-update configuration profile
Create an Intune configuration profile that enforces automatic Chrome updates.
Intune admin center > Devices > Windows > Configuration > Create > New policyIn Intune, go to Devices > Windows > Configuration. Click Create > New policy. Set Platform to Windows 10 and later, Profile type to Templates > Imported Administrative Templates. Click Create.
Name the profile Enforce automatic updates for Google Chrome. On the Configuration settings tab, navigate to Computer Configuration > Google > Google Update > Applications > Google Chrome > Update policy override. Set to Enabled and select Always allow updates (recommended) from the dropdown.
Expected result: Configuration profile created with Update policy override enabled and set to Always allow updates.
Note
The per-application Update policy override takes precedence over the Update policy override default. Use the per-application setting for Chrome-specific control.
4Assign the profile to device groups
Deploy the Chrome auto-update policy to your target devices.
Intune admin center > Configuration profile > AssignmentsOn the Assignments tab, click Add group under Included groups and select your target device groups. Start with a pilot group for validation. Click Review + create, then Create. Policy application takes 1 to 8 hours. Force a sync from Settings > Accounts > Access work or school > Info > Sync.
Expected result: Profile deployed and shows Succeeded status for test devices within 2 to 4 hours.
Note
Start with a pilot of 10 to 20 devices. Check for conflicts with existing Group Policies on domain-joined devices before deploying widely.
5Verify the policy is applied on target devices
Confirm Chrome's auto-update policy is active and working on managed devices.
On a target device, open Chrome and go to chrome://policy/. Search for Update and verify Update policy override shows Value 1, Source Platform, Status OK. Then go to chrome://settings/help to confirm Chrome checks for updates.
Verify the Google Update services from Command Prompt: sc query gupdate and sc query gupdatem. These services manage Chrome's update mechanism and may show STOPPED when not actively updating, which is normal.
sc query gupdateExpected result: chrome://policy/ shows UpdatePolicy value 1 with Source Platform and Status OK. chrome://settings/help confirms auto-update.
Note
If policies don't appear at chrome://policy/, the issue is with Intune policy delivery. Check the profile's Device status in the admin center and force a device sync.
6Troubleshoot common auto-update issues
Resolve common problems that prevent Chrome auto-updates on managed devices.
If the policy doesn't appear at chrome://policy/: verify all four ADMX files imported, confirm the profile targets devices (not users), and force a sync. If updates are still blocked: check for conflicting GPOs on domain-joined devices, look for override registry keys under HKLM\SOFTWARE\Policies\Google\Update, and test on a clean non-domain device.
If Chrome isn't updating, manually trigger a check by running GoogleUpdate.exe /ua /installsource scheduler from the Chrome installation directory. Check Windows Event Logs for Google Update errors. As a last resort, set registry values directly under HKLM\SOFTWARE\Policies\Google\Update.
"C:\Program Files\Google\Update\GoogleUpdate.exe" /ua /installsource schedulerExpected result: After troubleshooting, chrome://policy/ shows the update policy and chrome://settings/help confirms auto-update.
Note
Chrome's application GUID for registry keys is {8A69D345-D564-463c-AFF1-A69D9E530F96}. Registry modifications should be a last resort; prefer the ADMX policy approach.
How to Confirm Chrome Auto-Updates Are Enforced
Confirm configuration
A successfully applied policy shows up at chrome://policy/ on managed devices. The Update policy override entry displays value 1 (Always allow updates), with Source showing Platform and Status showing OK.
Chrome downloads and applies updates automatically in the background. Updates take effect after the user relaunches Chrome. You can verify the current version at chrome://settings/help.
In the Intune admin center, the configuration profile's Device status tab shows which devices have received the policy.
Normal result: chrome://policy/ shows UpdatePolicy value 1 with Source Platform. Chrome checks for and installs updates automatically.
Abnormal result: Policy not visible at chrome://policy/, or Chrome reports updates disabled. Check for conflicting GPOs, missing ADMX imports, or incorrect profile assignment.
Value 1
Always allow updates
Chrome downloads and installs updates whenever found. Recommended setting.
Value 0
Updates disabled
Updates blocked. Only use temporarily for testing.
Value 3
Updates available, not auto-applied
Updates available but user must manually trigger install.
Troubleshooting
ADMX import fails with NamespaceMissing:Microsoft.Policies.Windows
Warning
Cause: Google ADMX templates depend on the Windows ADMX namespace. Windows.admx was not imported first.
Import windows.admx and windows.adml first. Find these files at C:\Windows\PolicyDefinitions on any Windows 10/11 device, or download from Microsoft's ADMX template downloads. Then retry the Google ADMX imports.
ADMX import fails with NamespaceMissing:Google.Policies
Warning
Cause: chrome.admx or GoogleUpdate.admx was imported before google.admx, which defines the Google namespace.
Import in dependency order: (1) windows.admx, (2) google.admx, (3) chrome.admx, (4) GoogleUpdate.admx. Each template depends on the ones before it.
Update policy not appearing at chrome://policy/
Warning
Cause: Profile hasn't synced to the device, or profile is assigned to users instead of devices.
Check Device status in Intune. Force a sync from Settings > Accounts > Access work or school > Info > Sync. Verify the profile targets device groups, not user groups. Allow up to 8 hours for propagation.
Chrome still not updating despite correct policy
Warning
Cause: Conflicting GPOs on domain-joined devices, or local registry keys overriding Intune.
Run gpresult /h report.html to check for conflicting GPOs. Look for registry keys under HKLM\SOFTWARE\Policies\Google\Update. Verify the Google Update service is not disabled with sc query gupdate. Test on a non-domain device to isolate the issue.
Chrome updates download but don't install until relaunch
Note
Cause: Chrome downloads updates in the background but only installs them when relaunched. Users who keep Chrome open don't get updates applied.
This is expected Chrome behavior. Use the RelaunchNotification and RelaunchNotificationPeriod policies through the same ADMX templates to prompt users to relaunch Chrome after a configurable period.
Frequently asked questions
How long does it take for Chrome update policies to apply through Intune?
Policy application typically takes 1 to 8 hours depending on device check-in schedules. Force immediate sync from Settings > Accounts > Access work or school > Info > Sync on the device.
Why do I need to import windows.admx before the Chrome templates?
The Google Chrome and Google Update ADMX files reference the Microsoft.Policies.Windows namespace. Without it, Intune rejects the import with a NamespaceMissing error. Copy windows.admx from C:\Windows\PolicyDefinitions on any Windows 10/11 device.
Can I pin Chrome to a specific version instead of always updating?
Yes. Use the TargetVersionPrefix policy in the imported Chrome ADMX templates to pin installations to a specific major version. Combine it with staged device groups for controlled rollout.
What if Chrome update policies conflict with existing Group Policies?
On domain-joined devices, local Group Policy settings typically take precedence over Intune policies. Check chrome://policy/ to see which source is winning. Remove the conflicting GPO or target only non-domain devices.
Does Chrome update even if the user doesn't open the browser?
Chrome downloads updates in the background but only applies them when relaunched. If users never open Chrome, updates aren't installed. Use the RelaunchNotification and RelaunchNotificationPeriod policies to prompt users to relaunch.
Conclusion
Enforcing Chrome auto-updates through Intune requires importing four ADMX templates in the correct dependency order: windows.admx, google.admx, chrome.admx, and GoogleUpdate.admx. Once imported, create an Imported Administrative Templates profile and enable the Update policy override setting.
Verify at chrome://policy/ on target devices. The Update policy override should show value 1 with Source Platform.
Import Chrome ADMX templates into Intune (with windows.admx first) and enable Update policy override > Always allow updates to enforce automatic Chrome updates across managed Windows devices.
Intune admin center > Devices > Configuration > Import ADMX, then Create > Imported Administrative Templates > Google Update > Applications > Google Chrome > Update policy overrideSources3
