Enforce cloud storage for Chrome downloads

Supported editions for this feature: Chrome Enterprise Premium. Compare your edition

You can use data protection rules with Chrome Enterprise Premium to prevent users from saving files downloaded in Chrome browser to their local devices. When a rule with the "Enforce cloud storage" action triggers on a "File downloaded" event, Chrome browser blocks the file from saving to local storage. Instead, the Secure Enterprise Browser extension uploads the file to the user's corporate cloud storage in Google Drive or OneDrive.

This action keeps sensitive data off unmanaged local devices while letting users continue their work. If user validation or the cloud upload is unsuccessful, the local download remains blocked.

Before you begin

Make sure your environment meets the following requirements:

  • Chrome browser version:
    • Google Drive destination: Chrome browser version 144 or later
    • Microsoft OneDrive destination: Chrome browser version 146 or later
  • Administrator privileges: Make sure your account has the View Chrome DLP rule and Manage Chrome DLP rule privileges. You also need privileges to manage organizational units, groups, and Chrome apps and extensions.
  • Chrome Enterprise connector policies: Set up your connector policies, including Download content analysis. For steps, go to Set Chrome Enterprise connector policies for Chrome Enterprise Premium.
  • Additional requirements for Microsoft OneDrive:
    • Set up Microsoft Entra ID single sign-on (SSO) and identity synchronization with Google Workspace or Cloud Identity. Users must sign in to their Chrome profile with their Microsoft account. For setup instructions, consult your Microsoft Entra documentation.
    • Turn on third-party identity provider (IdP) SSO in the Google Admin console for your whole organization, or assign the SSO profile to the organizational units that use the rule.
    • Assign a Microsoft OneDrive license to each user who saves files to OneDrive.

Step 1: Set up the OneDrive app in Microsoft Entra ID

If you use Google Drive for your organization as your destination, skip to Step 2: Force-install the extension.

If you use OneDrive for your organization, add the Chrome Enterprise Premium Force Save to OneDrive app to your Microsoft Entra ID tenant. Then grant admin consent for the app:

  1. Open the admin consent page.

  2. Sign in with a Global Administrator or Privileged Role Administrator account.

  3. Review the requested permissions:

    • User.Read: Lets the app verify the user's identity against their Chrome profile.
    • Files.ReadWrite: Lets the extension create folders and upload files to the user's OneDrive.

  4. Click Accept. Your browser redirects to the Google Admin console.

  5. In the Microsoft Entra admin center, go to Enterprise applications and confirm that Chrome Enterprise Premium Force Save to OneDrive is in the list.

Step 2: Force-install the extension

Users must have the Secure Enterprise Browser extension installed on their managed Chrome browser or profile for cloud uploads to work. To test with a small group first, you can add an organizational unit for your pilot users.

  1. In the Google Admin console, go to Menu and then Devices and then Chrome and then Apps & extensions and then Users & browsers.

    If you signed up for Chrome Browser Cloud Management, go to Menu and then Chrome browser and then Apps & extensions and then Users & browsers.

  2. To apply the setting to specific users or browsers, select an organizational unit or configuration group. If you use Microsoft Entra ID SSO for a pilot organizational unit, make sure the third-party IdP SSO profile is assigned to that organizational unit.
  3. Point to Add and click Add Chrome app or extension by ID .
  4. For Extension ID, enter ekajlcmdfcigmdbphhifahdfjbkciflj and select From the Chrome Web Store.
  5. Click Save.
  6. In the list of apps and extensions, click Secure Enterprise Browser.
  7. For Installation policy, select Force install or Force install + pin to browser toolbar.
  8. In the top-right corner, click Save.

Step 3: Create a rule to enforce cloud storage

  1. In the Google Admin console, go to Menu and then Rules and then Create rule and then Data protection.

    Requires having the View and Manage DLP rule privileges, or for Chrome browser or ChromeOS, the View and Manage Chrome DLP rule privileges.

  2. Enter a name and an optional description for the rule.
  3. In the Apps section, for Chrome, check the File downloaded box.
  4. Click Continue.
  5. In the Actions section, for Chrome, select Enforce cloud storage.
  6. Select the cloud storage destination:
    • Google Drive for your organization
    • OneDrive for your organization
  7. (Optional) In the Alerting section, configure any of the following alert options:
    • Select a severity level of Low, Medium, or High.
    • Check the Alert center box to send notifications to the alert center.
    • Add email notification recipients.
  8. Click Continue.
  9. For Scope, choose an option:
    • To apply the rule to your whole organization, select All in *domain.name*.
    • To apply the rule to specific organizational units or groups, choose to include or exclude organizational units and groups, and then select the organizational units and groups.
  10. (Optional) In the Content conditions section, click Add Condition to specify what triggers the rule, such as a predefined data type, File type, Source URL, or File size. For details on available conditions, go to Use Chrome Enterprise Premium to integrate DLP with Chrome.
  11. Click Continue and review the rule details.
  12. For Rule status, select Active to run the rule immediately, or Inactive to review the rule before turning it on.
  13. Click Create.

File size limits, rule precedence, and timing

  • File size limit: Enforced cloud storage supports files up to 150 MB. If a user downloads a file larger than 150 MB, Chrome browser blocks the download and the extension shows an error message. You can add a File size condition to your rule to match specific file sizes.
  • Action precedence: When multiple rules apply to the same file download, the rule with the strictest action applies: Block and then Enforce cloud storage and then Allow with warning and then Audit only. If multiple rules have the same action, the most recently modified rule applies.
  • Rule updates: When you create or edit a rule, changes typically take up to 2 minutes to take effect.

Step 4: Turn on event reporting and monitor events

Turn on Chrome event reporting so you can review enforced cloud storage events in your logs, reports, and alerts.

  1. In the Google Admin console, go to Menu and then Devices and then Chrome and then Settings.

    If you signed up for Chrome Enterprise Core, go to Menu and then Chrome browser and then Settings.

    Requires having the Mobile Device Management administrator privilege.

  2. (Optional) To apply the setting to a department or team, at the side, select an organizational unit.
  3. Go to Browser reporting and then Event reporting.
  4. Select Enable event reporting. Make sure Sensitive data events or all event types are turned on.
  5. Click Save. Or, you might click Override for an organizational unit.

    To later restore the inherited value, click Inherit.

After event reporting is turned on, you can monitor enforced cloud storage activity across the Google Admin console:

  • Chrome log events: In Reporting and then Audit and investigation and then Chrome log events, matching downloads show a Destination of Google Drive or OneDrive.
  • Rule log events: In Reporting and then Audit and investigation and then Rule log events, matching downloads show a Triggered action of Force save to cloud or Force saved to cloud.
  • Alert center: In Security and then Alert center, alerts show the triggered action Force saved to cloud.
  • Chrome threat protection summary report: In Security and then Dashboard and then Chrome threat protection summary, the report tracks the number of Force saved to cloud events.

What users experience

  1. When a user starts a file download that matches the rule, Chrome browser blocks the local download. A message prompts the user to save the file to cloud storage.
  2. When the user saves the file to cloud storage:
    • For OneDrive, if the user is not signed in to their Microsoft account, a Microsoft sign-in box opens first.
    • The Secure Enterprise Browser extension opens the Save to Google Drive or Save to OneDrive box and shows upload progress.
  3. In the upload box, the user can cancel the upload, rename the file, or delete the uploaded file from cloud storage.

Users can also customize extension settings on the Secure Enterprise Browser Options page in the Download Control Settings section:

  • Convert saved link to Google editor format: Converts compatible files to Google Docs, Sheets, or Slides format when saving to Google Drive.
  • Automatically open the saved file: Opens the file in cloud storage after the upload completes.

Troubleshoot enforced cloud storage

User validation requirements and errors

For the extension to upload files to cloud storage, all of the following conditions must be met:

  • The user is signed in to their Chrome profile.
  • The signed-in account is affiliated with Chrome Enterprise Premium.
  • If the browser is managed, the signed-in user's domain matches the managed browser's domain.
  • For OneDrive, the Microsoft email address used to sign in to the extension must match the Chrome profile email address in all lowercase letters. Mixed-case email addresses are not supported.

If any requirement is not met, a notification prompts the user to sign in to a valid work or school account. The local file download remains blocked.

Validation notifications don't show on macOS

On macOS devices, system notification settings might suppress Chrome notifications when a user validation error occurs. Have the user open macOS System Settings and then Notifications and then Google Chrome and turn on notifications.

Microsoft Entra error AADSTS50105

If you added the Chrome Enterprise Premium Force Save to OneDrive enterprise app in Microsoft Entra ID but users get an AADSTS50105 error box, check whether user assignment is required for the app. In the Microsoft Entra admin center, open the app and set Assignment required? to No, or assign the affected users and groups to the app.

Error when the OneDrive app is not added

If users get an error stating that the app is not added to your organization, complete the steps in Step 1: Set up the OneDrive app in Microsoft Entra ID using a Global Administrator or Privileged Role Administrator account. Make sure you grant admin consent across the tenant.

Google Account not found during sign-in

If a user gets a "Google Account not found" error on the Chrome sign-in screen, their Microsoft Entra identity might not be synchronized with Google or SSO might not be turned on for their organizational unit. Verify your identity synchronization and SSO setup in Microsoft Entra ID and the Google Admin console.

Upload files to third-party applications

Many third-party applications connect directly with Google Drive and OneDrive. Contact your application provider for details on cloud storage integrations. If users must download files for an application that does not support cloud storage, refine your data protection rule conditions. For example, add File type or Source URL conditions to exclude specific files or websites from the rule.

Why the OneDrive app requests file permissions

The extension requires permission to create folders and upload files to the user's OneDrive. The app accesses only the signed-in user's OneDrive account. It cannot access files owned by other users in your organization.

Check extension logs for download or upload errors

If an upload is unsuccessful, the extension upload box shows the error details. An upload might be unsuccessful if cloud storage quota is full, sign-in is unsuccessful, or the source server returns an error.

To review or export extension logs:

  1. Open Secure Enterprise Browser Options.
  2. Go to the Troubleshooting section.
  3. Click Show log or Download log.