Ephemeral mode

To enable your employees to work from their personal laptop or a shared device that they trust, you can force the Chrome profile to be ephemeral by policy. Forcing ephemeral mode reduces the chances of any browsing information being left behind on their device.

Considerations

• When ephemeral mode is set at the user level in the Google Admin console, it relies on the user to sign in to Chrome for sync benefits and for the policy to take effect. The policy should be used only on devices that the user trusts and that are compliant with other corporate policies.
• The profile is marked for deletion only after the user signs out or manually closes every window associated with the profile. The profile is deleted the next time Chrome starts.
• Do not use ephemeral mode if you are using the Chrome Roaming Profile Support feature on Windows.
• When you enable ephemeral mode, users cannot turn on Linux development mode on their Chrome OS devices. For details, see Set up Linux on your Chromebook.
• There are also more granular policies that control whether and how Chrome retains certain types of data.

How does it work?

Ephemeral mode is supported on Google Chrome on Microsoft Windows, Mac, Linux, and Chrome OS. Here's how it works:

1. When a user signs in to Google Chrome with their corporate account, a new profile is created for that session and stored on disk.
2. If ephemeral mode is set for the user or device, the profile is marked for deletion after the last browser window associated with the profile is closed. It will be deleted the next time Chrome starts.
3. The ephemeral session ends when the user logs out of Chrome or exits the browser.

What does the user have access to in ephemeral mode?

During the ephemeral session the user has access to the full extent of a browser session including:

• Signing in for Chrome sync
• Cloud policy
• Password storage
• Bookmarks
• Autofill and other data normally present in the user profile
• Any corporate assets that are enabled in ephemeral mode, which may include corporate webmail, documents, and intranet pages

If you use ephemeral mode, we strongly recommend that you also use Chrome sync. For details, see Chrome Sync (Chrome OS).

If Chrome sync is enabled, any changes that the user makes to the browser's settings or to their Chrome data, such as bookmarks, history, apps, and so on, during an ephemeral session will be saved for future sessions. The settings are saved in the user's Google account in the cloud. If Chrome sync is not enabled, any changes are lost when the user exits the browser.

Setting up ephemeral mode

To set up ephemeral mode, enable the DeviceEphemeralUsersEnabled policy on Chrome OS or the ForceEphemeralProfiles policy on Windows, Mac, or Linux.

You can set up ephemeral mode at a user level in the Admin console, or at a device level by using Group Policy Objects (GPO).

If you set up ephemeral mode by GPO, each Chrome profile will be ephemeral, regardless of the user that signs in. The user needs to sign in to receive the productivity benefits of Chrome sync, such as access to corporate bookmarks.

How does it differ from Incognito mode?

Incognito mode enables a user to browse the web without saving certain information. Here's how it differs from ephemeral mode:

1. Entering Incognito mode is a user choice, while ephemeral mode is a policy that is enforced by the administrator.
2. In Incognito mode, the user can’t sign in and have the benefits of Chrome sync, such as corporate bookmarks. The user will lose all data after an incognito session. In ephemeral mode (if used with Chrome sync as recommended) the employee can sign in and start where they left off.
3. Apps and Extensions are not available in Incognito mode, but they are in ephemeral mode.

Ephemeral mode gives the employee productivity benefits, while reducing the risk of leaving data behind.

Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.