If your organization uses Microsoft Entra ID (Azure AD) Conditional Access policies, you’ve probably run into this problem: Microsoft Edge works seamlessly with device-based sign-in, but Google Chrome doesn’t — by default, Chrome doesn’t send device information to Entra ID, so even compliant, Entra-joined devices get blocked or asked to re-authenticate.
The fix is a Chrome enterprise policy called CloudAPAuthEnabled.
What is CloudAPAuthEnabled?
CloudAPAuthEnabled is a Chrome policy that enables automatic sign-in for accounts backed by a Microsoft cloud identity provider. When turned on, users who sign into Windows with a work or school account get signed into web apps automatically using that identity — no repeated logins.
It works by allowing Chrome to use the Primary Refresh Token (PRT) issued during Windows sign-in. Other Microsoft apps like Edge and Teams already use this token through a broker to deliver seamless single sign-on. CloudAPAuthEnabled gives Chrome the same capability natively, without needing a separate browser extension.
This setting is also what allows Entra ID Conditional Access policies (such as “require a compliant device”) to correctly recognize and approve Chrome-based sign-ins, instead of blocking them as “unmanaged.”
Requirements
Before enabling this policy, make sure:
- Devices are Entra ID Joined, Hybrid Joined, or Entra ID Registered
- Devices are running Windows 10 (Creators Update or later) or Windows 11
- Chrome is on version 111 or later
- You have administrative access to deploy registry settings, Group Policy, or Intune
Option 1: Enable via Registry (Quick Method)
This is the simplest method if you’re configuring a single device or pushing a setting through a script.
- Open Registry Editor (regedit) with administrator rights
- Navigate to: HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome
- Create the key if it doesn’t exist
- Create a new DWORD (32-bit) value named: CloudAPAuthEnabled
- Set the value to 1 (Enabled)
- Restart Chrome
You can also do this with a quick PowerShell command:
New-Item -Path “HKLM:\Software\Policies\Google\Chrome” -Force New-ItemProperty -Path “HKLM:\Software\Policies\Google\Chrome” -Name CloudAPAuthEnabled -PropertyType DWORD -Value 1 -Force
Option 2: Enable via Microsoft Intune (Enterprise Rollout)
For organizations managing multiple devices, Intune is the recommended approach.
- Download the Chrome ADMX/ADML policy templates and the Google Updater ADMX template from the Chrome Enterprise site
- In the Intune admin center, go to Devices > Configuration > Import ADMX/ADML files, and upload the templates
- Go to Devices > Configuration Profiles > Create Profile
- Choose Windows 10 and later as the platform, and Settings catalog (or Administrative Templates, depending on your Intune setup) as the profile type
- Search for “Allow automatic sign-in to Microsoft cloud identity providers” — this is the friendly name for CloudAPAuthEnabled
- Set it to Enabled
- Assign the profile to the relevant device or user group
- Sync the policy to your target devices
Verifying the Setting Works
Once deployed, confirm it’s applied correctly:
- Open Chrome on the target device
- Navigate to chrome://policy
- Scroll to the Chrome Policies section
- Look for CloudAPAuthEnabled — it should appear with a value of 1
You can also check Entra ID sign-in logs. A successful configuration will show the device ID, compliance state, and join type for Chrome-based sign-ins, rather than “unregistered” or “unknown device.”
Common Issues
- Setting shows in chrome://policy but device still shows as unregistered: try re-registering the device (dsregcmd /leave, then rejoin), and confirm Chrome is fully updated
- Works in Edge but not Chrome: this usually confirms the registry/Intune policy hasn’t propagated yet, or the device’s PRT needs to refresh — sign out and back into Windows
- Policy not appearing in Intune Settings Catalog: import the ADMX templates manually rather than relying on the built-in catalog, since Chrome’s newer policies aren’t always available there yet
Why This Matters
Without CloudAPAuthEnabled, organizations enforcing Conditional Access policies (like requiring a compliant or hybrid-joined device) end up blocking legitimate users simply because they’re using Chrome instead of Edge. Enabling this policy closes that gap, giving Chrome users the same seamless, secure sign-in experience as Edge — without requiring a separate browser extension.