Deploy the GlobalProtect App for Android on Managed Chromebooks Using the Google Admin Console

1. Before you begin:

   • Configure the GlobalProtect gateways to support the GlobalProtect app for Android on managed Chromebooks. Refer to Configure a GlobalProtect Gateway.
   • Configure the portal and customize the GlobalProtect app for Android on managed Chromebooks. You must configure one or more gateways to which the GlobalProtect app can connect. Refer to Set Up Access to the GlobalProtect Portal. Refer to the Palo Alto Networks Compatibility Matrix for a list of features supported for Android on Chrome OS.
   • (Recommended) Enable SAML SSO for the GlobalProtect app for Android on Chromebooks for seamless authentication. We recommend that you set up SAML SSO to allow users to connect automatically after they log in to Chromebook without having to re-enter their credentials on the GlobalProtect app. This ensures that users have access to always on security. Refer to Set Up SAML Authentication.
   • When users connect to GlobalProtect for the first time on Android on managed Chromebooks, the following suppress VPN notification message must be acknowledged before the tunnel is set up:

2. Approve the GlobalProtect app for Chromebook users.

   1. Log in to the Google Admin console as an administrator.
   2. From the Admin console, select DevicesChrome management to view and modify the Chrome management settings.
   3. Select Apps & extensions.
   4. In the Apps and extensions area, click the application settings page link.
   5. Click the add (

      ) button to add GlobalProtect to the list of approved Android apps from the Google Playstore.
   6. When the Google Play store launches, search for GlobalProtect and then click the GlobalProtect app icon.

   7. Click Select to add the GlobalProtect app.

      A message appears if the GlobalProtect app is successfully added as a result.

3. Determine how the GlobalProtect app is installed on Chromebooks.

   After you approve the GlobalProtect app, you must specify how the app is installed on Chromebooks. To prevent users from bypassing GlobalProtect by uninstalling the app, force all Chromebooks to install the GlobalProtect app automatically when users log in to their Chromebook.

   1. From the app extension management settings (Device managementChrome Apps & extensions), select GlobalProtect from the Apps list.
   2. Select your organizational unit from the list on the left edge of the page.
   3. Select any of the following options:

      • (Recommended) Force install + pin—Enable and pin the force-installed GlobalProtect app to the taskbar. If you selected this option, users will not have the option to Sign Out of the app.
      • Force install—Use this option if you want to ensure that the GlobalProtect app is automatically installed on each Chromebook when users log in to their Chromebooks. To prevent users from uninstalling the GlobalProtect app and getting around the security and compliance requirements you want to enforce the Force install option. If you selected this option, users will not have the option to Sign Out of the app.
      • Allow install—Install this app manually from the Google Playstore. This option also allows users to uninstall the GlobalProtect app from their Chromebooks.
      • Block—Block users from installing this app.

   4. SAVE your changes.
4. Apply a managed configuration to the GlobalProtect app.

   If you have enabled the GlobalProtect app to force install, you can apply a managed configuration file to the app. The managed configuration file contains values for configurable app settings.

   1. From the App Management settings (Device ManagementChrome managementApps & Extensions), select GlobalProtect from the Apps list.
   2. Select your organizational unit from the list on the left edge of the page.
   3. Click the Upload from file icon on the right edge of the page to select and upload your managed configuration file. Or enter the name of the key value in JSON format, as shown in the following sample configuration.

      {
      	"portal": "acme.portal.com",
      	"username": "user123"
      }

      The following table displays an example of the settings in the managed configuration file. For the settings that are relevant for your company, please contact your IT administrator.

      Setting	Description	Value Type	Example
      portal	IP address or fully qualified domain name (FQDN) of the portal.	String	acme.portal.com
      username	Username for portal authentication.	String	user123
      password	Password for portal authentication.	String	password123
      client_certificate	Client certificate for portal authentication.	String (in Base64)	DAFDSaweEWQ23wDSAFD…
      client_certificate _passphrase	Client certificate passphrase for portal authentication.	String	PA$$W0RD$123
      app_list	Begin the string with either the allowlist keyword or blocklist keyword followed by a colon, and follow it with an array of app names separated by semicolons. The block list or allow list enables you to control which application traffic can go through the VPN tunnel in a per-app VPN configuration.	String	allowlist| blocklist: com.google.calendar; com.android.email; com.android.chrome
      connect_method	VPN connection method.	String	user-logon | on-demand
      mobile_id	Unique identifier used to identify mobile endpoints, as configured in a third-party MDM system.	String	5188a8193be43f42d332 dde5cb2c941e
      remove_vpn_config _via_restriction	Flag to remove the VPN configuration.	Boolean	true | false
      allow_vpn_bypass	Flag to allow application traffic to bypass the VPN tunnel.	Boolean	true | false
      cert_alias	Unique name used to identify the client certificate during portal or gateway authentication.	String	Company User client
      managed	Flag to indicate whether the device is enrolled with an MDM server.	Boolean	true | false
      ownership	Ownership category of the device (for example, Employee Owned).	String	byod
      compliance	Compliance status that indicates whether the device is compliant with the compliance policies that you have defined.	String	yes
      tag	Tags to enable you to identify devices. Each tag must be separated by a comma.	String	GuestAccount,SatelliteOffice

   4. SAVE your changes.
5. Enforce policies on the GlobalProtect app for Android on managed Chromebooks.

   • Create HIP objects using Host Info that is specific to Android on managed Chromebooks. Then use it as match conditions in any Host Information Profile (HIP) profiles.
   • Enforce the corresponding security policy using a HIP profile as a match condition in a policy rule. By default, the app collects data categories of information to help identify the security state of the host.