# Windows 10 or later Configuration Policy - Block Password Saving In Google Chrome

> Configuration policy for blocking password saving in Google Chrome

Configuration policy for blocking password saving in Google Chrome

## Settings this baseline controls

| Setting                  | What it does                                                                                                                                                                  |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Policy name              | Name of the configuration policy. [Learn more](https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows)                                   |
| Policy description       | Description of the configuration policy. [Learn more](https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows)                            |
| Password manager enabled | Controls whether passwords can be saved using the password manager. [Learn more](https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows) |
| Group assignments        | The list of group assignments for this configuration policy. [Learn more](https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templates-windows)        |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

Add this to a tenant whose Windows fleet uses Google Chrome, so the browser stops acting as a password store in its own right.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or include it in a scheme you deploy to every tenant whose devices run Chrome ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Leave **Password manager enabled** switched off; it's the one setting that matters here. Chrome then stops offering to save or automatically fill in sign-in passwords on every device the policy reaches.
3. Save. There's nothing else to configure. Turn on **Auto-remediation** if you want Octiga to recreate the policy in Intune whenever it's changed or removed.

> **Licence: Intune:**

## Check it worked

This baseline shows **Passing** once the configuration profile exists in Intune with the setting above and a Windows device has reported it applied successfully. To check progress, go to **Devices → Manage devices → Configuration** in the Microsoft Intune admin centre, open the profile (its **Profile type** reads "Settings catalog"), and use its device status and per-setting status views. Users notice Chrome no longer offers to remember or fill in a password when they sign in to a site.

## Standards this addresses

### CIS

- **v8 4.1** — CIS Controls v8 Safeguard 4.1
- **v8 5.2** — CIS Controls v8 Safeguard 5.2

### NIST

- **PR.PT-1** — NIST CSF 2.0 PR.PT-1
- **CM-6** — NIST SP 800-53 CM-6
- **IA-5** — NIST SP 800-53 IA-5

### ISO 27001

- **A.8.5** — ISO/IEC 27001:2022 Annex A.8.5
- **A.8.6** — ISO/IEC 27001:2022 Annex A.8.6

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)