IssueTracker

This is a feature request for Google Admin tooling. For our specific use case we manage Users, Browsers, and Chromebooks in seaparate OUs. However, when it comes to scoping internally hosted extensions, we can only target user groups which causes issues because of policy precedence. No matter how we set the extension policy, the edge case where the policy applies to both chromebook and chrome browser with signed in manage account will always apply.

In order for us to consider exceptions, we would need a way to either separate User & Browser policies into separate containers or have a way to specify precedence for users signed into a managed browser/user signed into a chromebook.

Chrome Version: (copy from chrome://version)
Lacros Version (if applicable): (copy from chrome://version)
OS: (e.g. Win10, MacOS 10.12, etc...)

Note: Chrome is not responsible for bugs or behavior of individual extensions.

What steps will reproduce the problem?
(1)
(2)
(3)

What is the expected result?


What happens instead?


Does this issue affect a publicly-available extension?  If so, please include its ID here.


If this is a regression (i.e., worked before), please consider using the bisect tool (https://www.chromium.org/developers/bisect-builds-py) to help us identify the root cause and more rapidly triage the issue.