Workspace Admin · Domain 5 of 6

Workspace Admin Domain 5: Managing browsers and endpoints

The smallest section covers managing the devices people use to reach Workspace: choosing basic, advanced or third-party mobile management, handling company-owned and personal devices, and enrolling and configuring managed Chrome browsers and extensions.

Exam weight
~10%
Official objectives
2
Estimated questions estimate
5–6
Suggested study time estimate
5–7 hrs

About 10 min read Reviewed October 2026

Overview

Section 5 is worth about 10% of the exam and has two sub-objectives. The first covers mobile devices: the difference between basic, advanced and third-party management, the basic policies you can apply, visibility and control for company-owned and personal (BYOD) devices, and how to offboard a device when someone leaves or loses a phone.

The second covers Chrome browsers: enrolling browsers into cloud management, applying policies such as update behaviour and offline access, and allowing, blocking or force-installing extensions and apps by OU or group. Expect around five or six questions, usually framed as a choice between management levels or between a device wipe and an account wipe.

How it's tested

Section 5 questions describe a device population and a requirement, such as personal phones that must keep work data separate or company laptops that need a specific extension installed. Your job is to pick the management level, wipe type or browser policy that meets the requirement without overreaching.

  • Pick the management level

    Requirements for passcodes, app control or device wipe are given, and you choose basic, advanced or third-party management.

  • Personal vs. company-owned

    A BYOD or corporate device scenario asks how much control to apply and whether to wipe the account or the whole device.

  • Browser policy

    Managed browsers need an extension, update rule or block, and you choose enrollment and the OU-level policy.

Reasoning it through

A contractor using a personal Android phone leaves the company, and their phone has Gmail and Drive data. Wiping the entire device would erase personal photos and is inappropriate for BYOD. With advanced management and a work profile, an account wipe removes only the work profile and Workspace data. That protects company information while leaving the contractor's personal content untouched, which is what the exam expects for personal devices.

Objectives 2

Official objectives from the Google Cloud outline, in outline order.

5.1 Managing mobile devicesBasic, advanced and third-party management, BYOD, company-owned devices and offboarding.
What it means
This objective covers comparing basic, advanced and third-party mobile management, applying basic mobile policies, gaining visibility and control over company-owned and personal (BYOD) devices, and offboarding devices when users leave or devices are lost.
What to understand
Basic management needs no agent and can enforce a screen lock, show the device in the Admin console and wipe the Workspace account. Advanced management adds the Android Device Policy app or an Apple MDM profile, enabling stronger passcode rules, app management, device approvals, work profiles on Android and full device wipe for company-owned devices. Third-party management turns off Google's endpoint management in favour of another EMM. Company-owned devices can be registered by serial number to unlock more control. Account wipe suits BYOD; device wipe suits lost company phones.
How it shows up
A device requirement or a lost or departing device is described, and you choose the management level and wipe type.
Common confusion
Using a full device wipe on a personal phone when an account wipe removes only work data.
5.2 Managing Chrome browsersBrowser enrollment, policies, updates and extension control.
What it means
This objective covers configuring browser policies such as offline access and update behaviour, enrolling Chrome browsers and applying policies to them, and allowing, blocking or force-installing extensions and apps for OUs or groups.
What to understand
Browsers are enrolled with an enrollment token so they appear in the Admin console and receive machine-level policy, even before anyone signs in. Managed user profiles, created when users sign in with their Workspace account, receive user-level policy. Browser policies sit in the OU of the enrolled browser, which can differ from the user's OU. Extension settings can allow or block by ID or permission, and force-install required tools. Update policies can keep browsers current or pin a version for testing.
How it shows up
A browser security or extension requirement is described, and you choose enrollment, policy level and extension settings.
Common confusion
Assuming user-level policy reaches a browser where the user never signed in; machine-level policy needs enrollment.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Basic mobile management

    Agentless management with screen lock enforcement and account wipe.

    Remember
    No app install needed on the device.
    Tested as
    Light-touch BYOD.
    Trap
    Expecting full device wipe.

  • Advanced mobile management

    Uses the Device Policy app or an Apple MDM profile for deeper control.

    Remember
    Enables app management, device approval and work profiles.
    Tested as
    Regulated teams and company devices.
    Trap
    Forcing it on BYOD without need.

  • Third-party management

    Hands mobile management to another EMM.

    Remember
    Google endpoint management is turned off for those users.
    Tested as
    Existing MDM scenarios.
    Trap
    Running two management tools on one device.

  • Work profile

    A separated container for work apps on Android.

    Remember
    Account wipe removes only the work profile.
    Tested as
    BYOD privacy.
    Trap
    Thinking admins can see personal apps.

  • Device approval

    Requires admin approval before a device can sync work data.

    Remember
    Available with advanced management.
    Tested as
    Access control on new devices.
    Trap
    Approving after data has already synced.

  • Account wipe

    Removes Workspace data and the account from a device.

    Remember
    Leaves personal data in place.
    Tested as
    Leaver and BYOD scenarios.
    Trap
    Choosing device wipe for a personal phone.

  • Device wipe

    Factory-resets the whole device.

    Remember
    Use on lost company-owned devices.
    Tested as
    Lost device scenarios.
    Trap
    Using it on BYOD.

  • Company-owned inventory

    Registers corporate devices by serial number.

    Remember
    Marks devices as company-owned for stronger control.
    Tested as
    Corporate fleet questions.
    Trap
    Treating all devices as personal.

  • Chrome browser enrollment

    Registers a browser with a token so it receives machine-level policy.

    Remember
    Applies before any user signs in.
    Tested as
    Browser management questions.
    Trap
    Relying on user sign-in alone.

  • Extension force-install

    Installs a required extension automatically on managed browsers.

    Remember
    Users cannot remove it.
    Tested as
    Rollout scenarios.
    Trap
    Asking users to install it manually.

  • Extension blocklist

    Blocks extensions by ID or by permissions they request.

    Remember
    Allowlist mode blocks everything not approved.
    Tested as
    Risk reduction.
    Trap
    Blocking one extension while allowing all others with the same permissions.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Basic vs. advanced vs. third-party management

ConceptMeaningKey differenceCommon trap
Basic Agentless screen lock and account wipe Least intrusive, least control Choosing it for a regulated fleet
Advanced Device Policy app or Apple MDM App control, approval, work profiles, device wipe Imposing it on BYOD without need
Third-party External EMM manages devices Google management off for those users Expecting Google policies to still apply

Account wipe vs. device wipe

ConceptMeaningKey differenceCommon trap
Account wipe Removes work account and data Keeps personal content Using device wipe on BYOD instead
Device wipe Factory reset of the device Erases everything Running it on an employee's own phone

Enrolled browser vs. managed profile

ConceptMeaningKey differenceCommon trap
Enrolled browser Browser registered with a token Machine-level policy, any user Forgetting the browser OU
Managed profile User signed in with Workspace account User-level policy follows the user Assuming it covers guest users of that browser

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Device wipe for a leaver

    What candidates pick
    Wipe the leaver's personal phone to remove company mail.
    Why it looks right
    It guarantees the data is gone.
    Why it's wrong
    It also erases personal data; an account wipe removes only work data from a BYOD device.

    Clue to watch for The device belongs to the employee.

  2. Advanced for everyone

    What candidates pick
    Turn on advanced management for all users to be safe.
    Why it looks right
    More control sounds safer.
    Why it's wrong
    It requires an agent or profile on personal devices and can deter adoption; scope it to the OUs that need it.

    Clue to watch for Only one team handles regulated data.

  3. Basic meets approval needs

    What candidates pick
    Use basic management to require approval of new devices.
    Why it looks right
    Basic management lists devices.
    Why it's wrong
    Device approval needs advanced management.

    Clue to watch for New devices must be approved before syncing.

  4. User policy for kiosks

    What candidates pick
    Apply user-level Chrome policy to shared lab browsers where nobody signs in.
    Why it looks right
    Most Chrome policy is configured per user.
    Why it's wrong
    Without sign-in, only machine-level policy from enrollment applies.

    Clue to watch for Browsers are shared and users do not sign in.

  5. Manual extension install

    What candidates pick
    Email users instructions to install the required extension.
    Why it looks right
    It avoids policy work.
    Why it's wrong
    Force-installing by OU guarantees deployment and stops removal.

    Clue to watch for Every user must have the extension.

Answer framework

Apply these steps to any Section 5 endpoint scenario.

  1. Identify the endpoint (phone, tablet or Chrome browser) and who owns it, since company-owned and personal devices call for different levels of control.
  2. Match the requirement to a management level: basic for screen lock and account wipe, advanced for approval, app control and work profiles, third-party for an existing EMM.
  3. For lost or departing devices, choose account wipe on personal devices and device wipe on company-owned ones.
  4. For browsers, enroll them with a token for machine-level policy and confirm which OU the browser sits in.
  5. Apply extension allow, block or force-install and update policies to the narrowest OU or group, then confirm in the device and browser lists that they took effect.

Practice question

A company issues Android phones to field engineers and also lets office staff read mail on personal phones. Field engineer phones must be fully wiped if lost, and office staff want their personal data untouched. Which approach meets both needs?

Want more like this? The Workspace Admin practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Because this section is worth about 10%, plan a focused study block rather than days of practice. Begin with mobile management. Draw a three-column table for basic, advanced and third-party management and fill in passcode enforcement, app control, device approval, work profiles, account wipe and device wipe. Then add a column for company-owned versus personal devices. If you have a test tenant, enroll a spare phone under basic management, switch to advanced, and run an account wipe to see what is removed.

For Chrome, generate an enrollment token, enroll a browser on a test machine, and place it in a separate OU from your test user. Force-install one extension and block another by permission, then check the browser's policy page to see which settings applied and from where. Finish by answering practice questions that ask you to choose between wipe types and between basic and advanced management, since those distinctions appear often.

FAQ

How much of the Workspace Admin exam is Section 5?

Managing browsers and endpoints is about 10% of the exam, the smallest section, which works out to around 5 or 6 questions.

Does basic mobile management require an app on the device?

No. Basic management is agentless. Advanced management uses the Android Device Policy app or an Apple MDM profile.

When should I use account wipe instead of device wipe?

Use account wipe for personal devices, because it removes only Workspace data. Use device wipe for lost or stolen company-owned devices.

What is the benefit of marking devices as company-owned?

Company-owned devices can receive stronger controls, including full device wipe and tighter policies, than personal devices.

Why do enrolled browsers need their own OU?

Machine-level Chrome policy follows the OU where the enrolled browser sits, which can differ from the user's OU, so placing browsers deliberately controls which policies they get.

Can I stop users removing a required extension?

Yes. Force-installing an extension through policy installs it automatically and prevents users from removing it.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered mobile management levels, BYOD and company-owned devices, wipes, and Chrome browser policies. Check you can choose the right control for each device.

Take the Workspace Admin practice test Check your Workspace Admin readiness

Keep going