Deploy the GlobalProtect App for Android on Managed Chromebooks Using Workspace ONE

1. Set up the Google Admin console.
   The Google Admin console enables you to manage Google services for users in your organization. Workspace ONE uses the Google Admin console for integration with Chromebooks.
   1. Log in to the Google Admin console as an administrator.
   2. From the console, select SecurityAdvanced SettingsManage API client access.
   3. In the Client Name field, enter the Client ID that was provided to you by Workspace ONE.
   4. In the One or More API Scopes field, enter the following Google API scopes to which you want to control application access:
      Each API scope must be separated by a comma.
      • https://www.googleapis.com/auth/chromedevicemanagementapi
      • https://www.googleapis.com/auth/admin.directory.user
      • https://www.googleapis.com/auth/admin.directory.device.chromeos
   5. Click Authorize.
   6. Enable Chrome Management - Partner Access for device policies (Device ManagementDevice SettingsChrome ManagementDevice Settings) and user policies (Device ManagementDevice SettingsChrome ManagementUser Settings).
2. Register Workspace ONE as your Enterprise Mobility Management (EMM) provider for Google.
   To manage Chromebooks using Workspace ONE, you must register Workspace ONE with the Google Admin console.
   1. Log in to your Workspace ONE console.
   2. Select DevicesDevices SettingsDevices & UsersChrome OSChrome OS EMM Registration.
   3. Enter the Google Admin Email address that you used to access the Google Admin console.
   4. Click REGISTER WITH GOOGLE. You will be redirected to the Google authorization page, where you can obtain a Google authorization code.

   5. Enter the Google Authorization Code that you obtained from the Google authorization page.
   6. Click AUTHORIZE to complete the registration.

3. Enroll Chromebooks with Workspace ONE.
   Before you can begin managing Chromebooks using Workspace ONE, you must enroll and sync your Chromebooks to Workspace ONE.
   1. From your Chromebook, press CTRL+ALT+E to open the enterprise enrollment screen.
   2. Enter the username and password from your Google Admin welcome letter or enter your existing G Suite user credentials.
   3. Click Enroll device. You will receive a confirmation message when the Chromebook is successfully enrolled.
   4. Log in to your Workspace ONE console.
   5. Select DevicesDevices Settings & UsersChrome OS.
   6. Click Device Sync to sync all enrolled Chromebooks to Workspace ONE.
4. Add the GlobalProtect app for Android to a Chrome OS profile on Workspace ONE.
   The Application Control profile enables you to add apps from Google Play and the Chrome Web Store.
   1. Log in to your Workspace ONE console.
   2. Select DevicesProfiles & ResourcesProfiles to ADD a new Chrome OS profile.

   3. Select Chrome OS (Legacy) from the platform list.

   4. Configure the General settings.
   5. Configure the Application Control settings.
      1. Enter the GlobalProtect App ID displayed in the Google Play URL (com.paloaltonetworks.globalprotect).

      2. Enter the app Name.
      3. Specify whether you want to Pin App to Shelf. Enter Y to pin the app to the Chromebook app shelf.
      4. SAVE & PUBLISH your changes.