Option A: Preconfigure Office for the web in Microsoft 365 for your users

For administrators who manage ChromeOS devices for a business or school.

Google recommends that you preconfigure Office for the web in Microsoft 365 for your users. When users sign in, they can access their files and edit their documents without additional configuration or authentication.

What you need

Automatic Microsoft 365 configuration, also referred to as preconfigured setup, has the following additional requirements, as well as those listed in Overview.

• Single Sign On (SSO):
  • SSO with Microsoft Entra ID (previously called Azure Active Directory)—Automatically signs users into Office for the web.
  • SSO with a third-party identity provider (IdP) via SAML as well as integration between the third-party IdP and Microsoft Entra ID. For details, read Information about how to set up and test third-party IdP below.
• Account limitation. When you follow the instructions to Integrate Microsoft OneDrive into the Files app, make sure that you complete the step to limit accounts that can be used for the Microsoft OneDrive integration.

Information about how to set up and test third-party IdP

How to

Step 1: Accept use of the Microsoft Connect OneDrive ChromeOS app

As a Microsoft Azure tenant administrator, you need to consent on behalf of your users to the permissions that the Connect OneDrive ChromeOS app requires. This helps to ensure seamless automated integration.

Note: This step grants tenant-wide admin consent. Read about how you can restrict consent.

1. Consent: Grant the required permissions to the Connect OneDrive ChromeOS app in Entra ID. Click here to consent.
   Note: This grants tenant-wide admin consent for the following permissions to the Connect OneDrive ChromeOS app:
   • Microsoft Graph / Files.ReadWrite.All
   • Microsoft Graph / offline_access
   • Microsoft Graph / User.Read
2. Validate: Follow the steps provided here in Microsoft Entra documentation—Search for Connect OneDrive ChromeOS, client_id 0116c0d4-d938-4688-b4a3-ba68a88af1f1, to review the granted permissions. No further action is needed.

Step 2: Install the Microsoft 365 PWA on devices

Microsoft 365 for the web provides a progressive web app (PWA) to seamlessly access services on ChromeOS devices. We recommend the force installation of the Microsoft 365 PWA.

1. Sign in with an administrator account to the Google Admin console.

   If you aren’t using an administrator account, you can’t access the Admin console.

2. Go to Menu  Devices > Chrome > Apps & extensions > Users & browsers.
3. To install the Microsoft 365 PWA for everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
4. Add the Microsoft 365 PWA:
   1. Point to Add Add by URL .
   2. Enter the PWA URL. Use https://microsoft365.com/?from=Homescreen.
   3. For Open website in, choose Separate window.
   4. Click Save.
5. Configure policies. In the panel that automatically opens when you install Microsoft 365 PWA, force-install Microsoft 365 PWA for users:
   1. Under Installation policy, select Force install + pin to ChromeOS taskbar—Installs Microsoft 365 PWA automatically and pins it to the taskbar. Users can’t remove it from their devices.
   2. Click Save.

Step 3: Integrate Microsoft OneDrive into the Files app

OneDrive is required to open and edit files using Office for the web in Microsoft 365. By default, for enterprise users, the Microsoft OneDrive integration setting is set to Disable Microsoft OneDrive Files app integration—OneDrive integration into the Files app is turned off and users can't turn it on to set up Microsoft OneDrive on their devices.

Follow these steps to activate the OneDrive integration into the Files app. And, if needed, you can limit Microsoft OneDrive to specific Entra ID accounts.

1. Go to  Menu  Devices > Chrome > Settings. The User & browser settings page opens by default.

   Requires having the Mobile Device Management administrator privilege.

2. To apply the setting to all users, leave the top organizational unit selected. Otherwise, select a child organizational unit.
3. Go to Content.
4. Click Microsoft OneDrive integration.
5. Configure OneDrive integration into the Files app. Choose Automatically integrate Microsoft OneDrive into Files app.
   When users sign in to a managed user session on a ChromeOS device, OneDrive is automatically integrated into the Files app, without user interaction.
6. Limit accounts that can be used for the Microsoft OneDrive integration. Enter your Microsoft domain name. Enter no more than one identifier.
7. Click Save.

Step 4: Set up Office document handling

1. Go to  Menu  Devices > Chrome > Settings. The User & browser settings page opens by default.

   Requires having the Mobile Device Management administrator privilege.

2. To apply the setting to all users, leave the top organizational unit selected. Otherwise, select a child organizational unit.
3. Go to Content.
4. Click Microsoft Office documents.
5. Download Office documents without first opening them in the basic editor.
   1. Select Preview off (recommended): Download Office documents directly.
   2. Click Save.
6. Configure the cloud upload flow for Microsoft OneDrive and Microsoft 365. Choose Microsoft 365: Automatically enable Microsoft OneDrive upload and Microsoft 365 PWA file handling.
   Sets up the cloud upload flow for Microsoft OneDrive and the optimized Office for the web experience automatically. Files with matching file formats are moved to Microsoft OneDrive and handled by the Microsoft 365 PWA when users open them.
7. Click Save.

Let users know how it works

If you choose to automatically integrate OneDrive into the Files app and install the Microsoft 365 PWA, some users might not realize that they can now access their data that is stored in OneDrive and use Microsoft 365 on the web to open and edit Office files on their ChromeOS devices. Users who authenticate with Microsoft Entra ID on the device sign-in screen don’t need to re authenticate to use Office for the web.

Moving files to OneDrive

Office for the web in Microsoft 365 requires files to be stored in OneDrive. So, when users attempt to open an Office file from their local storage, they’re prompted to move it to Microsoft OneDrive before opening with Office for the web. When users open the second Office file locally, they can choose to move local files to OneDrive without asking each time. Later on, users can use Settings to reactivate notification.

For files that are already in OneDrive, users can open the file directly in Office for the web. No file upload is needed.

Any changes that users make to files are saved to OneDrive. They can find their files in the Microsoft OneDrive folder in the Files app.

Users can create new files by clicking the Microsoft 365 icon on the shelf.

Changing OneDrive Settings

In Settings on their ChromeOS devices, users can temporarily disconnect OneDrive at any time. For example, they might need to debug or switch accounts. During setup in the Admin console, if you choose Automatically integrate Microsoft OneDrive into Files app, OneDrive automatically reactivates the next time they open a Microsoft 365 file.

1. On the ChromeOS device, go to SettingsAdvancedFilesOneDrive.
2. Next to the signed-in user ID that you want to disconnect, click Remove access.

Changing the app that opens your file

From time to time, users might want to choose between Office for the web in Microsoft 365 and other productivity apps such as Google Workspace, to open their documents. In the Files app, they can right-click the file that they want to open and choose to open it using their preferred app.

Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.