Help center › Set up
Chromebooks from Google Admin
Districts that keep their Chromebooks in the Google Admin console need no CSV. On Admin › Import, the card Chromebooks from Google Admin connects your Google Workspace once; every Chrome device in the Admin console then appears as a device in Beacon and is refreshed each night. The Chromebook inventory page has the overview, and Chromebook asset management for schools puts the sync beside rooms, check-out and labels; this guide has the details.
What you need
- A Google Workspace administrator account that can view Chrome devices: a Super Admin, or a custom role with Services › Chrome Management › Manage Chrome OS devices (read only).
- Click Connect Google Admin, sign in to Google, and grant the permission to read Chrome devices. For People from Google Workspace, the same screen also asks to read users and group members; the Chromebook sync works with the devices permission alone. Beacon never asks for write access and never changes anything in Google.
- If your Workspace restricts third-party apps, a Workspace administrator allows Beacon's client ID once under Google Admin › Security › Access and data control › API controls › Manage third-party app access. The ID is shown on the card before you connect.
- Google currently shows an “unverified app” screen for these permissions; an administrator can continue past it (Advanced, then continue). The screen goes away once Google has verified Beacon.
The connection finishes only in the signed-in session of the administrator who clicked Connect. A connect link forwarded to someone else does nothing.
What is read, per device
| In Google | In Beacon |
|---|---|
| Serial number | The match key. Existing devices are matched by serial first; a device with the same asset tag but no serial of its own is adopted. |
| Annotated asset ID | The asset tag. Without one, the serial is used as the tag. A tag already set in Beacon is never blanked. |
| Model | Model, and the maker when the model name starts with one. |
| Status | Active → in service, or assigned when the annotated user is a person in Beacon with that email. Deprovisioned → retired. Disabled → lost (Google's own advice for lost or stolen devices). Anything else → in storage. |
| Annotated location | The site with that name or code. Otherwise a location: “Lincoln High School - Room 204” or “LHS / Cart 3” puts the device in that room at that site, and plain text (“Cart 3”) in a location at the device's own site, or at your only site. A device with no site in a district with several keeps the text as its room until someone gives it a site. |
| Device ID, org unit, OS version, last sync | Kept with the device for reference and for the Chromebook type's fields. |
Who signed in recently is kept as information. It becomes an assignment only when you turn on Also assign devices to their most recent Google user when the Admin console has no annotated user on the card (off by default): a device with no annotated user at all is then assigned to the managed user who signed in to it most recently, if that person is in Beacon. An annotated user always wins, even a name that is not an email address. The trade-off is stated on the switch: a shared device, such as a cart or loaner Chromebook, may be reassigned each night as different people sign in; a device somebody holds changes hands only when its most recent user changes, and a sync never unassigns. Nothing is ever deleted: a device that leaves Google stays as it was.
Your edits survive
After the first pass, status, tag, holder and site follow Google only when Google's own value changed since the previous sync, or when the Beacon field was empty. A technician's In repair or Loaner, a corrected tag, a check-out to someone else, or a move to another site or room all stay put while Google repeats itself; a deprovision, a re-tag, a new annotated user or a new location in Google are applied. A sync never unassigns a device.
When it runs
The first sync runs right after connecting; after that nightly at 02:00 in your organization's time zone, plus Sync now on the card. Each pass is listed under the card with its counts (seen, added, updated, deprovisioned). If Google refuses a sync, because the account lost its admin rights or access was revoked, the card says so and asks you to reconnect; a temporary quota answer from Google only fails that pass, and the next one tries again.
Disconnecting
The quiet link on the card deletes the stored token and revokes the grant at Google. The synced devices stay. Reconnecting with a different Google account revokes the previous account's grant.