You need to first enroll your Chrome devices to enforce policies on them set in your Admin console. Each device you enroll adheres to the Chrome settings you set in the Admin console until you wipe or recover the device. Note that if you "powerwash" the device, you will not be able to enroll it unless you reset it.
New devices should always be manually enrolled. Devices that have been previously enrolled, deprovisioned, wiped and placed back into pending are eligible for automatic enrollment if the policy is enabled.
Manual enrollment
Manually enroll the device before anyone (including administrators) signs in to the Chrome device. If a user signs in before you enroll the device, the device ignores the Admin console settings, and you must wipe the device and restart the enrollment process.
- Turn on the Chrome device and follow the on-screen instructions until you see the sign on screen. Do not sign in yet.
- Before signing in to the Chrome device, press the key combination Ctrl-Alt-E. The enrollment screen appears.
- Enter the username and password from your Google admin welcome letter, or the username and password for an existing Google Apps user on your account that has eligibility to enroll. You can control which users can enroll in your domain through the 'Enrollment Permissions' policy.
- Click Enroll device. You will receive a confirmation message that the device has been successfully enrolled.
By default, devices are enrolled into the top-level user organization of your domain. To enroll a device into a specific organizational unit, change the Device Enrollment user setting to 'Place Chrome device in user organization'. Also, if you have a policy set that controls which organizational units can enroll, make sure it’s set so that your desired users can enroll.
Information taken from 'Chrome for Work and Education Help' on 5/4/15. For more information, see https://support.google.com/chrome/a/answer/1360534