Chromebook Access Control

Summary

This page explains who controls what on a Chromebook or in the Chrome browser — for IT, Academic Technology, school leadership, teachers, and parents. It's written as a collaboration between IT, Academic Technology, and school leadership, and while the subject is technical, it's meant to be understood by anyone.

If you are setting up a new Chromebook, start with IT's Chromebook Setup Guide for account creation and first sign-in, then use Recommended Setup below for the account order. If a Chromebook is already set up and school apps are missing, skip to Fixing a Chromebook That's Already Set Up.

Control happens in layers, and each layer only governs what's inside it:

1. Network — the wifi or cellular connection the device is using
2. Device — settings owned by whoever set up the Chromebook first (the "owner")
3. Account — settings tied to whichever account is signed in

These layers are strictly ordered: a network-level block can't be overridden by device or account settings, and a device-level allowance (like guest mode being on) can let someone bypass account-level controls entirely.

The account layer has an important split that trips people up: a Chromebook can have a personal account and a school (UPrep) account signed in side by side, and each is controlled independently. A parent managing the personal account through Google Family Link does not thereby gain control over the UPrep account, and UPrep does not gain any control over the personal account. The rest of this page covers each layer, with the account layer split into personal and school accounts.

1. Network Controls

Before traffic reaches a device, it passes through whatever network the device is connected to — school wifi, home wifi, cellular, or a public network (like a coffee shop).

	Controller	Control Method
School Wifi	UPrep	Professional Firewall
Home Wifi	Family	Router Settings
Cellular	Family	Cell-Provider Parental Controls
Public Wifi	None	None

School wifi is managed by UPrep IT using a category filter on the school firewall. For a list of blocked content categories, contact IT.

Home and cellular networks are managed by whatever router or cell plan a family uses. Capabilities vary by provider — check with your manufacturer or carrier for specifics.

Public networks have no controls at all. Unless a device is restricted to only known networks (school and home), a student can bypass every other network-level control simply by connecting to public wifi elsewhere.

VPNs are a network back door: they tunnel traffic past a firewall in encrypted form, so the firewall can see that a VPN is in use but not what's being accessed through it. UPrep does not block VPN use.

Recommendation: combine network-level filtering with account-level controls (below) for meaningful protection — network controls alone can be bypassed by switching networks.

2. Device Owner Controls

The first account signed in to a new Chromebook becomes its owner account, with permissions no other account on that device has. UPrep student Chromebooks are family-owned, so this should usually be a parent, who should be the first account to log in to a new device.

What the owner can control, per Google's documentation:

• Time zone
• Sign-in permissions — who can add or use an account on the device, and whether guest browsing is allowed
• Wi-Fi network preferences

That's the complete list. The owner cannot set screen time limits, block apps, filter content, or supervise activity inside any account's session — those live at the account layer, covered below. An owner's reach is limited to deciding who and what is allowed on the device, not what happens once someone's signed in.

Recommended Setup

Set the device up in this order. Step 3 is what school requires; the rest are family choices.

1. Sign in first with a parent's Google account. Whoever signs in first during setup becomes the owner, and ownership can't be transferred afterward — the only way to change it is to factory reset and set the device up again with the parent's account first. Back up anything important before doing this.
2. Disable guest browsing and restrict sign-in to known accounts, using Google's instructions. Without this, a student can sidestep every account-level control just by using the guest profile or a second, unmanaged account.
3. Add the student's UPrep account as its own user on the device, from the Chromebook's sign-in screen — "Add Person", then sign in with their @universityprep.org address. This is the account they use for schoolwork, and adding it this way is what delivers UPrep's force-installed class apps, school bookmarks, and single sign-on to school services. If a supervised child account is already on the device, Google will ask for a parent's password before the new user is added — that's expected. The first sign-in also prompts a password change; see IT's Chromebook Setup Guide for the password rules.
4. Optionally, add the student's personal Google account as its own user too, and supervise it with Family Link. Many families skip this — a student does not need a personal Google account for school.
5. Consider blocking unknown networks on the device. This removes the public-wifi back door, at the cost of making it harder for the student to work from anywhere other than school or home.

:::warning "Add school account" is not the same as step 3

Inside a Family Link–supervised personal profile, Google offers a separate Add school account option, which attaches the UPrep account to the child's supervised profile as a secondary account. That is a different, much narrower thing, and it does not install required class apps. It is a useful addition for families who want Family Link to cover schoolwork, but it is not a substitute for step 3. See Linking the Two for the full breakdown.

:::

If you want your parental controls to cover schoolwork too

Family Link cannot reach a UPrep account added as its own user in step 3 — that account is governed by UPrep's Workspace policies by design. Families who want their own controls in force while their student is doing schoolwork have one option: have the student work inside the supervised personal profile, with the UPrep account added there as a secondary account. Screen time, downtime, and content filtering then apply to schoolwork as well.

The trade-off is real: that session does not get UPrep's force-installed class apps, and UPrep has no way to override a block you've set. If you choose this route, be ready to approve the apps and sites your student needs for class quickly, so class isn't disrupted.

Third-Party Parental Control Apps

As the device owner, you're welcome to install any additional safety or parental-control app (Qustodio, Net Nanny, or similar) that you feel is necessary — UPrep doesn't endorse a specific product, and the choice is entirely up to your family. One caveat: our tech team can't troubleshoot login or app problems these tools cause while a student is using their UPrep account at school. Any conflicts from a third-party app will need to be resolved at home. See Can I install a parental control app on my child's Chromebook? for more.

Loaner Devices

UPrep loaner Chromebooks work differently: the school is the device owner, and device controls run through the on-site firewall rather than a family setup. Loaners aren't meant for long-term or heavy off-campus use — students should return them the same day unless a longer loan is arranged with IT because their own device is broken or unavailable. Families are expected to repair or replace their own devices promptly.

3. Personal Accounts and Family Link

A student's personal Google account (a @gmail.com address, or any personal address) is entirely under the family's control. UPrep has no visibility or authority over it whatsoever.

Parents manage this account using Google Family Link. Family Link is account-based, not device-based, so it only works if the device is also set up correctly — specifically, a parent needs to be the device owner (see above), otherwise a student can dodge Family Link entirely by creating an unsupervised second account or using guest mode.

With Family Link on the personal account, a parent can set screen time limits and downtime schedules, filter or block websites and content, and control which apps and Play Store content the account can access. UPrep has no recommendation on how a family should configure any of this — it's entirely up to each family's judgment.

4. The UPrep (School) Account

A student's UPrep account (@universityprep.org) is a Google Workspace for Education account. Whatever Google services and apps a student can use while signed in to it is determined entirely by UPrep's Workspace admin console — not by any setting the family controls.

These settings follow the account, not the device. UPrep does not enroll or manage family-owned Chromebooks, but the moment a student signs in with their UPrep account, UPrep's policies for that account apply. That's what gives the student:

• Force-installed class apps and extensions, pushed automatically to every session signed in with a UPrep account
• School bookmarks, managed centrally and kept up to date
• Single sign-on to school services — Schoology, Google Drive, the Veracross portal, and school email — without separate logins

This only happens when the UPrep account is signed in as its own user on the device (step 3 of Recommended Setup). If a required app is missing or broken, contact IT rather than troubleshooting Family Link settings — the UPrep account isn't something Family Link reaches, as explained next.

Linking the Two: What Actually Carries Over

There are two different ways a UPrep account can be present on the device, and they're not interchangeable:

1. As its own separate account, added at the Chromebook's sign-in screen alongside the personal account — this is what Recommended Setup above calls for, and it's the normal, expected setup. Signed in this way, the UPrep account is governed entirely by UPrep's Workspace admin console, not by Family Link — that's intentional, not a gap to close. It's the only way a student gets UPrep's force-installed required class apps and the rest of the Workspace-managed app catalog.
2. As a secondary account inside the personal account's Chrome browser — a convenience that lets a parent (or student) check UPrep email and use a small set of allowed apps, like Google Classroom, while browsing under the Family Link-supervised personal profile, without switching accounts. This does not give access to UPrep's managed apps or policies — it's an email and browsing convenience layered on top of the personal account, not a substitute for the actual UPrep account in #1.

Based on testing and on Google's documentation, here's exactly what the secondary-account convenience (#2) does and doesn't carry over:

Setting it up requires ChromeOS 89 or later, a personal account that is already managed by Family Link, and a parent's approval at the time it's added.

Carries over to the secondary UPrep account:

• Signing in to websites using the UPrep account
• Switching to the UPrep account to check email
• Switching to the UPrep account for a small set of allowed apps and extensions, like Google Classroom, to do schoolwork under parent supervision
• Family Link screen time limits, downtime schedules, and content filtering, which govern the whole supervised profile — including what the student does while switched to the secondary UPrep account

Does not carry over:

• Required class apps, or anything else UPrep manages centrally. App availability for a signed-in UPrep session is governed entirely by UPrep's Workspace admin console. When the UPrep account is only present as a secondary account, that governance doesn't reach it — you need the actual, separate UPrep account (#1) for required apps to force-install.

For the actual, separate UPrep account (#1): screen time limits, content filtering, and Play Store restrictions set through Family Link on the personal account don't extend to it. That's expected, not a bug. We independently tested this and got a consistent result: a Family Link screen time limit locked the personal account's session on a Chromebook while a separate UPrep account on the same device stayed fully usable.

Since there's no software-based screen time control that reaches the UPrep account, families who want to limit their child's overall screen time at home may want to rely on non-software approaches instead — for example, setting rules around where the device can be used or stored, such as not keeping it in a bedroom overnight.

The short version: a personal account is fully parent-controlled, the actual UPrep account is fully school-controlled by design, and the secondary-account convenience only grants the narrow set of items above — checking email, using a few designated apps, and website sign-in. It is not a general supervision layer over the UPrep account, in either direction.

Required Apps and Parental Controls

Because of the split above, whether a parental content or app block can prevent a required class app from working depends entirely on which account is doing the work:

• If the student does their schoolwork on their personal account (with the UPrep account only used as a secondary, per the allowlist above), a required app blocked by Family Link may simply not be available, since UPrep's force-install policy doesn't reach that session at all. There's no school-side override for this — it would need to be resolved by adjusting the family's own Family Link settings.
• If the student signs in directly with their UPrep account as the primary user, UPrep's Workspace policies apply fully, and required apps are installed for all students automatically, regardless of any personal account settings. If a required app has trouble installing in this case, we'll reach out to the family to help.

Fixing a Chromebook That's Already Set Up

If a student's Chromebook is missing school apps or bookmarks, or they're being asked to log in to school services over and over, the usual cause is that the UPrep account was never added as its own user on the device — only as a secondary account inside a personal profile, or not at all.

Check which setup you have. From the Chromebook's sign-in screen (sign out if you're signed in), look at the row of profile pictures:

• If you see a tile for the @universityprep.org account, it's set up correctly. Nothing to change. Log in with that account for access to UPrep-managed items.
• If the only tiles are personal accounts, the UPrep account is missing as a device user — follow the fix below.

You can also check from inside a session: select the time in the bottom right → Settings → People. A UPrep address listed under "Accounts" within a personal profile is the secondary-account setup, not the same thing.

The fix — no factory reset needed:

1. Sign out to reach the Chromebook's sign-in screen.
2. Select Add Person.
3. Sign in with the student's @universityprep.org address and password. On a device with a supervised child account, Google will ask a parent to approve the addition with their password.
4. Let the device sit on wifi for a few minutes after the first sign-in — this is when school apps and bookmarks install.
5. Have the student use that UPrep tile for schoolwork from then on.

If a personal account is already supervised through Family Link, leave it alone — it keeps working exactly as before. Adding the UPrep account as its own user does not weaken or remove any control you've set on the personal account, and it does not give UPrep any visibility into the personal account.

When a factory reset is needed: only if you want a parent to be the device owner and the student's account was the first one signed in during setup. Ownership can't be transferred any other way. This is optional — the UPrep account works correctly regardless of who owns the device. See Device Owner Controls for what ownership does and doesn't get you.

If the student's UPrep password doesn't work, or school apps still haven't appeared after a day, email Tech Support rather than adjusting Family Link settings.