Blocking and Allowing AI on School Chromebooks: The Complete Admin Console Map (2026)

Current status: Last reviewed September 7, 2026. Google renames menus and ships new AI surfaces several times a year. Every path and policy below was read from Google's documentation on the review date; items marked confirm in your console could not be verified from a public page. Recheck before a board or parent communication.

There is no “turn off AI” switch for a school Chromebook. There are at least twelve switches, they live in four different places, three of them default to on, and one of the biggest surfaces has no switch at all. A technology director who searches for how to block AI on Chromebooks finds student newspapers, forum threads, and a February 2024 blog post, none of which lists the controls Google ships today.

This page is the list. Every row names the surface a student actually meets, the exact Google Admin Console path or Chrome policy that governs it, what Google says the default is for Education accounts and users under 18, and what the control leaves open. It was checked against Google’s documentation on September 7, 2026. It ends with the decision most districts arrive at after working through the table: block what should never be reached, allow a small approved set, and put the district’s rules on the approved surfaces at the moment of use.

If you want the three district templates that go with this work (the application register, the tool vetting template, and the acceptable-use checklist), they are in the free district AI governance starter kit.

The map

Paths are written as Google’s help pages write them. “Policy” means a Chrome or ChromeOS policy set under Menu > Devices > Chrome > Settings > User & browser settings in the Admin Console. Where Google’s public documentation does not state a default or a detail, the row says “confirm in your console” rather than guessing.

Two things stand out once the rows are side by side. The first is that the two highest-traffic surfaces, Gemini in Classroom and Chrome’s built-in features, default to on for Education accounts, and the single most visible surface, AI Overviews in Search, has no switch. A district that has not touched these settings has AI on. The second is that every “cannot do” cell describes the same gap: the controls act on addresses, apps, and service switches, and AI increasingly arrives inside sites and apps the district has already allowed.

What no console setting covers

1. AI Overviews on google.com. Google states they cannot be turned off.
2. AI inside allowed sites. Writing assistants embedded in design, quiz, and learning platforms, and Copilot inside allowed Microsoft 365 web apps, sit behind domains the district must allow.
3. Cross-app Gemini reach. Per-app Gemini toggles do not fence the data those apps hold.
4. The Classroom Gemini tab stays visible unless both the Gemini app and NotebookLM services are off.
5. Guest and personal sessions and sideloaded extensions escape user-level policies.
6. GenAiDefaultSettings value 1 leaves features on; it only stops training use.
7. Devices the district does not manage: phones, home computers, and a friend’s laptop.

That list is the honest limit of blocking. It is also the list that makes a pure blocklist strategy expensive to maintain: every new Google surface, every vendor that adds an AI panel to an approved tool, and every student who signs into a personal account reopens the question.

Three configurations districts actually run

Configuration 1: block everything the console can reach. Gemini app off, Gemini for Workspace off, Gemini in Classroom off for student organizational units, NotebookLM off, GenAiDefaultSettings at 2, AIModeSettings at 1, GeminiSettings at 1, Web Store in block-all mode with an allowlist, a URL blocklist for the known chatbot domains, Android apps disabled, guest mode disabled, sign-in restricted to the district domain. This is the right configuration for early elementary. It still leaves AI Overviews in Search and AI inside allowed sites, and it removes tools some teachers and high school courses legitimately want.

Configuration 2: Google on, everyone else off. Gemini in Classroom and the Gemini app on for the grade bands the district has approved, with under-18 protections; third-party chatbots on the URL blocklist; Web Store on allowlist mode. This is common in Google-native districts. Its weakness is that “on” means on for every purpose: the same Gemini that helps a student outline an essay will also write it, and the console has no setting for “hints only in English class.”

Configuration 3: a small approved set, allowed with rules. The district approves specific products for specific grade bands, blocks the rest, and applies its policy on the approved surfaces at the moment of use: which classes may use the tool, what a student may ask for, what leaves the device, and what gets blocked when an unapproved AI interface appears inside an allowed site. This is the configuration the rest of this page is about, because it is the one the console cannot produce on its own.

Allow with rules: what the console cannot do, done at the point of use

The Admin Console decides whether a student can reach a surface. It has no opinion about what happens once they are there. That is where a district policy layer on the managed browser does its work, and it is the reason Tenet exists.

Tenet by TrueMadeAI is K-12 AI governance software. Tenet Edge applies district and classroom policy on supported direct-use AI surfaces on managed Chrome. On a Chromebook fleet, it adds three things the console does not have:

• Rules on approved surfaces. On supported products such as ChatGPT, Claude, Gemini, Microsoft Copilot, and the student experiences in MagicSchool, SchoolAI, and Brisk, Tenet applies the district’s guidance and, in Tenet District, the class, subject, teacher, and schedule context, so “allowed” can mean “allowed for brainstorming in this course, not for the draft.” The supported-product capability matrix lists each surface and its boundary.
• On-device data-loss prevention. Supported plain-text prompt checks run before the text leaves the device, so a student pasting a classmate’s name or a health detail into an approved tool is stopped at the moment of use rather than found in a log later.
• Blocking of unapproved AI interfaces inside allowed sites. When the district enables the control, Tenet checks known interface signatures and local multi-signal patterns for AI chat and writing surfaces that are not on the approved list and blocks the interface while leaving the surrounding site available. Grammarly AI web experiences are one current example. This is the gap the URL blocklist cannot close.

Tenet does not replace the console. The rows above are still the right place to disable services, restrict sign-in, and block domains. Detection and blocking are distinct from deep governed support, coverage depends on the web surface, vendors change their interfaces, and no heuristic can guarantee detection of every AI interface. District allowlists and bypasses remain authoritative. The shadow AI guide explains the difference between inventory, detection, blocking, and governed support in detail.

Tenet Basic is free and applies one district-wide baseline without roster setup. Try Tenet Basic, or request a Tenet District conversation if you need classroom, subject, and schedule context.

A configuration checklist you can run this week

1. Export the current state. For each row in the map, record the setting as it is today, by organizational unit. Most districts find at least one surface on that nobody decided to turn on.
2. Decide by grade band, not by product logo. The AI product age and consent table tells you which products may admit which students at all; the console should never allow a surface the vendor’s terms exclude.
3. Set the umbrella policies first. GenAiDefaultSettings, AIModeSettings, GeminiSettings, and the Gemini for Workspace switches determine most of the default exposure.
4. Close the bypasses. Guest mode, sign-in restriction, multiple sign-in, Android apps, and Web Store mode are where a blocklist quietly fails.
5. Write the approved list down in the AI application register with the console setting that enforces it, and publish it if your state requires a public list.
6. Put rules on the approved surfaces. Decide what “allowed” means in each course, and use a point-of-use control for the part the console cannot express.
7. Recheck quarterly. Google shipped new AI surfaces in Chrome, ChromeOS, Search, and Classroom in every quarter of the last year.

The K-12 AI acceptable use policy checklist covers the policy text that should sit above this configuration, and the guide to how districts govern student AI tools explains the four-layer model that separates access control from in-surface policy.

What this page does not establish

This page does not determine:

• that a setting listed here still exists under the same name tomorrow;
• the default state of any setting in your domain, which depends on plan, purchase history, and prior admin changes;
• that a URL pattern reliably blocks a Google Search property;
• that any product is instructionally appropriate for a grade band; or
• that Tenet can detect or govern every AI interface on every site.

Verify in your own console, and read the dated capability matrix before relying on a specific Tenet behavior.

Sources

• Turn the Gemini app on or off for users, Google Workspace Admin Help
• Manage access to Gemini features in Workspace services
• Gemini Apps in Google Workspace for Education, Google Gemini Help
• Turn NotebookLM on or off for users
• AI Overviews and AI Mode in Google Search, Google Search Help
• Set Chrome policies for generative AI features
• Manage generative AI features with a default policy
• Chromium policy definitions, Generative AI group
• Allow or block apps and extensions
• Allow or block websites
• Set ChromeOS device policies

Frequently asked questions

Can a district turn off Google AI Overviews on student Chromebooks?

No. Google’s own help states that AI Overviews are a core Google Search feature and cannot be turned off. A user can choose the Web filter after a search, and a district can enforce SafeSearch, but neither removes AI Overviews from results. The AI Mode entry points in Chrome are a separate control (the AIModeSettings policy).

Does turning off the Gemini app also turn off Gemini in Docs and Gmail?

No. The Gemini app is a Workspace service switch under Generative AI, and Gemini features inside Docs, Gmail, and the other apps are governed by the separate Gemini for Workspace settings. Google’s help says turning off the app does not affect other AI features in Workspace services.

Is Gemini on for students by default in Google Workspace for Education?

Google’s admin guidance states that Gemini in Classroom is on by default for users of all ages, and its Gemini help for Education lists the Gemini app as available to all ages, with stricter content policies for users under 18. Districts should verify the current state in their own console rather than assume it is off.

Can the Chrome URL blocklist stop AI inside a site the district allows?

No. The URL blocklist matches addresses, not page content. AI features inside an allowed site, such as writing assistants embedded in a learning platform or Copilot inside allowed Microsoft 365 web apps, are not addressable by URL blocking. That gap is why interface-level blocking exists as a separate layer.

What is the difference between GenAiDefaultSettings value 1 and value 2?

Value 1 allows Chrome and ChromeOS generative AI features without using the district’s data to improve Google’s models. Value 2 turns the features off. Google’s documented default for Workspace for Education is value 1, so features stay on and only the training use is disabled. A district that wants the features off must set value 2 or the per-feature policies.

Does blocking AI on Chromebooks solve the district’s AI policy problem?

Only for the surfaces you block, only on managed devices, and only until the next vendor change. Guest sessions, personal accounts, phones, home computers, and AI inside approved tools remain. Most districts end up with a small approved set, a blocklist for the rest, and rules that apply at the moment of use on the approved surfaces.