Rule 8 · Action: Block · Trigger: File downloaded · Scope: Managed Browsers OU · Context: CEP-Unmanaged Profiles

Unmanaged profile — block all downloads

Condition: URL matches the Everything regex; context condition: access level CEP-Unmanaged Profiles (device.chrome.management_state != CHROME_MANAGEMENT_STATE_BROWSER_MANAGED). Expected message: “You are not allowed to download any files on non-corporate profiles.”

ExecuteBlock expected (unmanaged)
  1. On a managed browser (enrolled in the Managed Browsers OU), open a Chrome profile that is not a managed corporate profile — or a guest/local profile.
  2. Try each download:
clean-sample.txt name-ssn-ccn.csv name-dob-email.csv

Note the clean file is included deliberately: this rule must block every download in the unmanaged context, independent of content.

Control caseAllow expected (managed)

Repeat the same downloads in the managed corporate profile: clean-sample.txt must succeed (the PII files may still be blocked — but by rule 5, with the PII message, not this rule's non-corporate message).

Pass criteria
  1. Any download attempt on a non-managed profile is blocked with the non-corporate message.
  2. The managed profile downloads the clean file normally.
  3. Block messages differentiate correctly between this rule and the PII rule.