Version of Google Chrome (Wrench-> About Google Chrome): M50
Version of MSI (if applicable): N/A
Using group policy settings? N/A

Currently (M50) users may mark specific origins as 'never attempt to save password', however this is not configurable by policy.

Rather than paving over user preferences, it would be nice to offer administrators the ability to blacklist particular origins for their single-sign-on infrastructure.  While this doesn't make particular sense for Google where the SSO password is also used to encrypt the password manager, it may make sense for other orgs that want to exclude syncing of their enterprise passwords to personal accounts.