A few more details:

I believe the avatar was initially the generic person until my gsuite sessions timed out and I had to sign in again. However, gmail doesn't periodically log me out, so I've never signed in with my gmail account on Chrome 69.

This also affects my laptop running Windows 10 Enterprise.

I would not be surprised if the underlying issue is that if Chrome has only received the X-Chrome-ID-Consistency header for secondary accounts, it will show the first as the "signed in" avatar while not actually signing you in.

I have identical behavior on my Chrome 69.
4 logged in google accounts, 2 of which are 2 g-suite edu accounts. The 'primary' account is not the avatar shown, instead one of the edu accounts avatar is shown.

Chrome Version	69.0.3497.100	 
Account Consistency	DICE migration	 
Signin Status	Not Signed In	 
TokenService Load Status	Load credentials finished with success

I do NOT have advanced protection enabled on any of the 4 accounts.

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36

I have had this behavior since I got the 69.x update

Thanks for filing this bug!

Waiting for the actual product owner to triage, but looping in some more folks in the meantime to get this started.

Unable to reproduce the issue on chrome reported version# 69.0.3497.100 using Mac 10.12.6 with steps mentioned below:
1) Launched chrome version# 68.0.3440.106 and signed into chrome from Chrome://settings
2) Updated chrome to M-69(69.0.3497.100), clicked on avatar icon, able to see account signed in already.

@Reporter: Could you please let us know if the issue is specific to Mac 10.10.5, try to test this issue with no apps and extensions in it and let us know if the issue still persists.

Thanks!

Apologies for the minimal repro steps -- it's hard to repro upgrade issues since 1) old versions don't seem to be available, and 2) I would need to clear my Chrome profile to revert anyway.

However, I found a sketchy .deb for Chrome 68.0.3440.84 for Linux. I wasn't able to fully verify that it was legit, but multiple mirrors had identical files. It would be nice to be able to verify that I actually had a legit copy of Chrome, or better yet, a well-documented repository of old versions for testing.

Anyway, I was able to reproduce this issue with the following steps:

1. Manually install Chrome 68 with dpkg. 
2. Delete my ~/.config/google-chrome directory.
3. Launch Chrome.
4. Say "not now" when prompted to sign in.
5. Go to https://mail.google.com/
6. Sign in with my password and U2F key.
7. Click the avatar inside gmail to switch to another account.
8. Sign in with one gsuite account.
9. Close Chrome.
10. apt-get update to reinstall Chrome 69.
11. Notice that the avatar is a generic person, and says I'm signed out.
12. Go to https://mail.google.com again, and click the avatar inside gmail to add another gsuite account.
13. Log in to my 2nd gsuite account.
14. Observe that the Chrome signed-in avatar now shows my 2nd gsuite account avatar, but still says I'm logged out.

signin-internals shows three accounts in the cookie jar, but only the 2nd gsuite account in the token service. Logging in to a 2nd gsuite account works around the fact that I'd normally have to wait for my 1st gsuite login to expire in ~30 days.

This was repro'ed on Ubuntu 16.04.5. I've also seen it happen on my Windows laptop, so I do not believe it is OS-related. I cleared my Chrome profile on this Linux machine so no apps or extensions are installed.

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Mac triage: to ewald@ for triage.

Thanks for the report! What's going is quite technically complicated, but I understand the reason for the behavior. I will do my best to explain it here:

(1) When you sign into your personal @gmail.com account and your first G Suite account in Chrome 68, you are not also signed into Chrome. The part of our "identity consistency" launch which signs you into the browser when you sign into a Google web service was only turned on-by-default in Chrome 69. We have turned on that feature for all Chrome 68 users via our server-side experimentation platform, but that only kicks in after 1-2 browser restarts. Since you signed in immediately after installing a fresh version of Chrome 68, you did not get that experiment, and thus you were not signed into the browser.
(2) You upgrade to Chrome 69. In Chrome 69, the "identity consistency" feature is on-by-default. Thus, when you sign into your second G Suite account on a Google web service, you are also signed into the browser. Chrome receives a token for your second G Suite account, but still doesn't have tokens for either of your first two accounts that were signed in while you were still on Chrome 68.
(3) The browser UI sees that you have one token in the Chrome token service, and so displays the avatar for your secondary account in the toolbar UI (your screenshot from c#0). One quick question for you there: I see in the background you're on the Gmail page for that account. Can you confirm that you "switched" to that account in Gmail when you took that screenshot, which is why the icon is being shown in the top-right corner of Gmail as well? That is not your "default" account in the cookie jar, correct?
(4) You are seeing the "pre-identity consistency" version of the user menu, because you have not yet "migrated" to full identity consistency. This stems from the order in which you signed-in in steps (1) and (2). Since two of your accounts are only signed into Google web services and not signed into Chrome, you are not in a "consistent" identity state. Thus, the browser UI that we show when identity consistency is being enforced does not kick in. Instead, you get the "generic" user menu, because Chrome still isn't enforcing identity consistency.

To fix this, you could simply sign out (by going to gmail.com, clicking your avatar in the top-right corner, and clicking "Sign out"), and then sign back into each account one-by-one. After you've signed back into all your accounts, restart Chrome. Once you've restarted Chrome, you should see the "new" version of the menu (with your account info at the top of the menu), and the avatar in the toolbar should be your personal account.

This issue raises some tricky questions, in light of all the feedback we've gotten recently. Showing a non-default account in the Chrome toolbar is a little confusing. But we can't show the full version of the "identity consistency" user menu yet, since the user is in an inconsistent/not migrated state. The simplest fix would be to only show the Google Account picture in the toolbar *after* the user has migrated to Dice (so it would be "clean" from the perspective that the user would either see "pre-identity consistency" UI or "post-identity consistency" UI).

msarda, tangltom, droger: let's chat about this tomorrow morning.

Yes, I switched to my gsuite gmail account when taking that screenshot. The URL is https://mail.google.com/mail/u/1/, so it's not the default account (which would end with /u/0/ afaik).

Discussed with the team this morning. This is just a bug. We need to not show the user's avatar in the toolbar until the user has successfully migrated to Dice.

Assigning to Thomas. Thank you much for flagging this for us, supersat!

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8244a2fde499f6dd4d8e5c754c2a4643ee94e4cb

commit 8244a2fde499f6dd4d8e5c754c2a4643ee94e4cb
Author: Thomas Tangl <tangltom@chromium.org>
Date: Thu Sep 27 18:31:01 2018

[Dice] Only show the sync promo account icon when migrated to Dice

The account icon of the first sync promo account is now only
shown in the avatar toolbar when the profile is fully migrated to Dice.

Bug:  889325 
Change-Id: I75dfbbc4cbf24d94e42d3b243dce15cb857066f0
Reviewed-on: https://chromium-review.googlesource.com/1249268
Commit-Queue: Thomas Tangl <tangltom@chromium.org>
Reviewed-by: David Roger <droger@chromium.org>
Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org>
Cr-Commit-Position: refs/heads/master@{#594793}
[modify] https://crrev.com/8244a2fde499f6dd4d8e5c754c2a4643ee94e4cb/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc
[modify] https://crrev.com/8244a2fde499f6dd4d8e5c754c2a4643ee94e4cb/chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc

[Auto-generated comment by a script] We noticed that this issue is targeted for M-70; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-70 label, otherwise remove Merge-TBD label. Thanks.

Verified on today's Canary. WAI.
Requesting merge to M70.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2e2f9c59a3ead0f4110b4d4866e419cfde40ce71

commit 2e2f9c59a3ead0f4110b4d4866e419cfde40ce71
Author: Thomas Tangl <tangltom@chromium.org>
Date: Fri Sep 28 21:00:11 2018

[Dice] Only show the sync promo account icon when migrated to Dice

The account icon of the first sync promo account is now only
shown in the avatar toolbar when the profile is fully migrated to Dice.

Bug:  889325 
Change-Id: I75dfbbc4cbf24d94e42d3b243dce15cb857066f0
Reviewed-on: https://chromium-review.googlesource.com/1249268
Commit-Queue: Thomas Tangl <tangltom@chromium.org>
Reviewed-by: David Roger <droger@chromium.org>
Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#594793}(cherry picked from commit 8244a2fde499f6dd4d8e5c754c2a4643ee94e4cb)
Reviewed-on: https://chromium-review.googlesource.com/1252801
Reviewed-by: Thomas Tangl <tangltom@chromium.org>
Cr-Commit-Position: refs/branch-heads/3538@{#750}
Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811}
[modify] https://crrev.com/2e2f9c59a3ead0f4110b4d4866e419cfde40ce71/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc
[modify] https://crrev.com/2e2f9c59a3ead0f4110b4d4866e419cfde40ce71/chrome/browser/ui/views/profiles/profile_chooser_view_browsertest.cc

The following revision refers to this bug: 
https://chromium.googlesource.com/chromium/src.git/+/2e2f9c59a3ead0f4110b4d4866e419cfde40ce71

Commit: 2e2f9c59a3ead0f4110b4d4866e419cfde40ce71
Author: tangltom@chromium.org
Commiter: tangltom@chromium.org
Date: 2018-09-28 21:00:11 +0000 UTC

[Dice] Only show the sync promo account icon when migrated to Dice

The account icon of the first sync promo account is now only
shown in the avatar toolbar when the profile is fully migrated to Dice.

Bug:  889325 
Change-Id: I75dfbbc4cbf24d94e42d3b243dce15cb857066f0
Reviewed-on: https://chromium-review.googlesource.com/1249268
Commit-Queue: Thomas Tangl <tangltom@chromium.org>
Reviewed-by: David Roger <droger@chromium.org>
Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#594793}(cherry picked from commit 8244a2fde499f6dd4d8e5c754c2a4643ee94e4cb)
Reviewed-on: https://chromium-review.googlesource.com/1252801
Reviewed-by: Thomas Tangl <tangltom@chromium.org>
Cr-Commit-Position: refs/branch-heads/3538@{#750}
Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811}

Issue 890730 has been merged into this issue.

 Issue 897536  has been merged into this issue.