Background:
ChromeOS Device policies are offer useful security controls like blocking USB access, minimum version, whether rollback is allowed, etc.

This depends on making sure the user only logs on via ChromeOS devices with these restrictions. Currently there is no way for an enterprise to limit which devices the user can login to.

Use Case:
Why do admins want to do this? Two main reasons.
1. To restrict login to devices under their physical control
2. To make sure users only login from devices with these security controls in place.

What if we let an administrator specify per-user what requirements the device must meet for the user to login?

A. To accomplish #1 from above we could allow an admin to specify login is only allowed from devices in a specific OU.

B. To accomplish #2 above, we could allow an admin to specify which device policies must be set along with their values.


Motivation:
For EDU/Enterprise customers, they may wish to restrict students/employees from using USB devices. Enterprises may want to only allow login from devices which upload system logs.

Existing workarounds:
Specify a user policy which force installs a Chrome extension. This extension blocks all web requests if the user has logged in from an unapproved device.

This however doesn't do anything for Android apps or using Linux apps.