Fundamental vs Advanced vs Enterprise Endpoint Management: Which Does Your Business Need?

If you’ve enabled Google Endpoint Management and started reviewing your device settings, you’ve likely noticed three unfamiliar terms for computers: Fundamental, Advanced, and Enterprise endpoint management. Picking the wrong one means either leaving company laptops under-protected or paying for controls you don’t need.

This guide breaks down what each level actually does, which Google Workspace edition each one requires, and how to decide which fits your organization.

Quick Overview

These three levels apply specifically to computers — Windows, macOS, Linux, and ChromeOS devices. (Phones and tablets use a separate system, mobile device management, with its own Basic and Advanced levels — covered in our guide on Google Endpoint Management.)

Each level builds on the one below it: Advanced includes everything in Fundamental, and Enterprise includes everything in both Fundamental and Advanced.

Fundamental Endpoint Management

Fundamental endpoint management is the baseline. It’s applied automatically to any computer that signs into a managed Google account — there’s no setup required.

What it covers:

• Basic device inventory (device details, last sync)
• Core security settings visibility
• No password or encryption enforcement beyond what the operating system already provides

Eligible editions: Available by default across nearly all Google Workspace editions, including Business Starter, Business Standard, Business Plus, Enterprise, Education Fundamentals and above, Frontline, Essentials, and Cloud Identity Free.

Because it’s automatic and included everywhere, Fundamental management is really a visibility layer rather than an enforcement tool. Most businesses that need actual policy control move to Advanced.

Advanced Endpoint Management

Advanced endpoint management is where real enforcement begins. An administrator has to turn it on — it isn’t automatic.

What it adds on top of Fundamental:

• Stronger password and screen lock policy enforcement
• Device approval workflows before a device can access company data
• More detailed device inventory and reporting
• The ability to remotely wipe corporate data from a device

Eligibility requirements: To use Advanced endpoint management, a computer must either run Chrome Browser and/or ChromeOS, or — for Windows devices — have the Google Credential Provider for Windows installed. This can be installed by the end user or pushed remotely by an admin through the Admin console.

Eligible editions: Business Plus, Enterprise Standard and Plus, Education Standard and Plus, Frontline Standard and Plus, and Enterprise Essentials tiers. It’s not available on G Suite Basic or G Suite Business.

This is the level most growing businesses land on once they need actual policy enforcement rather than just visibility.

Enterprise Endpoint Management

Enterprise endpoint management is the most complete tier, built for organizations with stricter compliance or security requirements. It includes everything in Fundamental and Advanced, plus additional controls aimed at larger or more regulated environments.

Eligibility requirements: The same device eligibility as Advanced management applies — Chrome Browser/ChromeOS, or Windows with the Google Credential Provider installed.

Eligible editions: A narrower set — Frontline Standard and Plus, Enterprise Standard and Plus, and Education Standard, Plus, and Endpoint Education Upgrade. It is not included with Business Plus or lower Education tiers.

Because eligibility is limited to specific editions, this level is typically only relevant to mid-size and larger organizations already on Enterprise or equivalent plans.

Comparison at a Glance

How to Choose the Right Level

• Fundamental is enough if: you only need basic visibility into which devices are connected, and you’re not enforcing strict security policies.
• Advanced is the right fit if: you need to enforce password policies, approve devices before they connect, or remotely wipe company data — this covers most small and mid-sized businesses.
• Enterprise makes sense if: your organization already holds an Enterprise or equivalent edition and needs the most complete device control available, often for compliance-driven industries like finance, healthcare, or legal services.

Setup Steps for Advanced or Enterprise Management

1. Confirm your Google Workspace edition supports the level you want (see the eligibility notes above).
2. In the Admin console, go to Devices > Mobile & endpoints > Settings.
3. Select the organizational unit you want to configure.
4. Choose Advanced or Enterprise endpoint management for that unit.
5. For Windows devices, install the Google Credential Provider for Windows on each machine, or push it remotely from the Admin console.
6. Set your password, screen lock, and device approval policies.

Common Mistakes to Avoid

• Enabling Advanced management without checking device eligibility first. Windows devices without the Credential Provider installed won’t be fully managed under Advanced or Enterprise levels.
• Applying Enterprise-level policies company-wide when only one department needs them. Configure by organizational unit instead.
• Assuming Fundamental management enforces policies. It provides visibility, not enforcement — Advanced is needed for that.

FAQ