3Eyes / Blog
2026-08-30 · Dan Clark

Why Family Link Doesn't Work on a School Google Account

Short answer: Family Link supervises an account, not a device. A school-issued Google Workspace for Education account is owned and administered by the school, and Google does not let a second administrator — you — attach parental supervision to an account someone else controls. This is by design, not a bug, and no setting on your side changes it.

If you have spent an evening trying to add your child's @school.org address to your family group and getting nowhere, that is why. What follows is what the school controls, what you still control on the physical device, the three options that actually remain, and the exact questions to put to the school's IT administrator.

Why supervision can't be added to a managed account

Google Family Link works by linking a child's personal Google account to a parent's account, at which point the parent becomes the supervisor of that account: they approve app installs, set screen time, see activity, and apply content restrictions. Every one of those controls is attached to the account.

A Workspace for Education account already has a supervisor. The school's IT administrator manages it through the Google Admin console — they set the password policy, decide which apps and services are available, control whether third-party apps can be authorised, and can wipe or suspend it. An account can only have one administrative authority, and on a school account that authority is the school.

The practical consequences follow directly. You cannot add a school account to your family group. You cannot see its activity in Family Link. Any Family Link supervision you configured on your child's personal account applies only when they are signed into that personal account — sign into the school account instead, and none of it is in effect. Our Google Family Link guide covers what supervision does when it does apply.

What the school controls versus what you control

Splitting this cleanly is the single most useful thing you can do, because parents routinely spend effort on the school's half where nothing they do will stick.

The school controls You control
The Google account (password, apps, services) Yes No
Web filtering while signed into the school account Yes No
Chrome policies and extensions on an enrolled device Yes No
Which accounts can sign into an enrolled Chromebook Yes No
Data and activity visibility on the school account Yes No — request it from them
The home Wi-Fi the device connects to No Yes
Where and when the device is physically used No Yes
A personal profile on the device, if permitted Shares control Partly
A personally-owned second device No Yes

The dividing line is the account and the enrolment on one side, and the network and the physical world on the other. Everything on your side of that line is still available to you, and it is more than parents expect.

Option one: a second, personal profile on the device

On a Chromebook that is not fully locked down, and on a Windows or Mac laptop, you can often add a second profile or user account signed in with your child's personal Google account — the one you can supervise with Family Link.

This gives you a supervised environment for homework-adjacent and personal use, with app approval, screen time and content restrictions applying normally in that profile. Homework that genuinely requires the school account still happens in the school profile.

Two honest limits. First, many schools disable sign-in for accounts outside their domain on enrolled Chromebooks, so this simply is not offered. Second, even where it works, your child chooses which profile to use — so this is a way to provide a supervised space, not a way to constrain them. If the school account is unfiltered and available on the same device, they can switch to it.

Where it works best: as a way to keep personal browsing off the school account entirely, which is worth doing for its own reasons. Our Chromebook parental controls guide covers profile handling in more detail.

Option two: device-level controls outside the account

If the device is your family's own hardware — a home laptop or PC that your child signs a school account into — the account restriction becomes far less important, because you can control the machine itself.

On Windows: set the account to Standard User, use Microsoft Family Safety or third-party software, and apply controls that run as a service rather than inside a browser signed into a Google account. On a Mac: Screen Time, applied to the macOS user account rather than the Google account. These are enforced by the operating system, which has no opinion about which Google account is signed into Chrome.

On a school-owned, school-enrolled Chromebook, this option mostly evaporates. You cannot install software, cannot change device policy, and cannot add controls to a device an organisation has enrolled. That is the case where option three is the only one left.

Option three: filtering at the network, which ignores accounts entirely

This is the option most parents overlook, and on a school-managed device it is usually the only one that actually works.

A filter that operates at the network or DNS layer sees traffic leaving the device. It does not know or care which Google account is signed in, whether the device is enrolled, or whether the browser is Chrome under school policy. If the device is on your Wi-Fi, the filter applies.

Two ways to do it:

  • At the router. Most consumer routers offer domain blocking, per-device rules and schedules. Set them against the school device's Wi-Fi address. This is free, requires nothing on the device, and cannot be uninstalled by anything running on it.
  • Via a filtering DNS resolver configured on the router, which covers every device in the house at once with a maintained category list.

The limits are the usual ones: it only applies on your network, so a phone hotspot or a friend's Wi-Fi restores full access, and it does nothing while the device is at school. It also cannot see inside an encrypted tunnel, so a VPN defeats it. But for the specific problem of "a school laptop I cannot install anything on, sitting in my house", it is the answer.

For a home-owned computer, 3Eyes works this way on the device rather than the router — an allowlist filter running as a service on Windows and Mac, so approved sites load and everything else shows an "Ask Parent" page regardless of which account is signed in, with time limits and scheduled downtime alongside. It is paid, with a 14-day trial. To be clear about the boundary: it cannot be installed on a school-enrolled Chromebook, because nothing can. For that device, the router is your layer.

Third-party app permissions on managed accounts

A detail worth knowing, because it produces a lot of confusing error messages.

School administrators control whether a Workspace for Education account may authorise third-party applications. Many schools set this to allow only an approved list. So when your child tries to sign into a game, an AI tool or a note-taking app with "Sign in with Google" using their school account, they may get a blocked or "access denied" message that has nothing to do with anything you configured.

Two consequences. It means the school account is genuinely more restricted than a personal one in some respects — that is protective. And it means the sensible rule at home is that the school account is used for school things and a personal account is used for everything else, which keeps the two sets of restrictions doing the jobs they were designed for.

When this doesn't work

The school blocks adding profiles or personal accounts. Common on enrolled Chromebooks, where sign-in is restricted to the school domain. Next step: stop trying to control the device and control the network. Set router-level rules against that device, and if personal use matters, consider a separate personally-owned device where you can apply supervision properly. See Family Link alternatives for options that don't rely on Google accounts.

The device is in enrolled kiosk or managed-guest mode. Nothing can be added, no profiles, no software. Next step: the router is your only layer, plus physical rules about where and when the device is used — which for a device this locked down is often sufficient, because the school's own filtering is doing the rest.

Your child uses the school account on a personal phone. Supervision does not follow the account, so the phone is the thing to manage. Next step: apply Family Link or the platform's own controls to the phone's primary personal account and to the device, and treat the school account as just another sign-in on a managed device.

What to ask the school's IT administrator

Most of the uncertainty here is resolved by four questions. Email them, or ask at a parents' evening. The answers determine which of the three options above is available to you, so it is worth getting them in writing.

  1. Is the school's web filtering applied when the device is used at home, or only on the school network? Many schools filter at the network level on site and apply a Chrome policy that follows the device off site — but not all do, and the difference decides whether the device is filtered in your living room.

  2. Can a personal Google account be added to this device as a second profile, and if not, is that a policy you can change for individual families? This tells you directly whether option one exists for you.

  3. What activity on my child's school account is logged, and what can I as a parent request to see? Schools hold browsing and app-usage data on managed accounts. Access policies vary, and asking costs nothing.

  4. Are third-party app sign-ins restricted on this account, and is there a list of what is allowed? This explains sign-in failures your child will otherwise report as the device being broken, and tells you what they can reach with it.

A fifth if the device is school-owned: what is the policy on installing anything, and what happens if we do? The answer is usually "you cannot", but it is worth having it stated rather than discovering it after a failed install.

Frequently asked questions

Can I add my child's school Google account to Family Link? No. Family Link supervises accounts you can administer, and a Workspace for Education account is administered by the school. Google does not permit a second supervisor on a managed account, and there is no workaround on the parent side.

Why does Family Link say the account can't be supervised? Because the account belongs to a managed Workspace domain. The same message appears for work accounts. It is a property of the account type, not something wrong with your setup or your family group.

Can the school see what my child does at home on the school account? Typically yes, to some degree — managed accounts log activity, and Chrome policies applied to an enrolled device often follow it off the school network. Ask the IT administrator exactly what is retained and for how long.

Can I put parental controls on a school Chromebook? Not on the device itself; enrolled Chromebooks do not accept third-party software or parent-set policy. You can filter it at your router while it is on your home Wi-Fi, and you can set rules about where and when it is used.

Should my child use their school account for personal browsing? Better not to. Keeping school and personal use on separate accounts means the school's restrictions cover school work, your supervision covers personal use, and neither is doing a job it was not designed for.

Does this apply to homeschool families using a Workspace account? If you administer the Workspace domain yourself, you control it through the Admin console rather than Family Link — different tool, similar outcome. Our homeschool parental controls guide covers that setup.