Managed devices, such as school Chromebooks, work-issued MacBooks, corporate Windows laptops and enterprise iPads, are the tightest filtering environments most people ever touch. IT teams can lock installs, extensions, VPN configuration, sign-in and developer mode, and they can also block or allow individual websites. This page explains what those controls cover, why a web proxy sometimes fits and sometimes does not, and what the organisation can still see.
What we tested and what we did not. We do not have an enrolled Chromebook, a managed iPad or a corporate filter to test against fairly, so nothing on this page is a test result from a managed device. The tests we cite are of how proxied pages behave in an ordinary browser.
Check the rules first. Many school and workplace acceptable-use policies forbid proxies by name. Breaking such a policy is usually not a crime, but it can cost you access, a grade or a job, even when the page loads.
What managed devices actually lock
The specifics vary by platform, but the pattern is similar across ChromeOS, iPadOS, Windows and macOS management:
ChromeOS (Google Admin console): app and extension installs, guest mode, developer mode, network settings and downloads. Google’s own documentation also says admins can block and allow URLs, so that users can only visit certain websites (Google, Chrome Enterprise and Education help).
iPadOS and iOS (MDM profiles): App Store installs, VPN configuration, Safari content filters and many device features.
Windows (Intune, Group Policy): software installation, admin rights, browser choice and browser settings, and VPN clients.
macOS (Jamf, Kandji, Mosyle and others): system extensions, VPN configuration, app installs and security settings.
The browser usually stays open, because people need it for school or work. But “the browser works” is not the same as “every website works”: URL rules and network filters decide that.
Why VPN apps fail on managed devices
A consumer VPN needs install permission, permission to add a VPN configuration, and a network that lets its protocol through. Managed devices commonly deny the first two:
- Install permission. App stores on managed devices are limited to an admin-approved list. Consumer VPN apps rarely make that list.
- VPN configuration. iOS and Android ask for permission before adding a VPN profile, and device management can disable that.
- The network. A managed network can block VPN servers or protocols.
The result is usually visible straight away: an install error, a denied profile or a connection that never opens.
Why browser extensions also fail
Browser extension proxies sound like a halfway option: no full app, just an add-on. But managed Chrome profiles can limit extensions to an approved list, and proxy extensions rarely make it. The web proxy vs browser extension comparison covers this in more depth.
What a web proxy changes, and what it does not
A web proxy is a website, not an app or extension. The steps are:
- Open the browser that came with the device.
- Go to anyproxy.site.
- Enter the site you want. AnyProxy’s /browse accepts a site’s origin (such as https://example.com/); a pasted deep link opens the home page, and you navigate from there.
- Press the button.
Nothing installs and no permission prompt appears. That only gets you past the install restrictions. Three things can still stop it:
- URL rules on the device. If the admin uses an allowlist, or blocks anyproxy.site, the page will not open, and there is nothing on the device you can change.
- The network filter. If it blocks proxy sites as a category, the page will not open either.
- The destination. Some sites refuse proxy addresses. On 15 October 2026 Reddit refused every AnyProxy region, and Google Search showed a reCAPTCHA.
What corporate filters do
Corporate and school filters such as Cisco Umbrella, Zscaler, Cloudflare Gateway and Palo Alto Networks’ products sort websites into categories that admins can block. Proxy or anonymizer services are a common category, so a web proxy may be blocked by category before anyone looks at it. Products that inspect HTTPS with an organisation’s certificate installed on the device can also see the pages inside the connection.
We have not tested AnyProxy against any of these products. If anyproxy.site is blocked on your network, you see your organisation’s block page instead of ours. The quickest legitimate fix for a wrongly blocked work or school site is usually to ask IT to recategorise it.
What the organisation can see
Even when the page loads, the network is not blind:
- Connections. The network logs that you connected to AnyProxy, when and how much. When we checked on 15 October 2026, AnyProxy’s regional servers (such as sg.anyproxy.site) did not use Encrypted Client Hello, so their names are readable in every connection. See does the network know I used a proxy?.
- Pages, with TLS inspection. On a managed device with the organisation’s root certificate installed, the filter may read the pages too. Click the padlock on any HTTPS site: if the certificate is issued by your organisation, your traffic is being inspected.
- The device itself. Browser history and device management logs stay on, or are reported from, a managed device.
Chromebooks specifically
Chromebooks are a very common managed device in schools. The ChromeOS controls that matter here:
- Play Store apps and Chrome extensions: approved list only.
- Guest mode and developer mode: often disabled.
- Downloads: may be restricted.
- URL block and allow lists: admin-configurable.
So a web proxy on a managed Chromebook works only if the admin has not blocked or excluded anyproxy.site. Setup notes: /help/how-to-use-anyproxy-on-a-chromebook/, and the managed Chromebook FAQ.
Managed iPads specifically
iPadOS management can lock App Store installs and VPN configuration, and can also apply web content filters in Safari. Screen Time restrictions can limit websites as well. Where Safari can open anyproxy.site, the web proxy behaves as it does on any iPhone or iPad; where a content filter blocks it, it will not load.
Corporate work laptops
Company-managed Macs and Windows PCs vary more widely because their configurations are more customisable:
- If anyproxy.site does not load, the filter or the device policy blocks it. Do not try to route around a company’s controls.
- If it loads, the company can still see the connection, and may see more with TLS inspection.
- Your employer’s policy applies either way. If you need a work site that is wrongly blocked, IT is the right route.
More: /help/how-to-unblock-a-site-at-work/ and proxy vs VPN at work.
What breaks on managed devices even with a proxy
- Downloads may be blocked by the operating system, whatever the browser tries to save.
- Camera and microphone may be disabled, and calls do not go through a web proxy anyway.
- Copy and paste may be restricted for data-loss prevention.
- Pop-up windows may be blocked, which breaks some sign-in flows.
None of these are proxy issues: they are device restrictions a proxy cannot change.
Summary rule of thumb
On a managed device, assume installs and extensions are blocked and that the organisation can see your connections. A web proxy is the only no-install option, and it works only where the device and network allow its site. Read the acceptable-use policy first; for personal browsing, use your own device on your own connection.
For a ranked comparison based on dated tests in an ordinary browser, see best proxies for Chromebook and best proxies for managed networks.