Managed devices — school Chromebooks, work-issued MacBooks, corporate Windows laptops, enterprise iPads — are the tightest filtering environments most people ever touch. IT teams can lock down installs, extensions, VPN configuration, sign-in profiles, developer mode, and URL block lists. What they usually cannot lock is the ability to visit arbitrary websites. That gap is exactly where a web proxy fits.
What managed devices actually lock
The specifics vary by platform, but the pattern is similar across ChromeOS, iPadOS, Windows enterprise, and macOS MDM:
ChromeOS (Google Admin Console): locks Play Store app installs, Chrome extension installs (via Web Store allow-list), Guest mode, developer mode, network settings, downloads folder, URL block list. Sign-in restricted to organisation account only.
iPadOS / iOS (MDM profiles): locks App Store installs, VPN configuration profiles, Safari content filters, cellular data usage, screen recording, camera. Sign-in restricted to specific Apple IDs or Managed Apple IDs.
Windows enterprise (Intune / Group Policy): locks software installation, driver installation, USB access, browser choice, VPN client apps, admin privileges. Group Policy can push specific browser configurations.
macOS enterprise (Jamf, Kandji, Mosyle): locks kernel extensions, VPN configuration, Gatekeeper overrides, specific app installs via managed App Store. FileVault mandatory.
In every case, the browser is one thing that does not get fully locked — because employees need to reach organisation web services and third-party SaaS tools for work. That leaves a specific opening: the tab you already have open.
Why VPN apps fail on managed devices
A consumer VPN needs three things to work: install permission, VPN profile configuration permission, and network stack access. Managed devices deny all three by default:
- Install permission. The Play Store / App Store / Windows Store is filtered to an admin-controlled list. Third-party VPN apps almost never make that list.
- VPN profile permission. Even if the app installed, iOS and Android require explicit user permission to install a VPN profile — and MDM often disables this permission entirely.
- Network stack access. Some corporate MDM tools block outbound connections on the specific ports VPN protocols use (500, 4500, WireGuard’s default port), even if the app runs.
The chain of dependencies means VPN apps are visibly not-working on managed devices before you have finished trying. You get an install error, or a VPN-profile denial, or a connection timeout.
Why browser extensions also fail
Browser extension proxies (like the KProxy extension) sound like the natural halfway option — no full app install, just a browser add-on. But Chrome Web Store and Firefox Add-ons are also on the enterprise allow-list for managed profiles. Extensions almost never make the approved list either. The web-proxy-vs-browser-extension comparison covers this in depth.
Why web proxies work
A web proxy is not an app, not an extension, not a network profile — it is a website. The steps are:
- Open Chrome (or whichever browser your managed device came with).
- Type anyproxy.site into the URL bar.
- Paste the URL you want to open.
- Press the button.
Nothing installs. Nothing configures. No permission prompt appears. From the MDM’s perspective, you visited a website — same operation as visiting any other website. As long as anyproxy.site is not on the URL block list (rare on schools, more common on tight corporate networks), the proxy loads and works.
What Zscaler, Umbrella, and Cloudflare Gateway do
The specific enterprise filters most likely to sit between you and the internet on a work device in 2026:
Cisco Umbrella (formerly OpenDNS). DNS-based filtering with category enforcement. Cheap to deploy — no in-line packet processing. Bypassed by any proxy on a domain not in the category list.
Zscaler. In-line SSL inspection with a corporate root certificate on managed devices. Full DPI. Categorises “proxy avoidance”, “anonymiser”, and “circumvention” as separate blockable categories. This is the filter most likely to block proxy sites specifically.
Cloudflare Gateway. DNS + in-line proxy with category filtering. Growing category coverage. More common at younger enterprises that standardised on Cloudflare Zero Trust.
Palo Alto Prisma / Prisma Access. Full stack corporate filter with SSL decryption via device cert. Categorises “proxy avoidance” reliably.
Against Umbrella and Cloudflare Gateway, a proxy on a domain not yet categorised as “proxy avoidance” usually works. Against Zscaler and Palo Alto, the proxy domain itself is often blocked because those vendors categorise proxy-avoidance sites aggressively. The workaround: mobile hotspot for the one blocked page, or a proxy hosted on a domain the filter has not yet added.
Chromebook specifically — the most common managed device
Chromebooks are the highest-volume managed device in schools and are increasingly common in enterprise. The specific ChromeOS lockdowns that matter:
- Google Play Store apps: allow-listed only.
- Chrome extensions: allow-listed only.
- Guest mode: often disabled.
- Downloads: restricted folders or disabled.
- URL block list: admin-configurable.
- Developer mode + powerwash: locked.
The gap: visiting arbitrary websites. As long as anyproxy.site is not on the admin’s URL block list, the proxy works in the Chrome tab that came with the device.
Detailed Chromebook setup: /help/how-to-use-anyproxy-on-a-chromebook/.
School iPads specifically
iPadOS managed profiles lock App Store installs and VPN configuration, but Safari is not restricted from visiting arbitrary websites (unless a specific content filter is enabled). Same pattern as Chromebook: Safari + anyproxy.site + paste destination URL.
The catch on school iPads is Screen Time restrictions, which can categorise-block “adult content” and adjacent categories. These sit on Apple’s side, not the school’s, and can be more aggressive than school-network filters.
Corporate work laptops
Enterprise-managed Macs and Windows PCs vary more widely because MDM configurations are more customisable. General pattern:
- Test whether anyproxy.site loads at all. If it does, the proxy works.
- If your work has category-based filtering (Zscaler, Palo Alto), anyproxy.site may be blocked. Try a mobile hotspot as a smoke test.
- Your acceptable-use policy still applies. Even where the technical filter allows a proxy visit, your employer’s policy may prohibit it.
Detailed work setup: /help/how-to-unblock-a-site-at-work/.
The MDM-detection question
Enterprise MDM tools log traffic patterns. Occasional visits to any external domain blend into normal usage. Sustained sessions or repeated visits to the same domain get flagged for review at aggressive SOCs. Use proxies for essentials on managed devices, not for hours of idle browsing. For personal browsing use your own device on personal network.
What breaks on managed devices even with a proxy
- Downloads may be blocked at the OS level. ChromeOS and iPadOS can restrict downloads regardless of what the browser tries to save.
- Camera/microphone permission for video calls, live streaming, or Reels uploads. Enterprise MDM often blocks these at the OS level.
- Copy-paste to system clipboard may be restricted for DLP reasons.
- Popup windows may be blocked by corporate policy, breaking some sign-in flows.
None of these are proxy issues — they are OS-level restrictions the proxy cannot work around.
Summary rule of thumb
If your device makes you sign in with a work or school account, treat every download as risky, every install as blocked, and every extension as unavailable. Reach for a web proxy first, VPN never, browser extension only if it is on your organisation’s approved list. The specific proxy you use matters less than picking a proxy at all — most modern web proxies handle the managed-device case similarly.
For the ranked comparison of proxies specifically on managed-device compatibility, see best-proxies-for-Chromebook and best-proxies-for-school.