However, changing this was (apparently) "severely impactful" for how one of our coworkers prefers to use a browser in the company environment and is proposing all sorts of potential new work so that....basically......we can allow people to sign into google/other browsers with some sort of account that allows them to sync things....on company managed devices.

I see a more simple solution of just not signing into Chrome/et al with personal accounts and syncing data, which more aligns with how company policy has always been on that sort of thing. Me personally? Why would I want my personal data/info on company stuff, I'm having a hard time relating. So what I ask is - what's everyone else doing for this? Do you allow users to sign into Chrome and the like with personal accounts to sync data? Maybe I'm way off base here and this is standard practice...but I've been around for a little bit and have yet to encounter it.

Right around the time we were rolling out these changes, I read an article about some breach that basically involved company credentials cached in a browser on a personal device that ended up getting compromised, which was used as the vector for the corporate breach.

@Ray Davis possibly, I'm sure that's where things would be defined to disable the ability to do what I outlined - a GPO is where we blocked that behavior. More curious from a practical and political standpoint the challenges people may have faced with this.

and yes, to your point, I don’t login with personal accounts on corporate devices but users might need to login using google as IdP for third party apps/sites