Deploy Browser Shield across your org

The two things every device needs

Browser Shield enrolls a device with exactly two inputs:

1. The extension installed — force-installed by your MDM/GPO, or installed by the user from the Chrome Web Store.
2. An enrollment key — your org's reusable managed_key, minted in the console at Browser Shield → Generate enrollment key. MDM delivers it silently via managed storage; without an MDM the user pastes a one-time token.

Prerequisite: the extension ID

Force-install policies pin a Chrome extension ID (32 chars). Use the ID shown in your console under Browser Shield → Deploy. (For self-hosted/private distribution, you also get an update_url; for the public Web Store listing, Chrome's default update URL is used automatically.)

Option A — Google Admin (Chrome Enterprise / Workspace)

The cleanest path for Workspace orgs. In admin.google.com → Devices → Chrome → Apps & extensions → Users & browsers:

1. Add the extension by ID, set installation policy to Force install.
2. Under Policy for extensions, paste the managed configuration so it enrolls silently:

{
  "enrollmentKey": { "Value": "<your managed_key from the console>" }
}

Scope it to the OUs you want covered. Devices pick it up on next policy refresh and enroll with no user interaction.

Option B — Microsoft Intune (Chrome & Edge)

Push two settings via a Configuration profile → Settings catalog (or the Chrome/Edge ADMX):

1. ExtensionInstallForcelist → add <extension-id>;https://clients2.google.com/service/update2/crx
2. ExtensionSettings → managed config carrying the enrollment key:

{
  "<extension-id>": {
    "installation_mode": "force_installed",
    "update_url": "https://clients2.google.com/service/update2/crx",
    "managed_configuration": { "enrollmentKey": "<your managed_key>" }
  }
}

For Edge, use the identical keys under the Edge ADMX (Edge is Chromium and reads the same managed schema).

Option C — Windows Group Policy (no MDM, but you have Active Directory)

If you have AD/GPO but no full MDM, force-install via the registry. This is the most common "no-MDM" enterprise path.

# Force-install the extension
HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist
  1 = "<extension-id>;https://clients2.google.com/service/update2/crx"

# Deliver the enrollment key via managed config (3rd-party policy)
HKLM\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\<extension-id>\policy
  enrollmentKey = "<your managed_key>"

Deploy via a GPO Administrative Template + a registry preference item. Jamf (macOS) and Workspace ONE push the same Chrome keys through their own config profiles.

Option D — Self-serve (no MDM, no GPO)

For small teams or BYOD: the user installs the extension from the Web Store and pastes a one-time token (Browser Shield → Generate enrollment key → the user enters it in the extension's Options page). Good for pilots; not how you cover a whole fleet.

Verify enrollment

Enrolled devices appear under Browser Shield in the console within a minute of their first heartbeat, with browser/OS, extension inventory, and posture. Start in monitor mode; flip to blockonce the inventory looks right (block mode is what actually auto-disables denied/malicious extensions).