Skip to main content

MDM Integration

Professional

Deploy the Containment.AI Chrome extension to managed devices using your Mobile Device Management (MDM) solution for enterprise-wide coverage.

Overview​

MDM deployment enables:

  • Automatic extension installation (force install)
  • Toolbar pinning and update control
  • No user action required to install

:::note Managed configuration is planned — not yet read by the extension Chrome Enterprise managed storage (the 3rdparty policy block) is how admin-pushed extension configuration will work, and the extension ships a managed-storage schema declaring the planned keys (orgId, failPolicy, proxyUrl, authPageUrl). However, current released extension versions do not read chrome.storage.managed — any admin-pushed values are silently ignored, and users are associated with your organization when they sign in to the extension. The managed-configuration examples below are marked Planned and document the target contract so you can stage policies ahead of the release that consumes them. :::

Supported MDM Platforms​

Each platform's setup guide is a section further down this page. The platform names below are a table rather than headings deliberately: an ### Microsoft Intune summary heading and the ## Microsoft Intune setup heading generate the slugs #microsoft-intune and #microsoft-intune-1, so every cross-page #microsoft-intune link silently landed on the one-line summary instead of the setup guide. See adr/0018.

PlatformDevicesSetup guide
Microsoft IntuneWindows and macOSMicrosoft Intune
Jamf PromacOSJamf Pro
VMware Workspace ONEMixed device environmentsGeneric MDM
Google WorkspaceChromebooks and Chrome browser managementGoogle Workspace
Other MDMAny platform supporting Chrome extension policiesGeneric MDM

Prerequisites​

Before deploying:

  • MDM admin access
  • Organization ID from Containment.AI dashboard
note

The examples below use the published Chrome Web Store extension ID cfliledfjcblpjkeiokhhdadfcpekiog (extension name Containment AI) with the standard Chrome update URL https://clients2.google.com/service/update2/crx. Requires Chrome 114+ (Manifest V3).

Microsoft Intune​

Step 1: Create Configuration Profile​

  1. Go to Devices > Configuration profiles
  2. Click Create profile
  3. Select:
    • Platform: Windows 10 and later
    • Profile type: Settings catalog

Step 2: Add Chrome Settings​

  1. Click Add settings
  2. Search for "Chrome"
  3. Add Extension management settings

Step 3: Configure Extension​

Add the extension configuration:

{
  "ExtensionInstallForcelist": {
    "Value": [
      "cfliledfjcblpjkeiokhhdadfcpekiog;https://clients2.google.com/service/update2/crx"
    ]
  },
  "ExtensionSettings": {
    "Value": {
      "cfliledfjcblpjkeiokhhdadfcpekiog": {
        "installation_mode": "force_installed",
        "update_url": "https://clients2.google.com/service/update2/crx",
        "toolbar_pin": "force_pinned"
      }
    }
  }
}

Planned (not yet read by the extension — see the note above): the managed-configuration block, using the schema key orgId:

{
  "3rdparty": {
    "Value": {
      "extensions": {
        "cfliledfjcblpjkeiokhhdadfcpekiog": {
          "orgId": "YOUR_ORG_UUID"
        }
      }
    }
  }
}

Step 4: Assign Profile​

  1. Click Assignments
  2. Select target groups
  3. Save and deploy

Jamf Pro​

Step 1: Create Configuration Profile​

  1. Go to Configuration Profiles
  2. Click New
  3. Name: "Containment.AI Chrome Extension"

Step 2: Add Chrome Payload​

  1. Click Application & Custom Settings
  2. Upload policy plist or JSON

Chrome Policy JSON​

{
  "ExtensionInstallForcelist": [
    "cfliledfjcblpjkeiokhhdadfcpekiog;https://clients2.google.com/service/update2/crx"
  ],
  "ExtensionSettings": {
    "cfliledfjcblpjkeiokhhdadfcpekiog": {
      "installation_mode": "force_installed",
      "update_url": "https://clients2.google.com/service/update2/crx"
    }
  }
}

Planned (not yet read by the extension): add the managed-configuration block with the schema key orgId once a release consumes managed storage.

Step 3: Scope and Deploy​

  1. Set scope to target computers
  2. Deploy to production

Google Workspace​

Step 1: Access Admin Console​

  1. Go to admin.google.com
  2. Navigate to Devices > Chrome > Apps & extensions

Step 2: Add Extension​

  1. Click + (Add)
  2. Select Add from Chrome Web Store
  3. Enter extension ID or search
  4. Click Select

Step 3: Configure​

  1. Set Installation Policy to Force install

  2. Enable Pin to browser toolbar

  3. Planned (not yet read by the extension): add managed configuration using the schema key orgId:

    {
      "orgId": "YOUR_ORG_UUID"
    }

Step 4: Apply to OUs​

  1. Select target organizational units
  2. Save changes

Generic MDM​

For other MDM solutions supporting Chrome policies:

Required Policies​

Force Install Extension Registry/Policy path: ExtensionInstallForcelist Value: cfliledfjcblpjkeiokhhdadfcpekiog;update_url

Extension Settings Registry/Policy path: ExtensionSettings Value: JSON with installation_mode and update_url

Organization Configuration (Planned) Registry/Policy path: 3rdparty.extensions.cfliledfjcblpjkeiokhhdadfcpekiog Value: JSON with orgId — not yet read by the extension; see the managed-configuration note above

Windows Registry​

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="cfliledfjcblpjkeiokhhdadfcpekiog;https://clients2.google.com/service/update2/crx"

macOS Preferences​

<key>ExtensionInstallForcelist</key>
<array>
  <string>cfliledfjcblpjkeiokhhdadfcpekiog;https://clients2.google.com/service/update2/crx</string>
</array>

Verification​

After deployment, verify:

In Containment.AI​

  1. Have pilot users sign in to the extension (sign-in is what associates a device with your organization today — managed org configuration is not yet consumed)
  2. Go to Devices
  3. Check that the signed-in pilot devices appear

On Device​

  1. Open Chrome
  2. Go to chrome://extensions
  3. Verify extension is installed
  4. Check "Managed" badge

Troubleshooting​

Extension Not Installing​

  1. Check MDM Policy

    • Verify policy is assigned
    • Confirm device in scope
    • Check policy sync status

  2. Check Chrome Policy

    • Open chrome://policy
    • Look for extension policies
    • Check for conflicts

  3. Check Update URL

    • Verify network access to Google
    • Check proxy settings
    • Test URL directly

Extension Installed But Not Connecting​

  1. Check Sign-In

    • The user must sign in to the extension to connect it to your organization
    • Managed org configuration pushed via MDM is not yet read by the extension, so it cannot substitute for sign-in
    • Confirm the user's account belongs to your organization

  2. Check Network

    • Extension needs internet access
    • Verify API endpoints accessible
    • Check firewall rules

Users Can Disable Extension​

MDM-installed extensions shouldn't be removable. If users can:

  1. Check MDM policy enforcement
  2. Verify installation_mode is "force_installed"
  3. Review Chrome management settings

Best Practices​

Staged Rollout​

  1. Deploy to pilot group first
  2. Monitor for issues
  3. Gradually expand scope

Testing​

  • Test on representative devices
  • Verify all OS versions
  • Check different Chrome versions

Documentation​

  • Document configuration settings
  • Record deployment scope
  • Track version history

Monitoring​

  • Monitor installation success rate
  • Track connection status
  • Set up alerts for issues

Advanced Configuration​

Minimum Version​

Force specific extension version:

{
  "minimum_version_required": "1.0.1"
}

Toolbar Pinning​

Pin extension to toolbar:

{
  "toolbar_pin": "force_pinned"
}

Update Control​

Control update behavior:

{
  "override_update_url": true,
  "update_url": "https://custom-update-server/updates.xml"
}