Deploying the extension (managed / MDM)
Two ways to get Veridenti onto your team's browsers: let people install it themselves, or push it silently with your device-management tool.
Option A — Self-service (small teams)
Send the store link; users install and sign in with SSO.
- Chrome / Edge: the Chrome Web Store (Edge installs Chrome-store extensions).
- Firefox: Firefox Add-ons (AMO).
Option B — Managed deployment (MDM)
Force-install the extension with browser enterprise policy, pushed through your MDM. Users get it automatically — nothing to click, nothing to uninstall.
The force-install policy
Every major browser force-installs an extension via an extension force-list policy. Set it to Veridenti's extension ID:
| Browser | Policy | Extension ID |
|---|---|---|
| Chrome | ExtensionInstallForcelist | olcbmkkoibpoimhjkhgllokikajccknn |
| Edge | ExtensionInstallForcelist (Edge) | available once the Edge listing is approved; until then deploy the Chrome-store ID above — Edge accepts it |
| Firefox | ExtensionSettings (installation_mode: force_installed) | masked-autofill@cappfamily.org, install_url from AMO |
Push it through your MDM
- Microsoft Intune — Devices → Configuration → Settings catalog → the browser's "Configure the list of force-installed apps and extensions" → add the ID. (Or import the Chrome/Edge ADMX and set the policy there.)
- Group Policy (on-prem AD) — load the Chrome/Edge ADMX templates → Computer Configuration → Administrative Templates → [Browser] → Extensions → "Configure the list of force-installed apps and extensions" → add the ID.
- VMware Workspace ONE — a custom profile / browser payload carrying the same force-list policy.
- JAMF (macOS) — a Configuration Profile with the browser's managed preferences (the same force-list key).
Joining the organization
Installing is step one; the device also has to join your org so policies apply and posture reports flow in. Two paths:
- SSO (automatic) — the user signs in with your identity provider and the device associates with your tenant. This is the default for SCIM-provisioned users.
- Enrollment code (no-SSO / demos) — in the console, Settings → Connect the browser extension generates a one-time code. In the extension, the user opens Settings → Connect your organization, enters your console URL and the code. The device picks up your org's policies and shared vaults.
Why joining matters — management + analytics
Once a device has joined, and only then:
- Your security policies and feature governance apply to it.
- Its zero-knowledge posture (reused / weak / breached counts, MFA status — never the vault contents) flows into Security reports and the Human-Risk dashboard, so adoption and risk become visible.
- Offboarding revokes the device cryptographically — access ends the moment SCIM deprovisions the user.
TipRoll out in one motion: force-install via MDM and enable SSO. The extension appears automatically and self-associates on the first SSO sign-in — zero user steps.
Was this helpful?