Deploy the managed browser extension

Use the managed extension when IT installs the extension for people and identifies each device, instead of asking everyone to install it themselves. The managed extension is available for Google Chrome and Microsoft Edge.

Where to find each setting

The following table shows where each setting lives.

You need	Go here
The extension ID and policy template for your browser	Sanitized AI > My Organization > Extension settings > Managed extension setup
Chrome deployment instructions	Chrome Enterprise: manage extensions (Google documentation)
Chrome policy check	Type chrome://policy in Chrome’s address bar
Edge policy check	Type edge://policy in Edge’s address bar
Sign-in setup	Choose how people sign in

Chrome and Edge each have their own managed extension, with its own ID. A Chrome template doesn’t configure the Edge extension, and the other way around.

Note

The Managed extension setup guide appears for organizations that Sanitized AI set up as managed by IT. If you see store links instead, contact Sanitized AI.

1. Choose the browser and a pilot group

1. In your device-management platform, create a small pilot group of devices or users.
2. In Sanitized AI, go to My Organization > Extension settings, and open Managed extension setup.
3. Select the browser your organization manages, Chrome or Microsoft Edge. The guide fills in the matching managed extension ID.

2. Download a policy template

1. Select your device-management platform: Jamf, Microsoft Intune, or Google Admin (Chrome only).
2. Click Download template or Copy template.
3. Open it in a text editor or in your platform’s custom profile editor.
4. Replace only the clearly marked placeholders. Don’t rename policy keys or change value types.

The template contains your organization ID and placeholders for device and user values:

• Device ID and device name
• Assigned user’s name, email, department, and username

The default language is filled in as en. Change it to fr-CA for people who should see the extension in French until they choose a language themselves.

With Jamf or Microsoft Intune, use your platform’s variables for these values. Google Admin has no device variables: replace the placeholders by hand, and apply one policy per device. Devices that share a policy share one device ID and show up as a single device. Never copy one device ID to several devices.

3. Force-install the extension and apply the policy

In your device-management platform:

1. Force-install the managed extension for your browser.
2. Deliver the policy to the same browser and extension ID.
3. Scope the deployment to your pilot group.

Save or publish the policy, and let the device check in. Browsers can take several minutes to pick up a policy. If a manual policy reload doesn’t pick it up, restart the browser.

For Chrome profiles managed by Google Workspace, deliver the policy through the Google Admin console. For Edge, use Intune or your device-management platform: Google Admin doesn’t deliver Edge extension policy.

4. Check a pilot device

On a pilot device:

1. Check that the extension is installed and that the user can’t remove it.
2. Open chrome://policy or edge://policy, and click Reload policies.
3. Find the policy section for the Sanitized AI managed extension.
4. Check that every policy shows OK, that its source is your management platform, and that it shows the expected value.
5. Open the extension, and check that it’s ready for sign-in.
6. Sign in as a regular user, with a method your organization allows, and send a harmless test prompt on a protected AI tool.

If a required policy value is missing or invalid, the extension stays inactive and shows Managed extension configuration required, with the names of the missing fields. Correct the policy, reload policies, and restart the browser.

Before people sign in

A managed extension starts recording activity as soon as it’s installed. Until the person signs in with their work email, it only records: it doesn’t warn or block anyone. Plan your communication so people sign in soon after the deployment. Their welcome email tells them how.

Common policy checks

The following table lists common problems.

Problem	What to check
No Sanitized AI policy section	Check that the policy is assigned to the right browser and pilot group, and wait for the device to check in.
The policy is there but not OK	Compare the policy key names and value types with the downloaded template.
The extension says configuration is required	Check that the schema version, organization ID, device ID, and device name all have values.
The extension is installed but not managed	Check that the force-install entry uses the managed extension ID for that browser.
The icon isn’t in the toolbar	The templates don’t pin the icon. Users can find it in the browser’s extensions menu, or you can pin it with your browser’s extension policy.

Private windows

Browsers don’t run extensions in private windows by default, and a forced installation doesn’t change that. If people could work in private windows, consider turning off private browsing through your browser policy.

Remove the extension or retire a device

• To pause protection, remove the extension assignment or change its scope in your device-management platform. Keep the policy and device records until every affected device has received the change.
• To retire a device, also revoke it in Sanitized AI. On the Users page, find it under Managed devices, and then click Revoke. Removing the extension alone doesn’t remove the device record.

Firefox

The managed extension is for Chrome and Edge. To deploy the Sanitized AI extension on Firefox across your organization, contact Sanitized AI.