Intune Chrome Extension Best Practices

This article provides best practices for configuring Securly’s Google Chrome extensions using Microsoft Intune.

Follow these steps to deploy the Securly Chrome extension optimally via Intune.

1. Sign in to the Microsoft Endpoint Manager admin center

2. Select Devices > Windows > Configuration > Create New Policy. 

3. Select “Platform”, “Windows 10 and later”, and then select “Profile type”, “Settings catalog”.

Click on the “Create” button.

4. On the Basics tab, enter a descriptive name, such as "Manage Chrome Extension", then select Next.

5. In Configuration settings, select “+ Add settings”.

6. Search for “Chrome” and select “Google Google Chrome Extensions” to see all the settings in this category. 

7. Navigate to ‘Settings picker’, select ‘Configure extension installation blocklist' enable this setting and add “*”. This will prevent other extensions from installing in the Chrome browser. 

8. Now, search for “google” in the settings picker section and select “Google Google Chrome” to see all the settings in this category.

9. Select ‘Browser sign in settings’ for either user or device and set it to enabled.  Then, “Force users to sign-in to use the browser”.

10. Select ‘Block access to a list of URLs’ for either user or device and set it to enabled.  Then, enter the following list:

• chrome://addresses
• chrome://certificate-manager
• chrome://extensions
• chrome://flags
• chrome://hang
• chrome://inspect
• chrome://kill
• chrome://network
• chrome://serviceworker-internals
• chrome://settings/privacy
• chrome://settings/reset
• chrome://settings/signOut
• chrome://settings/system
• chrome://version
• data://*
• devtools://*
• javascript://*

11. Select ‘Control where Developer Tools can be used’ for either user or device and set it to enabled and “Disallow usage of Developer Tools”.

12. Select ‘Enable network prediction’ for either user or device and enable it.  Then set it to “Do not predict network actions on any network connection”.

13. Select ‘Incognito mode availability’ for either user or device and enable it.  Then, set it to “Incognito mode disabled”.

14. In the ‘Assignments’ section select the device/user groups you want to target. 

When the configuration policy is complete, it will take time for the settings to push out for the users. It will depend on the sync frequency between the Windows device and Intune.

If you have a testing device handy, you can find the device and force the sync. Learn more about how to do that here.