Manage browser extensions with device policy

Manage which browser extensions are installed on your devices — including the Keep Aware extension — directly from a Device Configuration Profile. Define extension policy once, optionally let Keep Aware merge in its own extension automatically, and download a ready-to-deploy configuration profile for your MDM. You no longer have to hand-maintain Keep Aware extension IDs in your own MDM to keep the extension pinned.

This page focuses on extensions and on downloading a configuration profile. For the full list of supported browser policies and how profiles sync to the client, see Deploy device configurations.

Requirements

• A Device Configuration Profile. See Deploy device configurations to create one.
• For the MDM download path: an MDM that distributes Apple configuration profiles (.mobileconfig), such as Jamf, Kandji, Intune, or JumpCloud.

Getting started

Extension policy lives in the Policies field of a Device Configuration Profile, alongside your other browser policies.

1. Open Profiles in the Keep Aware console.
2. Create or open a Device configuration profile.
3. Find the Policies field in the profile editor.

From here you can pin your own extensions, opt in to the Keep Aware extension merge, and download the profile as a configuration template.

Manage your own extensions

Extensions are controlled with the ExtensionSettings policy inside the Policies JSON. Map each extension ID to an installation mode:

• force_installed — Automatically installed and can't be removed by the user. Requires update_url on Chromium browsers, or install_url on Firefox.
• normal_installed — Installed, but the user can disable it.
• allowed — The user may install it.
• blocked — The user can't install it.

Use the * selector for all browsers, or target a specific browser. Browser-specific entries override the global * entry.

Force-install a password manager

{
  "chrome": {
    "ExtensionSettings": {
      "aeblfdkhhhdcdjpifhhbdiojplfjncoa": {
        "installation_mode": "force_installed",
        "update_url": "https://clients2.google.com/service/update2/crx"
      }
    }
  }
}

note

Chromium browsers (Chrome, Edge, Brave, and others) use update_url pointing at the web store. Firefox uses install_url pointing at the signed .xpi. Use the form that matches each browser.

Include the Keep Aware extension policy

The Keep Aware extension can be merged into the profile automatically. In the profile editor, check Include Keep Aware extension policy, directly under the Policies field.

When this is on, Keep Aware merges its own extension policy into the profile every time the profile is exported as an MDM template or applied by the client. Specifically, it:

• Force-installs the Keep Aware extension on each supported browser, using the correct store and installation method for that browser.
• Connects the extension to your tenant by adding your tenant deployment settings (ka_host, ka_name, ka_start) for each browser.
• Preserves your own extensions. Your non–Keep Aware ExtensionSettings entries are kept exactly as you wrote them; only the Keep Aware extension is added.

You don't add Keep Aware extension IDs to the Policies JSON yourself — they're guard-railed out of the editable policy and merged in at export and apply time. That means the Keep Aware pin stays correct even as you change your own extension policy, and you don't have to maintain Keep Aware's IDs in your MDM to avoid a conflict.

What gets added per browser

Browser	What Keep Aware adds
Chrome, Edge, Brave, and other Chromium browsers	Force-installs the Keep Aware extension and adds its tenant connection settings.
Firefox	Force-installs the signed Keep Aware add-on (install_url), enables enterprise policies, and adds tenant connection settings.
Safari	Adds the Keep Aware Safari app's tenant connection settings.

The merge is additive and off by default. Existing profiles are unchanged until you check the box.

Download a configuration profile

Download the profile as a configuration template to distribute through your MDM.

1. Save the profile. The Download button is disabled while you have unsaved changes.
2. In the Policies section, select Download configuration.
3. In the Download configuration panel, choose a Format. Apple mobileconfig is available for MDM distribution to macOS devices.
4. Choose a Browser — all browsers, or a single browser to scope the profile.
5. Select Download.

The downloaded .mobileconfig contains your browser policies, your own extension pins, and — if Include Keep Aware extension policy is checked — the Keep Aware extension merged in. Keep Aware pre-fills the deployment keys (ka_host, ka_name, ka_start) with your tenant values, so the file is ready to deploy as-is.

Deploy through your MDM

1. In your MDM (Jamf, Kandji, Intune, JumpCloud, and others), create a custom macOS configuration profile.
2. Upload the downloaded .mobileconfig.
3. Scope the profile to the devices or groups you want.

For a broader walkthrough of macOS deployment, see the Mac deployment guide.

Verifying

After the profile applies, confirm the policy on a device:

• Chrome: chrome://policy
• Edge: edge://policy
• Firefox: about:policies

Check that your pinned extensions and the Keep Aware extension both appear. The device and its browsers should also report into the console on the Devices and Browsers pages once the extension connects to your tenant. Restarting the browser forces a policy refresh.

Frequently asked questions

Question	Answer
Does this overwrite my own extensions?	No. Your non–Keep Aware ExtensionSettings entries are preserved. Only the Keep Aware extension is added.
Do I need to add the Keep Aware extension IDs to my policy?	No. They're merged in automatically when the box is checked.
Which browsers are supported?	Chrome, Edge, Brave, and other Chromium browsers, plus Firefox and Safari.
Are the tenant deployment keys filled in for me?	Yes. Keep Aware pre-fills ka_host, ka_name, and ka_start with your tenant values at download time.
What format can I download?	Apple .mobileconfig, for distribution through an MDM to macOS devices.
What happens if I turn the checkbox off?	No Keep Aware extension policy is added. Your other policies and your own extension pins are unchanged.

Examples

Extensions plus the Keep Aware merge

Pin your own extensions, set a few browser policies, and check Include Keep Aware extension policy. Keep Aware merges its extension into each browser alongside your entries.

Extension policy with Keep Aware merge

{
  "*": {
    "PasswordManagerEnabled": false,
    "AutofillEnabled": false,
    "PrivateModeAvailable": false,
    "DeveloperToolsAvailable": false,
    "DisableBrowserGuestMode": true,
    "Homepage": "https://intranet.company.com",
    "NewTabPage": "https://portal.company.com"
  },
  "chrome": {
    "ExtensionSettings": {
      "aeblfdkhhhdcdjpifhhbdiojplfjncoa": {
        "installation_mode": "force_installed",
        "update_url": "https://clients2.google.com/service/update2/crx"
      }
    },
    "GenAISidecarEnabled": false
  }
}

With the box checked, the downloaded profile force-installs your extensions and the Keep Aware extension on each browser, and pre-fills the Keep Aware tenant connection settings — with no manual extension IDs to maintain.