MDM & Chrome Enterprise

Two control layers

Who needs MDM

• Developer / Startup — usually skip MDM; use publishable keys + optional Shield enforcement for small teams.
• Business — self-serve this guide when Chrome is already managed (Intune / Google Admin).
• Enterprise — same policies, plus assisted rollout (extension ID handoff, OU targeting, SSO alignment). Contact sales for a managed onboarding.

Force-install policy

Pinned Chrome extension ID: menkdjnceoodpmhhpjflenahlecbfobo. Update URL: https://clients2.google.com/service/update2/crx.

{
  "menkdjnceoodpmhhpjflenahlecbfobo": {
    "installation_mode": "force_installed",
    "update_url": "https://clients2.google.com/service/update2/crx"
  }
}

installation_mode: force_installed installs the extension and blocks user uninstall / disable on managed browsers. For a softer rollout use normal_installed (allowed but removable) while you pilot.

Google Admin

1. Admin console → Devices → Chrome → Apps & extensions.
2. Select the OU (organization unit) for employees using LLMs.
3. Add the NoeticGuard extension by ID (menkdjnceoodpmhhpjflenahlecbfobo) or Chrome Web Store URL.
4. Set installation policy to Force install (and optionally pin to toolbar).
5. Allow time for policy sync; verify on a managed Chrome profile that uninstall is unavailable.

Microsoft Intune

1. Deploy Administrative Templates → Google Chrome → Extensions (or the Edge equivalent if you manage Edge Chromium the same way).
2. Configure Configure the list of force-installed extensions with:
   textCopy

   menkdjnceoodpmhhpjflenahlecbfobo;https://clients2.google.com/service/update2/crx

3. Assign the configuration profile to the device / user groups that need Browser Shield.
4. Confirm on a managed Windows endpoint that Chrome reports the extension as installed by policy.

Incognito / private windows

Chrome does not run extensions in Incognito by default. Force-install and Shield enforcement do not close this gap: without an extra browser policy, an employee can open ChatGPT in a private window and Shield will not inject — so masking does not run.

Recommended — disable Incognito

Set Chrome policy IncognitoModeAvailability to 1 (Incognito disabled). That removes the private-window bypass entirely for managed browsers.

• Google Admin — Devices → Chrome → Settings → Security → Incognito mode → Disallow incognito mode (apply to the same OUs as force-install).
• Intune — Administrative Templates → Google Chrome → Incognito mode availability → Enabled → Incognito mode disabled.

// Example fragment for a Chrome policy bundle / registry export
{
  "IncognitoModeAvailability": 1
}

Soft option — keep Incognito, require user opt-in

If the org must keep private windows, instruct users to open chrome://extensions → NoeticGuard Shield → Details → enable Allow in Incognito. Where Chrome supports it, pair with MandatoryExtensionsForIncognitoNavigation listing the Shield extension ID so Incognito navigation is blocked until the user allows Shield. Prefer disabling Incognito when compliance requires continuous LLM masking.

After install

1. Issue a workspace ng_pub_ key (Dashboard → API Keys) and distribute via your secret / MDM config workflow — never commit keys to source control.
2. Set Policies → Shield enforcement to Required so the popup toggle stays locked on.
3. Close the Incognito gap (above) — disable Incognito on managed browsers, or document Allow in Incognito for teams that keep private windows.
4. Confirm Home / Audit shows extension activity after employees open a supported LLM site.

Need a private CRX or OU design review? Talk to us — Enterprise includes assisted MDM onboarding.