About Deployment

Enterprise deployment has two parts: force-installing the extension via MDM so it appears on every managed browser, and delivering a managed config so the extension self-enrolls without user interaction.

Zero-touch enrollment flow

Admin creates an org API key in AgentKeeper
  (Settings → Access → API keys)
        ↓
Admin deploys browser policy via MDM:
  - force_installed: lllalmnahkbikalapoancgfkiegfoiim + update URL
  - managed config: { orgApiKey, userEmail }
        ↓
Browser installs extension automatically
        ↓
Extension reads chrome.storage.managed → orgApiKey present
        ↓
Extension self-enrolls with AgentKeeper backend
        ↓
Fleet view shows device bound to the correct user

The IT admin's only steps are: (1) get an org API key from AgentKeeper and (2) push the browser policy. No per-device configuration, no user action.

An AgentKeeper MDM connector can still be useful for device inventory and broader fleet workflows, but it is not part of browser extension self-enrollment. The extension pairs through the org API key in managed browser policy.

Extension IDs

Edge, Brave, Arc, Dia, and Vivaldi accept the same Chrome Web Store extension ID. No separate listing required.

To deploy to multiple Chromium browsers from a single Apple configuration profile on macOS, see macOS: Multi-browser. One .mobileconfig and one upload cover every browser.

Managed config schema

The extension reads three keys from chrome.storage.managed:

{
  "orgApiKey": "ak_live_xxxxxxxx",
  "backendUrl": "https://www.agentkeeper.dev/api",
  "userEmail": "{{userPrincipalName}}"
}

MDM variable substitution for userEmail

Without userEmail, the device still enrolls and events still flow. User binding happens on the next MDM sync cycle (every 30 minutes) once the extension's machine ID is matched to a directory user via email.

If you are not running MDM inventory sync, include userEmail. That is the direct way for zero-touch extension enrollment to bind the browser install to the expected directory user.

Step 1: Get an org API key

1. Open Settings → Access → API keys in the AgentKeeper dashboard.
2. Create a key named Browser Extension Fleet (or any descriptive name).
3. Copy the key. It starts with ak_live_.

This key is used in the managed config orgApiKey field pushed to every managed device.

Step 2: Choose a deployment path

Select the guide for your MDM and operating system:

Verifying after rollout

After policy is pushed, confirm on a managed machine:

1. chrome://policy shows ExtensionInstallForcelist with the AgentKeeper entry.
2. chrome://extensions shows AgentKeeper with "Installed by your administrator".
3. The extension popup shows "Paired" within seconds of first launch.
4. The device appears in Inventory → Workstations in the AgentKeeper dashboard.

See Verifying deployment for the full validation checklist.