Macos intune

Intune · Settings Catalog · macOS

Deploy the AgentKeeper browser extension to macOS devices managed by Microsoft Intune using a Settings Catalog policy for force-install and a Custom .mobileconfig profile for the managed config.

Prerequisites

• Microsoft Intune with macOS device management
• Chrome deployed to managed Macs
• An org API key from Settings → Access → API keys (starts with ak_live_)

The AgentKeeper Chrome extension ID is lllalmnahkbikalapoancgfkiegfoiim (shared by Chrome, Edge, Brave, and Arc). It is already filled into the templates below.

Step 1: Force-install the extension

1. In the Intune admin center, go to Devices → Configuration → Create → New Policy.
2. Platform: macOS, Profile type: Settings Catalog.
3. Search for and add: Google Chrome → Extensions → Configure the list of force-installed extensions.
4. Add the entry:

lllalmnahkbikalapoancgfkiegfoiim;https://clients2.google.com/service/update2/crx

5. Assign to your target macOS device group.

Step 2: Deploy managed config

Do not deliver the config through the Settings Catalog "Configure extension management settings" item (the ExtensionSettings policy). Chrome rejects a nested managed_configuration block with Schema validation error: Unknown property: managed_configuration and the extension never receives its config. On macOS, Chrome reads extension managed storage from a managed-preferences plist whose domain is com.google.Chrome.extensions.<id> with flat keys. Deliver that through a Custom profile.

1. Go to Devices → Configuration → Create → New Policy. Set Platform to macOS and Profile type to Templates → Custom.
2. Upload a .mobileconfig whose payload sets preference domain com.google.Chrome.extensions.lllalmnahkbikalapoancgfkiegfoiim with the flat keys:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>orgApiKey</key>
  <string>ak_live_xxxxxxxx</string>
  <key>backendUrl</key>
  <string>https://www.agentkeeper.dev/api</string>
  <key>userEmail</key>
  <string>dev@example.com</string>
</dict>
</plist>

Replace ak_live_xxxxxxxx with your organization API key. backendUrl is optional because the extension defaults to https://www.agentkeeper.dev/api; only set it (to your own host) for on-prem. userEmail is required for correct workstation attribution and, in a Custom .mobileconfig, is not token-substituted by Intune, so set a real address per profile. orgApiKey alone is enough for the extension to connect, but a device that enrolls without a userEmail stays unattributed and appears as an anonymous workstation. Directory sync cannot recover it on its own: with no email (and no provider user id) on the captured events there is nothing to match the device against.

3. Assign to the same device group.

For a ready-made multi-browser .mobileconfig (Chrome, Edge, Brave, Arc, and others), use the generated profile. See macOS: Multi-browser.

Step 3: Sync and verify

1. Trigger a sync: Devices → select a device → Sync.
2. Chrome applies the policy on next launch (typically within 5 minutes).

Verifying the rollout

On a managed Mac after policy sync:

1. Open chrome://policy. Confirm ExtensionInstallForcelist and managed config keys appear.
2. Open chrome://extensions. AgentKeeper shows "Installed by your administrator".
3. Extension popup reads "Paired".

See Verifying deployment for the full checklist including dashboard confirmation.

Covering Edge, Brave, Arc, Dia, Vivaldi

The Settings Catalog path above targets Chrome only. To deploy to multiple Chromium browsers from a single Intune Custom configuration profile, use the generated multi-browser .mobileconfig. See macOS: Multi-browser.