Macos iru

Deploy the AgentKeeper browser extension to Iru/Kandji-managed Macs using a Custom Profile for force-install and a Managed Preferences profile for the org API key.

Iru/Kandji · Custom Profiles

Deploy the AgentKeeper browser extension to Iru/Kandji-managed Macs using a Custom Profile for force-install and a Managed Preferences profile for the org API key.

Prerequisites

Iru/Kandji with Custom Profiles support
Chrome deployed to managed Macs
An org API key from Settings → Access → API keys (starts with ak_live_)

The AgentKeeper Chrome extension ID is lllalmnahkbikalapoancgfkiegfoiim (shared by Chrome, Edge, Brave, and Arc). It is already filled into the templates below.

Step 1: Create the force-install profile

In Iru/Kandji, go to Library → Add Library Item → Custom Profile.
Name it AgentKeeper Browser Extension - Chrome.
Upload or paste the following as a .mobileconfig file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.apple.ManagedClient.preferences</string>
      <key>PayloadIdentifier</key>
      <string>com.agentkeeper.chrome.forcelist</string>
      <key>PayloadUUID</key>
      <string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>PayloadEnabled</key>
      <true/>
      <key>PayloadContent</key>
      <dict>
        <key>com.google.Chrome</key>
        <dict>
          <key>Forced</key>
          <array>
            <dict>
              <key>mcx_value</key>
              <dict>
                <key>ExtensionInstallForcelist</key>
                <array>
                  <string>lllalmnahkbikalapoancgfkiegfoiim;https://clients2.google.com/service/update2/crx</string>
                </array>
              </dict>
            </dict>
          </array>
        </dict>
      </dict>
    </dict>
  </array>
  <key>PayloadDescription</key>
  <string>Force-installs the AgentKeeper browser extension in Chrome</string>
  <key>PayloadDisplayName</key>
  <string>AgentKeeper Browser Extension</string>
  <key>PayloadIdentifier</key>
  <string>com.agentkeeper.chrome.extension</string>
  <key>PayloadOrganization</key>
  <string>AgentKeeper</string>
  <key>PayloadRemovalDisallowed</key>
  <true/>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>B2C3D4E5-F6A7-8901-BCDE-F12345678901</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

Assign to the target Blueprint or device group.

Step 2: Create the managed config profile

Create a second Custom Profile to deliver the org API key:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.apple.ManagedClient.preferences</string>
      <key>PayloadIdentifier</key>
      <string>com.agentkeeper.chrome.managedconfig</string>
      <key>PayloadUUID</key>
      <string>C3D4E5F6-A7B8-9012-CDEF-123456789012</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>PayloadEnabled</key>
      <true/>
      <key>PayloadContent</key>
      <dict>
        <key>com.google.Chrome.extensions.lllalmnahkbikalapoancgfkiegfoiim</key>
        <dict>
          <key>Forced</key>
          <array>
            <dict>
              <key>mcx_value</key>
              <dict>
                <key>orgApiKey</key>
                <string>ak_live_xxxxxxxx</string>
                <key>backendUrl</key>
                <string>https://www.agentkeeper.dev/api</string>
              </dict>
            </dict>
          </array>
        </dict>
      </dict>
    </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>AgentKeeper Extension Config</string>
  <key>PayloadIdentifier</key>
  <string>com.agentkeeper.chrome.config</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>D4E5F6A7-B8C9-0123-DEFA-234567890123</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

Replace:

ak_live_xxxxxxxx: your organization API key

backendUrl is optional. The extension already defaults to https://www.agentkeeper.dev/api. Set it to your own host only for on-premises deployments.

Note on userEmail: Iru/Kandji Custom Profiles do not support per-user variable substitution in managed preferences. Set a static email if all devices belong to one user, or omit userEmail. User binding will still happen on the next AgentKeeper MDM sync cycle through machine ID matching.

Verifying the rollout

After the profile deploys (Iru/Kandji typically applies within minutes of the next check-in):

On a managed Mac, open chrome://policy. Confirm the extension entries appear.
Open chrome://extensions. AgentKeeper shows "Installed by your administrator".
Extension popup reads "Paired".

See Verifying deployment for the full checklist.

Covering Edge, Brave, Arc, Dia, Vivaldi

The example above targets Chrome only (com.google.Chrome). To deploy to additional Chromium browsers from a single Iru/Kandji Custom Profile, use the generated multi-browser profile. See macOS: Multi-browser.

Was this page helpful?