Macos multi browser

Jamf · Iru/Kandji · Intune · One profile for every Chromium browser

Deploy the AgentKeeper extension to every Chromium browser on a macOS fleet from a single Apple configuration profile. The profile force-installs the extension and delivers managed config (orgApiKey, userEmail, backendUrl) to each browser's managed preferences domain.

The dashboard generates this file for you. Go to Inventory → Browsers → Deploy with → Jamf, Iru/Kandji, or Intune, select the browsers, choose your MDM's userEmail token, and download the profile.

Why a multi-browser profile

Every Chromium browser (Chrome, Edge, Brave, Arc, Dia, Vivaldi) installs extensions from the Chrome Web Store and accepts the same extension ID. What differs per browser is the macOS preference domain the browser reads its policies from:

A .mobileconfig that only targets com.google.Chrome will not affect Edge or Brave, even though both are Chromium and can install from the Chrome Web Store. The generated profile emits two payloads per selected browser:

1. Force-install: Writes ExtensionInstallForcelist to the browser's preference domain.
2. Managed config: Writes orgApiKey, backendUrl, and userEmail to <bundleId>.extensions.<extensionId>.

Opera is intentionally excluded. Opera's force-install model uses Opera Add-ons IDs and does not honor Chrome Web Store update_url policies. If you need Opera coverage, contact us.

Prerequisites

• macOS MDM with custom profile support (Jamf, Iru/Kandji, or Microsoft Intune)
• At least one supported Chromium browser deployed to managed Macs
• An org API key from Settings → Access → API keys (starts with ak_live_)
• The AgentKeeper Chrome extension ID

Step 1: Generate the profile

1. Open Inventory → Browsers in the AgentKeeper dashboard.
2. Generate or copy your MDM enrollment key.
3. Expand macOS · Chromium fleet.
4. Select the browsers you want to manage. Default selects all six.
5. Choose the userEmail substitution that matches your MDM:
   • Jamf → {EmailAddress}
   • Microsoft Intune → {{userPrincipalName}}
   • Iru/Kandji → ${user_email} (Iru/Kandji does not interpolate this token automatically; treat it as a placeholder you fill in via Custom Profile variables)
   • Static / none → leaves userEmail empty; binding falls back to email-on-next-sync
6. Click Download to save agentkeeper-browser-extension.mobileconfig.
7. Replace EXTENSION_ID in the file with the AgentKeeper Chrome Web Store extension ID.

The UUIDs in the profile are deterministic. Downloading again with the same browser selection produces the same UUIDs, so the MDM updates the existing profile in place instead of creating a duplicate.

Step 2: Upload to your MDM

Jamf Pro

1. Go to Computers → Configuration Profiles → New.
2. Choose Upload and select the downloaded .mobileconfig.
3. Scope to your target Macs or smart group.
4. Save and distribute.

Jamf will preserve the userEmail token. Devices that are assigned to a user in Jamf resolve {EmailAddress} automatically.

Iru/Kandji

1. Go to Library → Add Library Item → Custom Profile.
2. Upload the .mobileconfig.
3. Assign to the target Blueprint.

Iru/Kandji Custom Profile payloads do not substitute per-user variables in managed preferences. Either leave userEmail empty (binding happens on the next MDM sync) or set a static value if every device belongs to the same user.

Microsoft Intune (macOS)

1. Go to Devices → Configuration → Create → Templates → Custom.
2. Profile type: Custom.
3. Upload the .mobileconfig as a Custom configuration profile.
4. Assign to your macOS device group.

Intune substitutes {{userPrincipalName}} on macOS for the enrolled user's UPN.

Step 3: Verify

On a managed Mac after policy applies (typically within 5 minutes of the next check-in):

1. Open each browser in turn. For each one:
   • Chrome / Edge: Open chrome://policy or edge://policy. ExtensionInstallForcelist and the managed configuration keys should appear.
   • Brave: brave://policy
   • Arc / Dia: chrome://policy (Arc and Dia inherit Chromium's policy surface)
   • Vivaldi: vivaldi://policy
2. Open chrome://extensions (or the equivalent). AgentKeeper shows "Installed by your administrator" and cannot be removed.
3. The extension popup reads Paired within a few seconds of first launch.
4. The device appears in Inventory → Workstations in the AgentKeeper dashboard.

See Verifying deployment for the full checklist.

What the generated profile looks like

The downloaded file is plain XML. A profile that targets Chrome and Edge with the Jamf userEmail token contains two payloads for each browser: a force-install payload keyed by the bundle ID and a managed configuration payload keyed by <bundleId>.extensions.<extensionId>.

<dict>
  <key>PayloadType</key>
  <string>com.apple.ManagedClient.preferences</string>
  <key>PayloadIdentifier</key>
  <string>com.agentkeeper.browser-extension.edge.forcelist</string>
  <key>PayloadContent</key>
  <dict>
    <key>com.microsoft.Edge</key>
    <dict>
      <key>Forced</key>
      <array>
        <dict>
          <key>mcx_preference_settings</key>
          <dict>
            <key>ExtensionInstallForcelist</key>
            <array>
              <string>EXTENSION_ID;https://clients2.google.com/service/update2/crx</string>
            </array>
          </dict>
        </dict>
      </array>
    </dict>
  </dict>
</dict>

Caveats

• Edge requires the Chrome Web Store update URL. The generated profile uses https://clients2.google.com/service/update2/crx for every browser, including Edge. Microsoft Edge honors the Chrome Web Store as a source. If another Edge policy blocks that store, allow it before deployment.
• Arc and Dia inherit Chromium policy surface. They read the same ExtensionInstallForcelist and managed config keys as Chrome but under their own bundle IDs.
• The extension ID is the same across browsers. Do not publish separate listings on Edge Add-ons and the Chrome Web Store unless you fix the key field in the extension manifest. Otherwise, the same extension gets a different ID in each store and this profile will not match.