Skip to main content

Overview

Deploy the Velatir browser extension to managed devices with pre-configured settings. This guide covers deployment via Microsoft Intune (Windows), SCCM / Configuration Manager (Windows), and Jamf Pro (macOS).

Extension Details

BrowserExtension IDStore Link
ChromebbiokppljpbjgiogcoggjnfffbeiihjaChrome Web Store
EdgephgnjcoglpdamjjmidheehacjbkgkoocEdge Add-ons
Firefoxvelatir@velatir.comFirefox Add-ons

Managed Configuration

The extension accepts configuration via managed storage:
PropertyTypeDescription
apiTokenstringYour Velatir API key
organizationNamestringDisplay name shown in the extension
Additional properties (endpoint, organizationId, enabledServices) are available for advanced configurations. Contact support if you need these.

Microsoft Intune (Windows)

This is the simplest and most reliable method. It works on all Windows editions (Pro, Enterprise, Education), deploys to all browsers in one step, and configures the API token and organisation name automatically. Contact hello@velatir.com to request the MSI installer file.

MSI Properties

PropertyRequiredDescription
API_TOKENYesYour Velatir API token (e.g., vltr_...)
ORGANIZATION_NAMEYesYour organisation’s display name shown in the extension
ADDLOCALNoComma-separated list of browsers. Defaults to all. Options: Chrome, Edge, Firefox

Steps

  1. Sign in to the Microsoft Intune admin center
  2. Navigate to Apps > All apps, then click + Add
  3. Select Line-of-Business app as the App Type
  4. Upload VelatirExtension.msi in the App package file field and click OK
  5. In App information, fill in the following:
    • Name: Velatir Browser Extension
    • Description: Velatir AI compliance browser extension
    • Publisher: Velatir
    • Set Ignore app version to No
    • In the Command-line arguments field, enter:
      /qn API_TOKEN="vltr_yourApiTokenHere" ORGANIZATION_NAME="Your Organization"
      
  6. Click OK, then click Next
  7. In the Assignments tab, click Add group and select the device groups to deploy to
  8. Click Next, review your configuration, and click Create
To deploy to specific browsers only, add ADDLOCAL to the command-line arguments:
/qn API_TOKEN="vltr_yourApiTokenHere" ORGANIZATION_NAME="Your Organization" ADDLOCAL=Chrome,Edge

Updating the API Token

To rotate the API token, update the command-line arguments with the new token value and redeploy. Reinstalling overwrites the existing registry keys:
/qn API_TOKEN="vltr_newTokenHere" ORGANIZATION_NAME="Your Organization"
The MSI writes registry keys to force-install the extension from each browser’s official store and configure managed storage with your API token. No files are copied beyond a marker in Program Files\Velatir. Uninstalling removes all registry keys cleanly.

Method B: Registry Keys via Remediations

Intune Remediations require Windows Enterprise or Education editions. They silently do nothing on Windows Pro. No error is shown and the scripts will not execute. If your fleet includes Windows Pro devices, use Method A: MSI via Line-of-Business App instead.
Use this method to write registry keys directly via PowerShell scripts. This gives you fine-grained control over per-browser deployment.
  1. Go to Devices > Remediations > Create script package
  2. Name it (e.g., “Velatir Chrome Extension Deployment”)
  3. Add the detection and remediation scripts for your browser (see tabs below)
  4. Configure the script package:
    • Run this script using the logged-on credentials: No
    • Enforce script signature check: No
    • Run script in 64-bit PowerShell: Yes
  5. Assign to your device groups
  6. Set the schedule (e.g., once per day)
Detection script (Detect-VelatirChrome.ps1):
$ExtensionId = "bbiokppljpbjgiogcoggjnfffbeiihja"
$ForcelistPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
$PolicyPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\$ExtensionId\policy"

# Check if extension is in force install list
$ForcelistExists = $false
if (Test-Path $ForcelistPath) {
    $Values = Get-ItemProperty -Path $ForcelistPath -ErrorAction SilentlyContinue
    foreach ($Property in $Values.PSObject.Properties) {
        if ($Property.Value -like "$ExtensionId;*") {
            $ForcelistExists = $true
            break
        }
    }
}

# Check if policy configuration exists
$PolicyExists = (Test-Path $PolicyPath) -and
                (Get-ItemProperty -Path $PolicyPath -Name "apiToken" -ErrorAction SilentlyContinue)

if ($ForcelistExists -and $PolicyExists) {
    Write-Output "Velatir Chrome extension is configured"
    exit 0
} else {
    Write-Output "Velatir Chrome extension needs configuration"
    exit 1
}
Remediation script (Remediate-VelatirChrome.ps1):
# Configuration - UPDATE THESE VALUES
$ApiToken = "your-api-token-here"
$OrganizationName = "Your Organization"

# Extension details
$ExtensionId = "bbiokppljpbjgiogcoggjnfffbeiihja"
$UpdateUrl = "https://clients2.google.com/service/update2/crx"

# Registry paths
$ForcelistPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
$PolicyPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\$ExtensionId\policy"

# Create ExtensionInstallForcelist
if (-not (Test-Path $ForcelistPath)) {
    New-Item -Path $ForcelistPath -Force | Out-Null
}

# Find next available index
$NextIndex = 1
$ExistingValues = Get-ItemProperty -Path $ForcelistPath -ErrorAction SilentlyContinue
if ($ExistingValues) {
    $Indices = $ExistingValues.PSObject.Properties |
               Where-Object { $_.Name -match '^\d+$' } |
               ForEach-Object { [int]$_.Name }
    if ($Indices) { $NextIndex = ($Indices | Measure-Object -Maximum).Maximum + 1 }

    # Check if already exists
    foreach ($Property in $ExistingValues.PSObject.Properties) {
        if ($Property.Value -like "$ExtensionId;*") {
            $NextIndex = $null
            break
        }
    }
}

if ($NextIndex) {
    Set-ItemProperty -Path $ForcelistPath -Name $NextIndex -Value "$ExtensionId;$UpdateUrl"
}

# Create 3rdparty policy configuration
if (-not (Test-Path $PolicyPath)) {
    New-Item -Path $PolicyPath -Force | Out-Null
}

Set-ItemProperty -Path $PolicyPath -Name "apiToken" -Value $ApiToken -Type String
Set-ItemProperty -Path $PolicyPath -Name "organizationName" -Value $OrganizationName -Type String

Write-Output "Velatir Chrome extension configured successfully"

Method C: Settings Catalog (Force Install Only)

Use this method if you only need to force-install the extension without pre-configured settings. Users will need to enter their API token manually after installation.
The Intune Settings Catalog does not support Firefox extension deployment. For Firefox, use Method A or Method B.
  1. Sign in to the Microsoft Intune admin center
  2. Go to Devices > Configuration > Create > New policy
  3. Select:
    • Platform: Windows 10 and later
    • Profile type: Settings catalog
  4. Name your profile (e.g., “Velatir Chrome Extension”)
  5. Click Add settings and search for Google Chrome
  6. Select Google Chrome > Extensions
  7. Enable Configure the list of force-installed apps and extensions
  8. Add the following value:
    bbiokppljpbjgiogcoggjnfffbeiihja;https://clients2.google.com/service/update2/crx
    
  9. Assign to your device groups and create the profile

SCCM / Configuration Manager (Windows)

If your organisation uses Microsoft SCCM (ConfigMgr) instead of Intune, you can deploy the Velatir browser extension using the pre-built MSI installer that Velatir provides. No need to build anything. Just pass your API token and organisation name as properties at install time. Contact hello@velatir.com to request the MSI installer file.

MSI Properties

PropertyRequiredDescription
API_TOKENYesYour Velatir API token (e.g., vltr_...)
ORGANIZATION_NAMEYesYour organisation’s display name shown in the extension
ADDLOCALNoComma-separated list of browsers. Defaults to all. Options: Chrome, Edge, Firefox

Step 1: Create an Application

  1. Open the Configuration Manager Console
  2. Navigate to Software Library > Application Management > Applications
  3. Click Create Application > Manually specify the application information
  4. Add a Deployment Type and select Script Installer
  5. Set the content location to the network share containing VelatirExtension.msi

Step 2: Configure Install Command

All browsers (Chrome, Edge, and Firefox):
msiexec /i VelatirExtension.msi API_TOKEN=vltr_yourApiTokenHere ORGANIZATION_NAME="Your Organization" /qn
Specific browsers only (e.g., Chrome and Edge):
msiexec /i VelatirExtension.msi API_TOKEN=vltr_yourApiTokenHere ORGANIZATION_NAME="Your Organization" ADDLOCAL=Chrome,Edge /qn
Uninstall command:
msiexec /x VelatirExtension.msi /qn

Step 3: Configure Detection Method

Use a registry-based detection rule to check if the extension is already configured:
SettingValue
HiveHKEY_LOCAL_MACHINE
KeySOFTWARE\Policies\Google\Chrome\3rdparty\extensions\bbiokppljpbjgiogcoggjnfffbeiihja\policy
ValueapiToken
Data TypeString
RuleThe registry setting must exist

Step 4: Deploy

  1. Right-click the application > Deploy
  2. Select the target Device Collection
  3. Set purpose to Required (auto-install) or Available (self-service via Software Center)
  4. Set a deployment schedule and complete the wizard

Updating the API Token

To rotate the API token, re-deploy the MSI with the new value. Reinstalling overwrites the existing registry keys:
msiexec /i VelatirExtension.msi API_TOKEN=vltr_newTokenHere ORGANIZATION_NAME="Your Organization" /qn
The MSI writes registry keys to force-install the extension from the browser’s official store and configure managed storage with your API token. No files are copied beyond a marker in Program Files\Velatir. Uninstalling removes all registry keys cleanly.

Jamf Pro (macOS)

Combined Configuration Profile (Chrome + Edge)

If you deploy both Chrome and Edge, you can use a single .mobileconfig profile that handles force-install and managed storage for both browsers. Upload this to Jamf Pro as a Configuration Profile (or any MDM that supports .mobileconfig files).
Replace XXXXXXXXXXXX with your Velatir API token and Your Organization with your organisation’s display name before deploying.
velatir-browser-extension.mobileconfig
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <!-- Chrome: Force install -->
        <dict>
            <key>PayloadType</key>
            <string>com.google.Chrome</string>
            <key>PayloadIdentifier</key>
            <string>com.velatir.chrome.forcelist</string>
            <key>PayloadUUID</key>
            <string>5ECD8344-941A-45C0-BE37-7E13BCBBBBBE</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>ExtensionInstallForcelist</key>
            <array>
                <string>bbiokppljpbjgiogcoggjnfffbeiihja;https://clients2.google.com/service/update2/crx</string>
            </array>
        </dict>
        <!-- Chrome: Extension managed storage -->
        <dict>
            <key>PayloadType</key>
            <string>com.google.Chrome.extensions.bbiokppljpbjgiogcoggjnfffbeiihja</string>
            <key>PayloadIdentifier</key>
            <string>com.velatir.chrome.extension.config</string>
            <key>PayloadUUID</key>
            <string>5102578B-1554-4556-B895-591A7621A7F8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>apiToken</key>
            <string>XXXXXXXXXXXX</string>
            <key>organizationName</key>
            <string>Your Organization</string>
        </dict>
        <!-- Edge: Force install -->
        <dict>
            <key>PayloadType</key>
            <string>com.microsoft.Edge</string>
            <key>PayloadIdentifier</key>
            <string>com.velatir.edge.forcelist</string>
            <key>PayloadUUID</key>
            <string>590735BD-010D-4C3E-BB5B-0FF9DE7577B8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>ExtensionInstallForcelist</key>
            <array>
                <string>phgnjcoglpdamjjmidheehacjbkgkooc;https://edge.microsoft.com/extensionwebstorebase/v1/crx</string>
            </array>
        </dict>
        <!-- Edge: Extension managed storage -->
        <dict>
            <key>PayloadType</key>
            <string>com.microsoft.Edge.extensions.phgnjcoglpdamjjmidheehacjbkgkooc</string>
            <key>PayloadIdentifier</key>
            <string>com.velatir.edge.extension.config</string>
            <key>PayloadUUID</key>
            <string>963ED0A7-556F-45A6-8F17-A0DBDF3DA264</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>apiToken</key>
            <string>XXXXXXXXXXXX</string>
            <key>organizationName</key>
            <string>Your Organization</string>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Velatir Browser Extension</string>
    <key>PayloadIdentifier</key>
    <string>com.velatir.browser.profile</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>D582F777-FEBE-4B67-A3DC-35FD07F37E03</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Chrome Extension

  1. In Jamf Pro, go to Computers > Configuration Profiles > New
  2. Name the profile (e.g., “Velatir Chrome Extension”)
  3. Select Application & Custom Settings > External Applications > Add
  4. Set Source to Custom Schema or Upload
  5. Set Preference Domain to com.google.Chrome
  6. Upload or paste the following plist content:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>ExtensionInstallForcelist</key>
    <array>
        <string>bbiokppljpbjgiogcoggjnfffbeiihja;https://clients2.google.com/service/update2/crx</string>
    </array>
    <key>3rdparty</key>
    <dict>
        <key>extensions</key>
        <dict>
            <key>bbiokppljpbjgiogcoggjnfffbeiihja</key>
            <dict>
                <key>apiToken</key>
                <string>your-api-token-here</string>
                <key>organizationName</key>
                <string>Your Organization</string>
            </dict>
        </dict>
    </dict>
</dict>
</plist>
  1. Scope the profile to your target computers
  2. Save the configuration profile

Edge Extension

  1. Create a new Configuration Profile
  2. Add Application & Custom Settings > External Applications
  3. Set Preference Domain to com.microsoft.Edge
  4. Use the following plist content:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>ExtensionInstallForcelist</key>
    <array>
        <string>phgnjcoglpdamjjmidheehacjbkgkooc;https://edge.microsoft.com/extensionwebstorebase/v1/crx</string>
    </array>
    <key>3rdparty</key>
    <dict>
        <key>extensions</key>
        <dict>
            <key>phgnjcoglpdamjjmidheehacjbkgkooc</key>
            <dict>
                <key>apiToken</key>
                <string>your-api-token-here</string>
                <key>organizationName</key>
                <string>Your Organization</string>
            </dict>
        </dict>
    </dict>
</dict>
</plist>
  1. Scope and save the profile

Firefox Extension

Firefox on macOS uses the preference domain org.mozilla.firefox and requires EnterprisePoliciesEnabled to be set to true.
  1. Create a new Configuration Profile
  2. Add Application & Custom Settings > External Applications
  3. Set Preference Domain to org.mozilla.firefox
  4. Use the following plist content:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>EnterprisePoliciesEnabled</key>
    <true/>
    <key>ExtensionSettings</key>
    <dict>
        <key>velatir@velatir.com</key>
        <dict>
            <key>installation_mode</key>
            <string>force_installed</string>
            <key>install_url</key>
            <string>https://addons.mozilla.org/firefox/downloads/latest/velatir/latest.xpi</string>
        </dict>
    </dict>
    <key>3rdparty</key>
    <dict>
        <key>Extensions</key>
        <dict>
            <key>velatir@velatir.com</key>
            <dict>
                <key>apiToken</key>
                <string>your-api-token-here</string>
                <key>organizationName</key>
                <string>Your Organization</string>
            </dict>
        </dict>
    </dict>
</dict>
</plist>
  1. Scope and save the profile
The EnterprisePoliciesEnabled key must be set to true. Without it, Firefox ignores all enterprise policy configuration on macOS.

Verification

Windows

  1. Trigger an Intune sync on the device or wait for the scheduled check-in
  2. Verify policies are applied:
    • Chrome: Navigate to chrome://policy and click Reload policies
    • Edge: Navigate to edge://policy and click Reload policies
    • Firefox: Navigate to about:policies
  3. Verify you see:
    • Chrome/Edge: ExtensionInstallForcelist with the Velatir extension ID, and your configured apiToken and organizationName
    • Firefox: ExtensionSettings containing velatir@velatir.com with force_installed mode
  4. Confirm the extension is installed:
    • Chrome: chrome://extensions
    • Edge: edge://extensions
    • Firefox: about:addons (should show “Installed by enterprise policy”)

macOS

  1. After the Jamf profile deploys, verify the plist files exist:
    # Chrome
    ls /Library/Managed\ Preferences/com.google.Chrome.plist
    
    # Edge
    ls /Library/Managed\ Preferences/com.microsoft.Edge.plist
    
    # Firefox
    ls /Library/Managed\ Preferences/org.mozilla.firefox.plist
    
  2. Check the applied settings:
    # Chrome
    defaults read /Library/Managed\ Preferences/com.google.Chrome
    
    # Firefox
    defaults read /Library/Managed\ Preferences/org.mozilla.firefox
    
  3. Verify policies in the browser:
    • Chrome: chrome://policy
    • Edge: edge://policy
    • Firefox: about:policies
  4. Confirm the extension is installed:
    • Chrome: chrome://extensions
    • Edge: edge://extensions
    • Firefox: about:addons

Troubleshooting

Extension not installing

  • Windows: Verify the device has synced with Intune. Check Devices > Monitor > Device configuration status
  • macOS: Verify the configuration profile is installed under System Settings > Privacy & Security > Profiles
  • Firefox (macOS): Ensure EnterprisePoliciesEnabled is set to true in the plist. Firefox ignores all policies without it.
  • Ensure the browser is installed before the policy applies
  • Check the browser’s policy page for errors (chrome://policy, edge://policy, or about:policies for Firefox)

Configuration not appearing

  • Windows: Remediations run on a schedule. Trigger a manual sync or wait for the next run
  • Windows: Verify the scripts are running in 64-bit PowerShell context
  • macOS: Check that the preference domain matches exactly (com.google.Chrome, com.microsoft.Edge, or org.mozilla.firefox)
  • Firefox (Windows): If using policies.json, check that the file exists at C:\Program Files\Mozilla Firefox\distribution\policies.json. Firefox updates can remove this directory.
  • Restart the browser after policy changes

Policy conflicts (Windows)

If multiple Intune profiles configure ExtensionInstallForcelist, they may conflict. Use Remediations instead of Settings Catalog to avoid this issue, as Remediations can check for existing entries and add new ones without overwriting.

32-bit vs 64-bit context (Windows)

Registry changes may be written to WOW6432Node if the script runs in 32-bit context. Always enable Run script in 64-bit PowerShell in your Remediation settings.

Remediations not running (Windows Pro)

Intune Remediations require Windows Enterprise or Education editions. On Windows Pro devices, Remediations silently fail with no error logged. If you deployed using Remediations (Method B) and some devices are not picking up the extension, check the Windows edition with winver. Switch to Method A: MSI via Line-of-Business App for Windows Pro devices.

Browser Extension Overview

General extension features and manual installation

Get API Token

Set up your Velatir account and get an API token