Managed rollout

Managed rollout is the recommended way to deploy Airentect. You force-install the extension through your existing browser management and push one managed configuration value, a reusable deploy token. Every managed device then enrols silently on install and maps to the signed-in user. No per-user codes, no user action at all.

The recommended distribution channel is the Airentect CDN: devices force-install and auto-update from https://downloads.airentect.com/update.xml, with no Chrome Web Store review in the loop. This channel is for managed force-install only; users cannot install it by hand.

Create a deploy token

In the console, open Endpoints, then Deploy extension. Generate a deploy token there. It starts with aire_deploy_ and is shown once, so copy it when it appears. The token is reusable across your whole fleet and revocable at any time. It only lets a device enrol; it cannot read any data.

The Deploy page also generates ready-to-paste snippets for every platform below, pre-filled with your extension ID and token.

Google Workspace

In the Admin console, go to Devices, then Chrome, then Apps and extensions, and pick the org unit. Add the extension by ID with the source set to a custom URL (the Airentect CDN update URL), and set it to force install. Then open the app's "Policy for extensions" field and paste the managed configuration:

{
  "enrollmentToken": { "Value": "aire_deploy_..." },
  "gatewayBaseUrl": { "Value": "https://gateway.airentect.com" }
}

Warning: Google Workspace's cloud policy field requires every value wrapped in { "Value": ... }. The plain { "enrollmentToken": "aire_deploy_..." } form is accepted by the UI without complaint but silently ignored, and nothing reaches the device. If your fleet installs the extension but never enrols, check this first.

Workspace-managed Chrome is signed into the user's Google account, so identity maps automatically with no extra configuration.

Intune, GPO, macOS, and Linux

Microsoft Intune. Use the Settings Catalog to push an ExtensionSettings policy for the force-install. Edge policies are native; for Chrome, ingest the Google Chrome ADMX first. Deliver the token with a remediation script that writes the per-extension policy key under ...\3rdparty\extensions\<extension-id>\policy for both browsers.

Windows GPO. Add the Chrome and Edge ADMX templates, set ExtensionInstallForcelist, and push the token via Group Policy Preferences or a .reg file targeting:

HKLM\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\<extension-id>\policy
HKLM\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\<extension-id>\policy

macOS MDM. Deliver two configuration profile payloads: one for the com.google.Chrome (or com.microsoft.Edge) preference domain carrying the force-install list, and one for com.google.Chrome.extensions.<extension-id> carrying the token. On Jamf you can add userEmail using the $EMAIL substitution variable for reliable identity mapping.

Linux. Drop a single managed policy JSON containing both the force-list and the token at:

/etc/opt/chrome/policies/managed/airentect.json

Companion policies

Set these alongside the force-install; the console's generated snippets already include them:

• Pin to the toolbar with toolbar_pin: force_pinned in ExtensionSettings, so users can see Airentect is active.
• Close the Incognito bypass. On Chrome, list the extension in MandatoryExtensionsForIncognitoNavigation so Incognito cannot be used to route around it. Edge has no equivalent per-extension policy, so disable InPrivate with InPrivateModeAvailability set to Disabled.

Also allow HTTPS to gateway.airentect.com through any proxy or web filter.

Verify the rollout

On a managed device:

1. Open chrome://policy (or edge://policy) and click Reload policies. Confirm ExtensionInstallForcelist and the 3rdparty managed configuration are both present.
2. Check chrome://management: the browser should show "Managed by your organization", and the extension's toggle at chrome://extensions should be greyed out because it is force-installed.
3. Confirm the icon is pinned to the toolbar, and that opening an Incognito window either prompts to allow Airentect or is blocked.
4. In the console, the device appears under Endpoints within about a minute, and a test prompt shows up in the logs.

If any of these checks fail, the troubleshooting guide maps each symptom to its usual cause.