Troubleshooting

Most rollout problems fall into a small set of causes: policy never reached the device, the managed configuration was malformed, the device could not reach the gateway, or credentials were mishandled. Work through the first checks, then match your symptom in the table.

First checks

On the affected device, in order:

1. chrome://policy (or edge://policy), then Reload policies. Confirm ExtensionInstallForcelist lists the extension and the 3rdparty managed configuration is present with your token.
2. chrome://management should show "Managed by your organization" for a managed rollout.
3. chrome://extensions should show Airentect installed with a greyed-out toggle (force-installed).
4. Confirm the device can reach https://gateway.airentect.com through any proxy or filter.

A healthy device passes all four and appears under Endpoints within about a minute.

Common fixes

Symptom	Fix
Extension installed but the browser is not "Managed by your organization"	The install did not come from policy. Check the force-install policy is scoped to this device or user and reload policies; a hand-installed copy will not enrol with the deploy token.
Managed config is present at chrome://policy but devices never enrol (Google Workspace)	The values were pasted in plain form. Workspace's "Policy for extensions" field silently ignores values not wrapped as { "Value": ... }. Re-paste the wrapped JSON from the console's Deploy page.
Endpoint never appears in the console	Policy has not synced, or the gateway is blocked. Reload policies on the device, confirm the 3rdparty config carries the token, and allow gateway.airentect.com through your proxy or firewall.
Enrolment refused with a 403	Either the sign-in email's domain is not on the approved domains list, or the organisation's seat cap is reached. Check both under Users before anything else.
HTTP 401 on session after a key was revoked	Expected: that device's API key is dead. Re-enrol the device (managed devices re-enrol via the deploy token; direct users need a fresh install link).
Enrolment code invalid or expired	Codes are single use and expire after 7 days. Generate a new install link from the user's entry under Users.
Wrong user on reports, or sessions conflicting between machines	An API key was shared across devices. Each device must enrol itself and hold its own key; re-enrol each machine separately and the logs will attribute correctly.
Device shows as an anonymous "Managed device"	The browser had no known signed-in email at enrolment. Assign it under Endpoints, or fix identity (Workspace sign-in, or userEmail via your MDM) and it re-maps automatically.
Users can bypass via Incognito or InPrivate	The companion policies are missing. Set MandatoryExtensionsForIncognitoNavigation on Chrome; on Edge disable InPrivate with InPrivateModeAvailability.
HTTP 500 from the gateway	Not usually a credential problem; the gateway service itself is unhealthy. Contact Airentect support rather than regenerating keys.

Deploy token behaviour

Two behaviours look like bugs but are by design:

• Revoking a deploy token only stops new enrolments. Devices that already enrolled hold their own API keys and keep working. To cut off an individual device, revoke that device's key under Endpoints instead.
• Rotating the token invalidates the old one. Devices already enrolled are unaffected, but any policy still pushing the old token stops enrolling new devices until you update the managed configuration.

Warning: Do not respond to a stuck rollout by copying a working device's API key onto other machines. It looks like a fix, but shared keys cause session conflicts and permanently mixed audit trails, which are far harder to clean up than the original enrolment problem.