SafeToOpenBrowser Security Docs

SafeToOpen Browser Security

Chrome Enterprise (Google Admin)

Chrome Browser Cloud Management and ChromeOS: force-install and the extension policy from the Admin console

Guide 6 of 11 · April 2026

If your organisation runs Google Workspace, or manages Chrome across Windows, macOS and Linux from one place, Chrome Browser Cloud Management (CBCM) lets you force-install SafeToOpen and set its policy from admin.google.com. Two of the four enrolment values still need a per-device source; section 3 explains the combinations.

1. Enrol browsers in CBCM#

  1. admin.google.com → Devices → Chrome → Managed browsers → Enrol → generate an enrolment token for the organisational unit.
  2. Deliver the token to devices as the Chrome policy CloudManagementEnrollmentToken: Windows registry HKLM\SOFTWARE\Policies\Google\Chrome\CloudManagementEnrollmentToken (Intune Settings Catalog after the ADMX import, or a GPO); macOS key CloudManagementEnrollmentToken in a com.google.Chrome profile.
  3. Browsers appear under Managed browsers after their next start.

2. Force-install and configure the extension#

  1. Devices → Chrome → Apps & extensions → Users & browsers → select the OU → Add (+) → Add Chrome app or extension by ID → ekfkopmgnijagfmjgcjkbffcnmggekec, From the Chrome Web Store.
  2. Installation policy: Force install (or Force install + pin to toolbar).
  3. Click the extension → Policy for extensions → paste the JSON below and Save. Google Admin wraps each value in a Value object.
{
  "enrol_key":   { "Value": "PASTE-ENROLMENT-KEY" },
  "domain_name": { "Value": "" }
}

Policies set here are static for the whole OU, so user_name and asset_name cannot be put in this JSON.

3. Supplying user_name and asset_name#

FleetWhere the two values come from
Windows or macOS managed by Intune, GPO or JamfRun the script from guide 2, 3 or 4 with only user_name and asset_name (the key and workspace may stay in Google Admin, or be written by the script too; the extension merges both sources).
Windows or macOS with no other management toolUse the .reg file (guide 3) or the macOS script (guide 4) through whatever runs commands on your devices, or fall back to activation emails.
ChromeOSNo script channel exists, so unattended enrolment is not available today. Force-install from Google Admin and register users with activation emails (guide 7); with Google Workspace directory sync coming later.
Note When Google Admin and a local policy both set the same key, the cloud policy wins on Windows and macOS unless the machine policy is marked as taking precedence (Devices → Chrome → Settings → Policy precedence). Keep enrol_key and domain_name in one place only.

4. Verify#

  1. chrome://policy on a device shows CloudManagementEnrollmentToken, the force-list entry and, under the SafeToOpen extension ID, the keys you set.
  2. Google Admin → Devices → Chrome → Managed browsers → the device → Applied policies lists the extension policy.
  3. Console → Settings → Unattended enrolment → Enrolled devices shows the browser once both per-device values are present.