macOS: Chrome, Edge and Safari

On macOS, Chrome and Edge read policy from managed preferences (/Library/Managed Preferences). Force-install is a configuration profile. The four enrolment values are a second preference domain named after the extension, which Intune can only deliver with static values, so a shell script fills the per-user ones. Jamf can do it all in one profile with variables.

1. Force-install Chrome and Edge (Intune custom profile)#

1. Save the profile below as SafeToOpen-ForceInstall.mobileconfig. Replace the two UUIDs with fresh ones (uuidgen).
2. Intune → Devices → macOS → Configuration → Create → Templates → Custom. Upload the file; deployment channel Device channel.
3. Assign to your Mac device groups.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>PayloadContent</key><array>
    <dict>
      <key>PayloadType</key><string>com.google.Chrome</string>
      <key>PayloadIdentifier</key><string>com.safetoopen.chrome.forceinstall</string>
      <key>PayloadUUID</key><string>11111111-1111-1111-1111-111111111111</string>
      <key>PayloadVersion</key><integer>1</integer>
      <key>ExtensionInstallForcelist</key><array><string>ekfkopmgnijagfmjgcjkbffcnmggekec;https://clients2.google.com/service/update2/crx</string></array>
    </dict>
    <dict>
      <key>PayloadType</key><string>com.microsoft.Edge</string>
      <key>PayloadIdentifier</key><string>com.safetoopen.edge.forceinstall</string>
      <key>PayloadUUID</key><string>22222222-2222-2222-2222-222222222222</string>
      <key>PayloadVersion</key><integer>1</integer>
      <key>ExtensionInstallForcelist</key><array><string>bbgoikmidjfiaaadlgkpdlppilhkjfke;https://edge.microsoft.com/extensionwebstorebase/v1/crx</string></array>
    </dict>
  </array>
  <key>PayloadDisplayName</key><string>SafeToOpen Browser Security — force install</string>
  <key>PayloadIdentifier</key><string>com.safetoopen.forceinstall</string>
  <key>PayloadScope</key><string>System</string>
  <key>PayloadType</key><string>Configuration</string>
  <key>PayloadUUID</key><string>33333333-3333-3333-3333-333333333333</string>
  <key>PayloadVersion</key><integer>1</integer>
</dict></plist>

2. Push the enrolment values (Intune shell script)#

The console generates this script with your key filled in (Settings → Unattended enrolment → “Intune script (macOS)”). It writes the extension preference domain into the console user’s managed preferences, which Chrome and Edge treat as mandatory policy.

1. Devices → macOS → Scripts → Add. Upload the script; run as signed-in user: No (it must run as root); frequency: every 1 day, so a new user on the Mac is picked up; max retries 3.
2. Assign to the same device groups.

#!/bin/bash
# SafeToOpen Browser Security — unattended enrolment values (Intune shell script, runs as root)
KEY="PASTE-ENROLMENT-KEY"
WS=""                                   # workspace name, or "" for the organisation default
USER_NAME=$(stat -f%Su /dev/console)    # login of the person at the console
ASSET=$(scutil --get ComputerName)
[ -z "$USER_NAME" ] || [ "$USER_NAME" = "root" ] && exit 0
for entry in "com.google.Chrome ekfkopmgnijagfmjgcjkbffcnmggekec" "com.microsoft.Edge bbgoikmidjfiaaadlgkpdlppilhkjfke"; do
  set -- $entry; DOMAIN=$1; ID=$2
  P="/Library/Managed Preferences/$USER_NAME/$DOMAIN.extensions.$ID"
  mkdir -p "/Library/Managed Preferences/$USER_NAME"
  defaults write "$P" enrol_key   -string "$KEY"
  defaults write "$P" user_name   -string "$USER_NAME"
  defaults write "$P" asset_name  -string "$ASSET"
  defaults write "$P" domain_name -string "$WS"
  chmod 644 "$P.plist"
done
# Chrome and Edge re-read managed preferences within minutes; a browser restart is immediate.

3. Jamf Pro: one profile, no script#

Jamf substitutes payload variables, so the values can live in a profile. Create an Application & Custom Settings payload for preference domain com.google.Chrome.extensions.ekfkopmgnijagfmjgcjkbffcnmggekec (and com.microsoft.Edge.extensions.bbgoikmidjfiaaadlgkpdlppilhkjfke) at user level with this plist:

<dict>
  <key>enrol_key</key><string>PASTE-ENROLMENT-KEY</string>
  <key>user_name</key><string>$EMAIL</string>
  <key>asset_name</key><string>$COMPUTERNAME</string>
  <key>domain_name</key><string></string>
</dict>

$EMAIL is filled from the user record Jamf holds (inventory or directory binding); $USERNAME is the fallback when no email is recorded. Add the force-install keys from section 1 as a computer-level payload for com.google.Chrome and com.microsoft.Edge.

4. Safari on macOS#

Safari extensions ship inside a Mac app. Two steps make it silent on macOS 15 and later:

1. Buy the app in Apple Business Manager (“SafeToOpen Online Security”, https://apps.apple.com/us/app/safetoopen-online-security/id1587471170) and deploy it as a required app from Intune (Apps → macOS → App Store app) or Jamf (Mac App Store apps).
2. Intune → Devices → macOS → Configuration → Settings catalog → Declarative Device Management → Safari Extension Settings. Add the SafeToOpen extension with State AlwaysOn, Private Browsing AlwaysOn, Allowed Domains *. Jamf: Blueprints → Safari Extension Settings.
3. To get the extension’s composed identifier (bundle id (team id)) run pluginkit -mAvv -p com.apple.Safari.web-extension | grep -i safetoopen on any Mac with the app installed, or ask [email protected].

5. Verify#

1. On a test Mac, sudo profiles renew -type enrollment, then defaults read "/Library/Managed Preferences/$(stat -f%Su /dev/console)/com.google.Chrome.extensions.ekfkopmgnijagfmjgcjkbffcnmggekec" should print the four values.
2. chrome://policy or edge://policy shows the force-list and the extension section.
3. Console → Settings → Unattended enrolment → Enrolled devices shows the Mac.