Deployment Overview and Enrolment Key

SafeToOpen Browser Security is a browser extension. Rolling it out to an organisation is two separate jobs, and each has a zero-touch mechanism on desktop and on iPhone and iPad:

• Install — Getting the extension onto the browser and keeping it there. Every managed browser has a force-install policy: the user cannot skip, disable or remove the extension.
• Register — Tying that install to your organisation so it is licensed, follows your workspace policies and reports incidents to your console. With the enrolment key this happens silently on first run; without it the user has to click an activation link.

This guide explains the pieces that every platform guide relies on. Read it once, then go to the guide for your platform.

1. The two ways to register#

You can mix them: enrol managed devices and email everyone else. A person who enrolled unattended and later clicks an activation email is the same member; no second seat is used.

2. Platform coverage: what can be enforced, what stays with the user, and why#

The table is the honest map. “Enforced” means the administrator decides and the user cannot change it. “User” means the person must do it, and the reason is the platform, not SafeToOpen.

What the user can and cannot change once enrolled#

• Removal — Uninstall, disable or hide the extension: not on any force-installed platform. Where the platform allows removal (Android, BYOD) the console shows the person’s last heartbeat so you can see who has gone dark.
• Settings — Alert level, automatic scanning, Paste Guard, trusted sites, tracker blocking: each is either locked by the workspace policy or left to the user, per setting. Locked settings are greyed out in the popup with a “managed by your organisation” note. enforce_alert in the MDM policy pins the alert level regardless of workspace policy.
• Overrides — Pausing protection on a site or trusting a domain: allowed only when the workspace policy permits it; otherwise the buttons are absent. Every pause and trust is recorded in the console.
• Identity — Signing out or registering to another organisation: not possible on an enrolled install. The activation page refuses with “already registered with your organisation”.
• Visibility — Seeing what was blocked and why, and reporting a false positive: always available. Users cannot see other people’s events.

3. The enrolment key#

1. Sign in to the Business Console as Owner or Co-administrator and open Settings: https://plus.safetoopen.com/business-console#/settings.
2. In the card “Unattended enrolment (MDM)”, tick Enabled. The console generates the organisation’s enrolment key.
3. Click Show, then Copy. Paste it into your MDM policy as the value of enrol_key. Treat it like a password: anyone who has it can register a browser against your organisation and consume a seat.
4. If the key leaks, click Rotate. New enrolments with the old key stop at once; devices already enrolled keep working.

4. The four policy values#

Whatever the delivery channel, the extension reads the same four values from managed storage:

An optional fifth key, enforce_alert, fixes the alert level for the user: 1 malicious only, 2 suspicious and above, 3 everything, 4 silent.

The browser needs the device name and the person’s identity from outside because no browser API exposes either. That is why the delivery mechanism on Windows and macOS is a script rather than a static profile.

5. Extension identifiers#

6. Workspaces#

Workspaces let an MSP or a larger organisation split people into sites, departments or client tenants, each with its own policies, alert recipients and analysts. Create them on the Workspaces page first. Then push the workspace name as domain_name to the devices that belong there. Devices with no domain_name land in the organisation default.

7. What the user sees#

Nothing during enrolment. The extension icon appears in the toolbar, its popup shows your organisation name and logo, and the settings that your workspace policy locks are greyed out. The person can still open the popup, see why a page was blocked and report a false positive.

8. Verifying a deployment#

1. On the device, open chrome://policy or edge://policy and click Reload policies. Under the SafeToOpen extension ID you should see enrol_key, user_name, asset_name and domain_name. If they are missing, the policy has not reached the browser yet; that is a policy problem, not a SafeToOpen problem.
2. Open the extension popup. It should show your organisation name.
3. In the console, Settings → Unattended enrolment → Enrolled devices lists the device with the person, workspace and an active session within a minute of the browser starting.
4. People shows the person as active. Removing them there revokes the device; the device re-enrols automatically at next start if the policy is still present, so remove the policy first when someone leaves.

9. Troubleshooting#

10. Which guide next#

• Windows with Intune: guide 2. Group Policy, RMM or images: guide 3.
• macOS with Intune or Jamf, including Safari: guide 4.
• iPhone and iPad: guide 5.
• Google Workspace shops and ChromeOS: guide 6.
• Android, BYOD, contractors and activation emails: guide 7.
• Jamf Pro, Kandji, Mosyle, Addigy or SimpleMDM: guide 8.
• NinjaOne, Datto RMM, ConnectWise, Kaseya, Atera, Action1, PDQ Deploy, ManageEngine, MECM or Workspace ONE: guide 9.
• Linux desktops: guide 10.
• ManageEngine Mobile Device Manager Plus, SOTI MobiControl or Hexnode: guide 11.