Windows: Edge and Chrome with Intune

Result: every Intune-managed Windows device gets SafeToOpen in Edge and Chrome, registered to your organisation, with no email and no click. Time: about 20 minutes, then policy propagation.

What you will need#

• Intune administrator rights and devices that are Entra joined or hybrid joined and Intune enrolled.
• Your enrolment key and, if you use workspaces, the workspace name (guide 1).
• For Chrome: the Chrome ADMX templates from the Chrome Enterprise bundle (chrome.admx, google.admx, and the en-US ADML files).

1. Force-install in Microsoft Edge#

1. Intune admin center → Devices → Windows → Configuration → Create → New policy. Platform Windows 10 and later, profile type Settings catalog.
2. Add settings → search “installed silently” → under Microsoft Edge \ Extensions tick “Control which extensions are installed silently”.
3. Set it to Enabled and add one entry: bbgoikmidjfiaaadlgkpdlppilhkjfke;https://edge.microsoft.com/extensionwebstorebase/v1/crx.
4. While you are here, optionally tick “Allow specific extensions to be installed” if you block all others, and add the same ID.
5. Assign to your device groups. Devices pick it up at the next policy sync (typically within the hour).

2. Force-install in Google Chrome#

Chrome is not in the built-in catalog, so import Google’s templates once, then create a policy from them.

1. Devices → Windows → Configuration → Import ADMX → Import. Upload google.admx first (with its ADML), then chrome.admx (with its ADML). Wait until both show Available.
2. Create → New policy → Windows 10 and later → Templates → Imported Administrative templates (Preview).
3. Computer Configuration → Google → Google Chrome → Extensions → “Configure the list of force-installed apps and extensions”. Enabled; add ekfkopmgnijagfmjgcjkbffcnmggekec;https://clients2.google.com/service/update2/crx.
4. Assign to the same device groups.

3. Push the enrolment values (platform script)#

Force-install policies are static, but two of the four values differ per device. A PowerShell platform script running as SYSTEM writes all four for both browsers. The console generates this script with your key filled in (Settings → Unattended enrolment → “Intune script (Windows)”); it is reproduced here so you can see what it does.

1. Devices → Windows → Scripts and remediations → Platform scripts → Add → Windows 10 and later.
2. Upload the script below saved as SafeToOpen-Enrol.ps1. Run this script using the logged on credentials: No. Enforce script signature check: No. Run script in 64 bit PowerShell Host: Yes.
3. Assign to the same device groups. Platform scripts run once per device; see section 5 for shared devices.

# SafeToOpen Browser Security — unattended enrolment values (run as SYSTEM, 64-bit)
$key = "PASTE-ENROLMENT-KEY"
$ws  = ""            # workspace name, or "" for the organisation default

# user_name: the primary user's UPN recorded by the Intune enrolment.
# (Do not use 'whoami' here — under SYSTEM it returns the machine account.)
$upn = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue |
       ForEach-Object { (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).UPN } |
       Where-Object { $_ } | Select-Object -First 1
if (-not $upn) { $upn = (Get-CimInstance Win32_ComputerSystem).UserName }   # DOMAIN\login fallback
$asset = $env:COMPUTERNAME

$browsers = @(
  @{ id = "ekfkopmgnijagfmjgcjkbffcnmggekec"; root = "HKLM:\SOFTWARE\Policies\Google\Chrome";   upd = "https://clients2.google.com/service/update2/crx" },
  @{ id = "bbgoikmidjfiaaadlgkpdlppilhkjfke";   root = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; upd = "https://edge.microsoft.com/extensionwebstorebase/v1/crx" }
)
foreach ($b in $browsers) {
  # Belt and braces: also force-install here in case the catalog policy has not arrived yet.
  New-Item "$($b.root)\ExtensionInstallForcelist" -Force | Out-Null
  New-ItemProperty "$($b.root)\ExtensionInstallForcelist" -Name "1" -Value "$($b.id);$($b.upd)" -PropertyType String -Force | Out-Null
  $pol = "$($b.root)\3rdparty\extensions\$($b.id)\policy"
  New-Item $pol -Force | Out-Null
  foreach ($kv in @{ enrol_key = $key; user_name = $upn; asset_name = $asset; domain_name = $ws }.GetEnumerator()) {
    New-ItemProperty $pol -Name $kv.Key -Value ([string]$kv.Value) -PropertyType String -Force | Out-Null
  }
}

The 3rdparty\extensions\<id>\policy key is where Chrome and Edge read managed storage for an extension. Values under HKLM are mandatory and cannot be changed by the user.

4. Verify#

1. On a test device, force a sync (Settings → Accounts → Access work or school → Info → Sync) and start Edge.
2. Open edge://policy, click Reload policies. ExtensionInstallForcelist shows the SafeToOpen ID, and a section named after the extension ID shows the four values.
3. The extension icon appears within a minute; its popup shows your organisation name.
4. Console → Settings → Unattended enrolment → Enrolled devices shows the device with the person and workspace.

5. Shared and multi-user devices#

The script writes the primary user of the enrolment. On kiosk-style or shared PCs where several people sign in, use a Remediation instead so the values follow the console session:

1. Devices → Scripts and remediations → Remediations → Create. Detection script: exit 1 when the stored user_name differs from (Get-CimInstance Win32_ComputerSystem).UserName; remediation script: the script above with that value as $upn.
2. Schedule hourly. The extension re-reads policy changes at once and re-enrols under the new person; the previous person’s session on that device is replaced, not added.

6. Leavers and re-imaging#

• Removing a person on the People page, or an Azure AD sync removal, revokes their enrolled sessions. If the policy stays on a device they still use, it re-enrols them at next start; remove the device from the assignment group, or wipe it, when someone leaves.
• A re-imaged device with the same name reuses its previous session slot, so it never trips the five-browsers-per-person limit.
• Rotating the key in the console requires updating $key in the script and re-assigning it (Intune only re-runs a platform script when its content changes).

7. Firefox on Windows#

Firefox uses policies.json or the Firefox ADMX. Force-install via ExtensionSettings with installation_mode: force_installed and the add-on URL from https://addons.mozilla.org/addon/safetoopen-online-security/. Managed storage for the four values goes under 3rdparty → Extensions → <add-on id>. Unattended enrolment in Firefox depends on a Firefox build of the extension that reads managed storage; confirm with SafeToOpen support before relying on it, and use activation emails (guide 7) otherwise.