Force-install and policy

You can push the extension to managed Chrome and Edge devices with browser policy. This page describes the policy shapes; none of them have been tested against a real tenant for this project.

Extension id

The manifest carries a fixed key, so an unpacked or self-hosted build always has the same id. Computed from the key in apps/extension/wxt.config.ts:

ndfpefldicajaangbhjlebpkjdimncml

A copy published through the Chrome Web Store or Edge Add-ons receives the id the store assigns. Check the id of the actual installed extension before writing policy.

From a store listing

When the extension is published, force-install by id with the store's update URL.

ChromeEdge

Policy ExtensionInstallForcelist, one string per extension:

<extension-id>;https://clients2.google.com/service/update2/crx

Policy ExtensionInstallForcelist, same form with the Edge Add-ons update URL:

<extension-id>;https://edge.microsoft.com/extensionwebstorebase/v1/crx

The extension is not yet published, so this path is not available today.

Off-store (self-hosted)

On a managed device, Chrome and Edge install an off-store extension only from a self-hosted CRX with an update_url. A folder of unpacked files will not be force-installed.

1. Build the managed package (see managed build) and pack it into a CRX signed with a private key you keep.
2. Host the CRX and an update manifest XML over HTTPS. The manifest's update_url is the address of that XML file.
3. Add the extension id and update URL to ExtensionInstallForcelist:

<extension-id>;https://updates.example.com/guidepost/updates.xml

Alternatively use ExtensionSettings, which gives one JSON policy per extension:

{
  "<extension-id>": {
    "installation_mode": "force_installed",
    "update_url": "https://updates.example.com/guidepost/updates.xml",
    "toolbar_pin": "force_pinned"
  }
}

ExtensionSettings takes precedence over the older allow, block and force lists for the same extension.

Note

The extension id for a self-signed CRX comes from your signing key, not from the manifest key, unless the CRX is signed with the key that matches it. Compute the id from the CRX you actually host.

Extension policy keys

The extension reads its own policy from storage.managed:

Key	Effect
storeMode	Pins the store mode. Default local
authorMode	Pins author mode on or off

Policy wins over the user's choices. The extension does not ship a managed_schema, so Chrome and Edge do not validate or show these keys; set them with a JSON policy file or your management tool's custom extension policy feature.

Gotchas

• Windows registry, group policy, Intune and Linux JSON files all deliver the same policies; the names above are identical across them. Edge uses its own policy namespace (Microsoft\Edge) rather than Chrome's.
• Edge on a managed device may block extensions not on its allowlist. If you use ExtensionInstallBlocklist with *, add this extension to the allowlist.
• Updating: the browser polls update_url. Raising version in the update manifest triggers the upgrade.
• Policy deployment has not been verified on a real device for this project.