# Deploy in your organization

> Install Phishing Shield silently on Chrome and Edge with group policies, Intune, Jamf or Google Workspace, and activate the licenses.

URL: https://docs.ironchip.com/en/phishing-shield/despliegue/

This page explains how to install Phishing Shield on every managed device without each user having to install it. It is for whoever administers the devices or the browser.

## How installation works

Instead of each user installing it from the Chrome Web Store, the extension is installed through corporate policy: the browser installs it automatically when it opens. The **force-install** policy (`ExtensionInstallForcelist`) offers several advantages:

- **Silent installation.** The user sees no prompt or install button.
- **No antivirus warnings.** The extension arrives signed by Google, not as a loose file.
- **No uninstalling.** The user cannot disable or uninstall the extension: it shows as installed by the administrator.
- **Automatic updates** through the same channel.

## Requirements

- **Chrome 88 or later**, or Microsoft Edge. Edge accepts the same policy (`ExtensionInstallForcelist`) and the same string for Chrome extensions: set it in the Microsoft Edge branch of your management tool.
- A managed browser. Only Chrome for business honors these policies: a personal Chrome that the user downloaded does not apply them.
- Access from the devices to `clients2.google.com`, the standard Chrome update channel. It is usually already open.
- The **extension ID**, which Ironchip provides.
- A **license**, which you generate in the Phishing Shield admin console, in the **Licenses** section.

The string used on every platform is the extension ID and the update address, separated by `;` with no spaces:

```text
<extension_id>;https://clients2.google.com/service/update2/crx
```

## Windows: group policies

You need the Chrome ADMX templates installed on the domain controller and an organizational unit (OU) with the target devices.

1. On the domain controller, open **Group Policy Management**.
2. On the target OU, create a GPO with **Create a GPO in this domain and link it here**. For example, `Chrome - Ironchip Phishing Shield`.
3. Edit the GPO and go to **Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions**.
4. Enable **Configure the list of force-installed apps and extensions**.
5. Click **Show** and add the string `<extension_id>;https://clients2.google.com/service/update2/crx`.
6. Apply the GPO. On a test device, run `gpupdate /force`. Otherwise, wait for the normal cycle, 90 to 120 minutes.

## Windows: Microsoft Intune

1. In the Intune admin center, go to **Devices > Configuration profiles > Create profile**.
2. Choose the platform **Windows 10 and later**.
3. Choose the profile type:
   - **Settings Catalog:** search for `ExtensionInstallForcelist` and enter the string above as the value.
   - **Templates > Administrative Templates:** under **Computer Configuration > Google > Google Chrome > Extensions**, open **Configure the list of force-installed extensions** and add the string. You first need to import the Chrome ADMX templates.
4. Assign the profile to the target device groups.

## macOS: configuration profile

In Jamf, Mosyle, Kandji or your MDM, create a profile with the `com.google.Chrome` payload and add this key:

```xml
<key>ExtensionInstallForcelist</key>
<array>
  <string>EXTENSION_ID;https://clients2.google.com/service/update2/crx</string>
</array>
```

Replace `EXTENSION_ID` with the real ID and apply the profile to the target Mac group. Chrome picks it up on launch.

For a single device or a test, without MDM:

```bash
sudo defaults write com.google.Chrome ExtensionInstallForcelist -array \
  "<extension_id>;https://clients2.google.com/service/update2/crx"
```

Restart Chrome. This option does not scale.

## Google Workspace

1. Sign in to the Google Admin console (`admin.google.com`) and go to **Devices > Chrome > Apps & extensions > Users & browsers**.
2. Select the target organizational unit.
3. Click **+** and choose **Add Chrome app or extension by ID**.
4. Paste the extension ID and choose **From the Chrome Web Store**.
5. Under **Installation policy**, choose **Force install** and save.

## Activate the license

After installation, each user activates the extension once:

1. Open the extension from its icon in the browser toolbar.
2. Paste the license and enter your email address.
3. Accept the privacy policy and the terms of service.

The extension remembers the activation and does not ask again unless an administrator revokes that seat.

## Harden the browser (optional)

If you want a profile where only the Ironchip extension is allowed, combine force-install with these policies:

```text
ExtensionInstallAllowlist = ["<extension_id>"]
ExtensionInstallBlocklist = ["*"]
```

Chrome will only allow that extension to be installed and will block the rest.

## Verify the deployment

On a target device:

1. Open `chrome://policy` and search for `ExtensionInstallForcelist`. It must appear as applied.
2. Open `chrome://extensions`. The extension must be enabled and marked as installed by your administrator, with no switch to turn it off.
3. If you use group policies, `gpresult /h C:\gpo.html` exports a report of the applied policies.

## Troubleshooting

| Symptom                                          | What to do                                                                                                                                                                                     |
| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The extension does not appear                    | In `chrome://policy`, search for `ExtensionInstallForcelist`. If it is missing, the policy has not arrived: check the channel (GPO, Workspace, Intune) and that the device is in the right OU. |
| The policy shows as not applied                  | There is a format error in the string. Check the `;` between the ID and the address, with no spaces.                                                                                           |
| Chrome does not install the extension            | Check that the device reaches `clients2.google.com` and that the Chrome version is 88 or later. In `chrome://extensions` with developer mode on, an error message may show.                    |
| Chrome shows a possibly unsafe extension warning | Check that the ID is correct (32 characters) and that the policy is **Force install** and not just allow: with allow, Chrome asks the user to confirm.                                         |
| Policies are not applied                         | The device uses a personal Chrome and not a managed one. Install Chrome through MDM or group policy.                                                                                           |
| The extension appears but is not active          | The license has not been activated: the user must paste it once in the extension.                                                                                                              |

If the problem continues, contact [support](https://docs.ironchip.com/en/soporte/).

## More information

- [Warnings and false positives](https://docs.ironchip.com/en/phishing-shield/avisos-y-falsos-positivos/)
- [Privacy and permissions](https://docs.ironchip.com/en/phishing-shield/privacidad-y-permisos/)