Deploy in your organization

This page explains how to install Phishing Shield on every managed device without each user having to install it. It is for whoever administers the devices or the browser.

How installation works

Instead of each user installing it from the Chrome Web Store, the extension is installed through corporate policy: the browser installs it automatically when it opens. The force-install policy (ExtensionInstallForcelist) offers several advantages:

• Silent installation. The user sees no prompt or install button.
• No antivirus warnings. The extension arrives signed by Google, not as a loose file.
• No uninstalling. The user cannot disable or uninstall the extension: it shows as installed by the administrator.
• Automatic updates through the same channel.

Requirements

• Chrome 88 or later, or Microsoft Edge. Edge accepts the same policy (ExtensionInstallForcelist) and the same string for Chrome extensions: set it in the Microsoft Edge branch of your management tool.
• A managed browser. Only Chrome for business honors these policies: a personal Chrome that the user downloaded does not apply them.
• Access from the devices to clients2.google.com, the standard Chrome update channel. It is usually already open.
• The extension ID, which Ironchip provides.
• A license, which you generate in the Phishing Shield admin console, in the Licenses section.

The string used on every platform is the extension ID and the update address, separated by ; with no spaces:

<extension_id>;https://clients2.google.com/service/update2/crx

Windows: group policies

You need the Chrome ADMX templates installed on the domain controller and an organizational unit (OU) with the target devices.

1. On the domain controller, open Group Policy Management.
2. On the target OU, create a GPO with Create a GPO in this domain and link it here. For example, Chrome - Ironchip Phishing Shield.
3. Edit the GPO and go to Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions.
4. Enable Configure the list of force-installed apps and extensions.
5. Click Show and add the string <extension_id>;https://clients2.google.com/service/update2/crx.
6. Apply the GPO. On a test device, run gpupdate /force. Otherwise, wait for the normal cycle, 90 to 120 minutes.

Windows: Microsoft Intune

1. In the Intune admin center, go to Devices > Configuration profiles > Create profile.
2. Choose the platform Windows 10 and later.
3. Choose the profile type:
   • Settings Catalog: search for ExtensionInstallForcelist and enter the string above as the value.
   • Templates > Administrative Templates: under Computer Configuration > Google > Google Chrome > Extensions, open Configure the list of force-installed extensions and add the string. You first need to import the Chrome ADMX templates.
4. Assign the profile to the target device groups.

macOS: configuration profile

In Jamf, Mosyle, Kandji or your MDM, create a profile with the com.google.Chrome payload and add this key:

<key>ExtensionInstallForcelist</key>
<array>
  <string>EXTENSION_ID;https://clients2.google.com/service/update2/crx</string>
</array>

Replace EXTENSION_ID with the real ID and apply the profile to the target Mac group. Chrome picks it up on launch.

For a single device or a test, without MDM:

sudo defaults write com.google.Chrome ExtensionInstallForcelist -array \
  "<extension_id>;https://clients2.google.com/service/update2/crx"

Restart Chrome. This option does not scale.

Google Workspace

1. Sign in to the Google Admin console (admin.google.com) and go to Devices > Chrome > Apps & extensions > Users & browsers.
2. Select the target organizational unit.
3. Click + and choose Add Chrome app or extension by ID.
4. Paste the extension ID and choose From the Chrome Web Store.
5. Under Installation policy, choose Force install and save.

Activate the license

After installation, each user activates the extension once:

1. Open the extension from its icon in the browser toolbar.
2. Paste the license and enter your email address.
3. Accept the privacy policy and the terms of service.

The extension remembers the activation and does not ask again unless an administrator revokes that seat.

Harden the browser (optional)

If you want a profile where only the Ironchip extension is allowed, combine force-install with these policies:

ExtensionInstallAllowlist = ["<extension_id>"]
ExtensionInstallBlocklist = ["*"]

Chrome will only allow that extension to be installed and will block the rest.

Verify the deployment

On a target device:

1. Open chrome://policy and search for ExtensionInstallForcelist. It must appear as applied.
2. Open chrome://extensions. The extension must be enabled and marked as installed by your administrator, with no switch to turn it off.
3. If you use group policies, gpresult /h C:\gpo.html exports a report of the applied policies.

Troubleshooting

Symptom	What to do
The extension does not appear	In chrome://policy, search for ExtensionInstallForcelist. If it is missing, the policy has not arrived: check the channel (GPO, Workspace, Intune) and that the device is in the right OU.
The policy shows as not applied	There is a format error in the string. Check the ; between the ID and the address, with no spaces.
Chrome does not install the extension	Check that the device reaches clients2.google.com and that the Chrome version is 88 or later. In chrome://extensions with developer mode on, an error message may show.
Chrome shows a possibly unsafe extension warning	Check that the ID is correct (32 characters) and that the policy is Force install and not just allow: with allow, Chrome asks the user to confirm.
Policies are not applied	The device uses a personal Chrome and not a managed one. Install Chrome through MDM or group policy.
The extension appears but is not active	The license has not been activated: the user must paste it once in the extension.

If the problem continues, contact support.

More information

• Warnings and false positives
• Privacy and permissions