> For the complete documentation index, see [llms.txt](https://boza.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://boza.gitbook.io/docs/browser-extension/deployment.md). # Deployment Guides Deploy the Boza browser extension with the management system already used by your organization. The right method depends on the operating system, browser, and whether you need automatic user identification. {% hint style="info" %} **Installation and identification are separate.** A force-install policy puts the extension in the browser. Users still sign in once with SSO unless the deployment also supplies a valid Boza extension secret and a reliable per-user email. {% endhint %} *** ## Choose a Deployment Method | Method | Platform | Browsers | User identification | | ------------------------------------------------------------------------------- | ------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [Google Admin Console](/docs/browser-extension/deployment/google-admin.md) | ChromeOS, Windows, macOS | Chrome | SSO by default; automatic only when a valid per-user managed configuration is also deployed | | [Microsoft Intune](/docs/browser-extension/deployment/microsoft-intune.md) | Intune-enrolled Windows devices | Chrome, Edge, Firefox with the current script | Automatic when the Boza wizard can identify the signed-in corporate user; if managed identification fails, verify the Intune result before relying on SSO | | [PowerShell](/docs/browser-extension/deployment/powershell.md) | Windows | Chrome, Edge, Firefox when confirmed for the supplied script | Automatic only when the supported deployment detects the user and applies a valid secret; an installed extension without managed identification may prompt for SSO | | [Jamf](/docs/browser-extension/deployment/jamf.md) | macOS | Chrome, Firefox, Safari | Automatic when Jamf resolves `$EMAIL`; Safari must also be enabled once by the user | | [Jamf via Profile](/docs/browser-extension/deployment/jamf-via-profile.md) | macOS | Chrome, Firefox, Safari | Automatic when Jamf resolves `$EMAIL`; Safari must also be enabled once by the user | | [Safari via Intune](/docs/browser-extension/deployment/safari-intune.md) | Intune-enrolled macOS devices | Safari | SSO: Intune does not substitute Jamf's `$EMAIL` variable | | [Other MDM](/docs/browser-extension/deployment/other-mdm.md) | macOS | Chrome, Firefox, Safari | Automatic only if the MDM substitutes a per-device email variable; otherwise SSO | | [Group Policy (GPO)](/docs/browser-extension/deployment/gpo.md) | Domain-joined Windows devices | Chrome, Edge | SSO; automatic identification requires a separately confirmed Boza Windows procedure | | [GPO on Remote Desktop Services](/docs/browser-extension/deployment/gpo-rds.md) | Windows Server / RDS | Chrome, Edge, Firefox when confirmed for the supplied script | Automatic only when both machine and per-user stages succeed; an installed extension without managed identification may prompt for SSO | {% hint style="warning" %} “Automatic” is conditional. Test with real user accounts before rollout. If the extension is present but cannot resolve a user, it may offer the normal Boza SSO sign-in. Treat a failed management script as a failed or partial deployment until its device status and logs are verified. {% endhint %} Microsoft restricts force-installation from outside Edge Add-ons on some Windows devices that are not joined to on-premises Active Directory. Because Boza's current Edge policy uses the Chrome Web Store update service, pilot Edge separately on Intune-only or Entra-only devices. *** ## Recommendations by Environment ### Microsoft-managed Windows Use the [Boza Microsoft Intune wizard](/docs/browser-extension/deployment/microsoft-intune.md). It authorizes Boza to create and assign the deployment script in Intune, so there is no script to download or edit manually. If Intune is not available, request the current supported [PowerShell deployment materials](/docs/browser-extension/deployment/powershell.md) from Boza and confirm their capabilities before use. ### Active Directory domains Use [Group Policy](/docs/browser-extension/deployment/gpo.md) when force-installing on Chrome and Edge is enough and users can sign in with SSO. If automatic identification is required, pair the browser policy with a Boza-supported Windows procedure whose execution context and identity behavior have been confirmed. For multi-user servers, use the dedicated [RDS guide](/docs/browser-extension/deployment/gpo-rds.md); a workstation-mode deployment is not safe for shared sessions. ### Google Workspace and ChromeOS Use [Google Admin Console](/docs/browser-extension/deployment/google-admin.md) for native Chrome extension management. Force-installation alone uses SSO; managed user configuration is required for automatic identification. ### Apple devices Use [Jamf](/docs/browser-extension/deployment/jamf.md) when available. Jamf can resolve the per-device `$EMAIL` value used by Boza profiles. With another MDM, review its variable-substitution support and expect SSO if it cannot supply a different email to each device. *** ## Extension Identifiers Use these exact identifiers in browser policies and validation: | Browser | Identifier | Store/update source | | -------------------- | ---------------------------------- | ------------------------------- | | Google Chrome | `lgdogpphmkjofjogicpokolmlmcfilja` | Chrome Web Store | | Microsoft Edge | `lgdogpphmkjofjogicpokolmlmcfilja` | Chrome Web Store update service | | Firefox | `extension-firefox@getboza.io` | Mozilla Add-ons | | Safari container app | `com.boza.safari` | Mac App Store | For Chrome and Edge force-install policies, the complete value is: ``` lgdogpphmkjofjogicpokolmlmcfilja;https://clients2.google.com/service/update2/crx ``` *** ## Security Baseline * Use a pilot group before broad assignment. * Delegate only the permissions needed to create and assign the policy or script. Routine deployment does not require Domain Admin or Global Administrator access. * Avoid two management systems writing the same browser policy. Conflicting GPO, Intune, registry, and Google Admin settings can produce unpredictable results. * Treat the Boza extension secret as a credential. Never place it in source control, email, tickets, chat, or a broadly writable network share. * Obtain deployment materials through an authorized Boza channel and record their source and date. If Boza supplies a version, checksum, signature, or release note, verify that metadata before use; if your security policy requires metadata that is not supplied, stop and obtain written confirmation or compatible materials. * Do not disable PowerShell signature enforcement across the organization to make a deployment work. * Roll back by removing the Boza-specific assignment or policy entry; do not delete a shared policy that also manages other extensions. ### If a secret is exposed 1. Stop new deployments and restrict access to every configured script or profile. 2. Contact **** or your Boza account team immediately to rotate the secret. 3. Replace the old secret in the authoritative deployment and redeploy it to every assigned device or group. 4. Confirm the new configuration works and the old secret is no longer accepted. 5. Review access to the deployment system and document the incident according to your security process. *** ## Validate Every Rollout On a representative device: 1. Confirm the intended management policy or script reports success. 2. Check `chrome://policy`, `edge://policy`, or `about:policies`. 3. Confirm Boza is listed as installed by policy in the browser's extension page. 4. Open the Boza extension and verify the correct user is identified—or that SSO is offered when automatic identification is not configured. 5. Test a second user or device before expanding the assignment. Choose a guide from the matrix above for method-specific deployment and troubleshooting. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://boza.gitbook.io/docs/browser-extension/deployment.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.