MSP Deployment
Configure every managed policy on Chrome, Edge, and Firefox from your own tooling, without editing raw registry keys by hand. These templates cover Group Policy, Intune, macOS, Linux, and Firefox.
Prefer to pick settings and get the exact files? Use the configuration generator.
Running your own receiver instead of the management console? Verify it live with the reporting setup checker.
Console customers skip it; enrolled devices simply appear in the console.
Choose your platform
Every template embeds the same hardened example configuration. Edit the placeholder domains and identifiers before you push.
Windows, Group Policy
Import the administrative template for a full settings UI in gpedit and GPMC, covering every policy for Chrome and Edge. The .reg files are for a quick test without Group Policy.
Windows, Microsoft Intune
Import the ADMX above into Intune for a full settings UI, then force-install through the Settings Catalog. The guide walks through both, with an OMA-URI fallback.
macOS
Deploy the matching configuration profile through your MDM. Each profile sets every key and force-installs the extension. The plist is for MDMs that take a custom plist instead.
Linux
Copy the file for your browser to the managed-policy directory in its name. For example, the Chrome file goes to /etc/opt/chrome/policies/managed/osprey.json.
Firefox
Firefox does not read Chromium managed storage. Deploy the native managed-storage manifest, or the enterprise policies.json with its 3rdparty.Extensions block and force-install.
Extension IDs
The extension has a different ID in each store. Use the right one for each browser family.
| Store | Extension id |
|---|---|
| Chrome Web Store (Chrome, Chromium, Brave, Vivaldi) | jmnpibhfpmpfjhhkmpadlbgjnbhpjgnd |
| Microsoft Edge Add-ons | nopglhplnghfhpniofkcopmhbjdonlgn |
| Firefox Add-ons (AMO) | osprey@foulest.net |
Where each browser reads settings
Chromium browsers share the managed-storage model but each vendor uses its own path. On Windows the full key adds \3rdparty\extensions\<id>\policy. Getting the path wrong is the most common reason a deployment applies on some browsers and not others.
| Browser | Windows registry root | macOS preference domain | Linux managed directory |
|---|---|---|---|
| Chrome | HKLM\SOFTWARE\Policies\Google\Chrome | com.google.Chrome | /etc/opt/chrome/policies/managed/ |
| Chromium | HKLM\SOFTWARE\Policies\Chromium | org.chromium.Chromium | /etc/chromium/policies/managed/ |
| Edge | HKLM\SOFTWARE\Policies\Microsoft\Edge | com.microsoft.Edge | /etc/opt/edge/policies/managed/ |
| Brave | HKLM\SOFTWARE\Policies\BraveSoftware\Brave | com.brave.Browser | /etc/brave/policies/managed/ |
| Vivaldi | HKLM\SOFTWARE\Policies\Vivaldi | com.vivaldi.Vivaldi | /etc/vivaldi/policies/managed/ |
Firefox does not read Chromium managed storage. It uses a native manifest namedosprey@foulest.net.json, or a 3rdparty.Extensions block inpolicies.json. Prefer the native manifest for lists and objects, because Firefox delivers those as strings when they are set through the Windows registry. The full guide lists every path.
Removal protection
None of these templates stop a user from removing the extension. That is a browser force-install policy, separate from Osprey's settings, set with ExtensionInstallForcelist on Chromium browsers and ExtensionSettings on Firefox. The macOS profiles already include it.
Documentation
Full deployment guidePolicy reference (all 40 keys)Recommended hardened baselineRemoval protection note
Something not working?
Send us a message or create an issue on GitHub.
We'll get back to you as soon as we can.