> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inviolet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy the extension via MDM

> Force-install the Inviolet browser extension across your fleet and push a signed managed-config so each install self-enrolls to your tenant.

The Inviolet browser extension captures prompts on the major LLM web UIs. To
roll it out across a managed fleet you do two things through your MDM, both
carried in a single generated profile:

1. **Force-install** the extension (`ExtensionInstallForcelist`) so users can't
   remove it.
2. **Push a signed managed-config** (`chrome.storage.managed`) so the extension
   knows which org it belongs to and how to establish identity — no per-user
   setup.

<Note>
  Every profile below is produced for you. Go to **App → Settings → MDM**, pick
  your vendor and [identity mode](#identity-modes), and download the ready-to-import
  file. This page explains what's in it; the vendor pages are the click-by-click.
</Note>

## Generate the profile

1. Open [app.inviolet.ai](https://app.inviolet.ai) → **Settings → MDM**.
2. Choose your MDM (Intune, Jamf, Kandji, or Workspace ONE) and an identity mode.
3. Download the generated file — the placeholders are already substituted with
   your `org_id`, a fresh `enrollment_token`, and a `config_signature`.

## The managed-config payload

Every vendor format carries the same five fields under the
`org.inviolet.extension` managed-storage key:

| Field                          | What it is                                                                |
| ------------------------------ | ------------------------------------------------------------------------- |
| `org_id`                       | Your Inviolet organization id                                             |
| `enrollment_token`             | One-time token that binds this install to your tenant                     |
| `expected_user_email_template` | `${osUser.email}` — resolved by the browser at runtime to attach identity |
| `identity_mode`                | How the extension establishes the user (see below)                        |
| `config_signature`             | HMAC over the other fields; the extension refuses tampered config         |

## Identity modes

| Mode                      | Behavior                                                             |
| ------------------------- | -------------------------------------------------------------------- |
| `sso_required`            | The extension requires an SSO-verified user before capturing         |
| `sso_with_token_fallback` | Prefer SSO; fall back to the enrollment token if SSO isn't available |
| `self_serve`              | Lightest — the user confirms their own identity                      |

## Verify any deployment

After the profile lands, on a target device open `chrome://policy/` (or
`edge://policy/`) and confirm `ExtensionInstallForcelist` and `ExtensionSettings`
are present. The extension then reports into your tenant — new installs appear in
the fleet view, and MCP-discovery scans begin per device.

## Pick your MDM

* **[Microsoft Intune](/guides/mdm/intune)**
* **[Jamf Pro](/guides/mdm/jamf)**
* **[Kandji](/guides/mdm/kandji)**
* **[VMware Workspace ONE](/guides/mdm/workspace-one)**