Chrome extension via Intune (Windows)

This guide deploys the Scribe browser extension to Chrome through Intune on Intune-managed Windows devices and configures it: silent authentication through your Microsoft Entra identity, a reduced interface for background-capture users, and the other extension settings. It applies only to managed devices; on an unmanaged computer, users get a normal sign-in.

Prerequisites

• Intune-managed, Entra-joined Windows devices with Chrome installed.
• For silent authentication: set up single sign-on for your Scribe organization with Entra as the identity provider (see Browser extension - set up single sign-on with Microsoft Entra).
• For silent authentication, users exist in Scribe with email addresses that match their Entra sign-in names.
• Scribe extension ID: okfkdaglfjjjfefdcppliegebpoegaii

Deploy

Everything is delivered as registry values under HKLM\SOFTWARE\Policies\Google\Chromewith an Intune script. Two options, depending on your Windows licensing:

• Remediation (recommended): Intune → Devices → Scripts and remediations → Remediations. A detection script checks the values, a remediation script writes them, and it runs on a schedule, so changed values are put back. Requires Windows 10/11 Enterprise E3 or E5, Microsoft 365 F3/E3/E5, the education equivalents, or Windows 365 / Azure Virtual Desktop.
• Platform script: any license. Intune → Devices → Scripts and remediations → Platform scripts, run in system context. Runs once per device; later changes to the values are not re-applied.

Example script, usable as a platform script or as the remediation half of a remediation pair. Set Domain to your SSO domain, adjust the other values and add any you need from the table below (MinerVisibility, for example) as further Set-ItemProperty lines on the policy key:

$chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
New-Item -Path $chrome -Force | Out-Null
Set-ItemProperty $chrome -Name 'CloudApAuthEnabled' -Value 1 -Type DWord
New-Item -Path "$chrome\ExtensionInstallForcelist" -Force | Out-Null
Set-ItemProperty "$chrome\ExtensionInstallForcelist" -Name '1' -Value 'okfkdaglfjjjfefdcppliegebpoegaii;<https://clients2.google.com/service/update2/crx>' -Type String
$policy = "$chrome\3rdparty\extensions\okfkdaglfjjjfefdcppliegebpoegaii\policy"
New-Item -Path $policy -Force | Out-Null
Set-ItemProperty $policy -Name 'SilentLoginEnabled' -Value 1 -Type DWord
Set-ItemProperty $policy -Name 'Domain' -Value 'yourcompanydomain.com' -Type String
Set-ItemProperty $policy -Name 'SuppressWelcomeTab' -Value 1 -Type DWord

What it sets:

• CloudApAuthEnabled lets Chrome use the Windows sign-in identity for Microsoft sign-ins, so silent authentication works without the user signing in to anything in Chrome. Without it, each user signs in to a Microsoft 365 page in Chrome once.
• ExtensionInstallForcelist Installs the extension.
• The values under 3rdparty\extensions\okfkdaglfjjjfefdcppliegebpoegaii\policy are the extension's settings - each one is listed in the table below.

Minimal mode. For users who only do background capture, you can add MinerVisibility as a string value minimal to the policy key: the extension reduces to a small status view, with no manual capture options and no regular popup or side panel. It works like the desktop app's minimal visibility mode.

All values the policy key accepts:

For remediation, pair it with this detection script, which reports non-compliant when any value is missing or different (keep the values identical to the script above):

$chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
$forcelist = "$chrome\ExtensionInstallForcelist"
$policy = "$chrome\3rdparty\extensions\okfkdaglfjjjfefdcppliegebpoegaii\policy"
$forcelistEntry = 'okfkdaglfjjjfefdcppliegebpoegaii;<https://clients2.google.com/service/update2/crx>'
$expected = @{
    SilentLoginEnabled = 1
    Domain             = 'yourcompanydomain.com'
    SuppressWelcomeTab = 1
}
$cloudAp = (Get-ItemProperty -Path $chrome -Name 'CloudApAuthEnabled' -ErrorAction SilentlyContinue).CloudApAuthEnabled
if ("$cloudAp" -ne '1') { exit 1 }
if (-not (Test-Path $forcelist)) { exit 1 }
$fl = Get-ItemProperty -Path $forcelist -ErrorAction SilentlyContinue
$found = $false
foreach ($p in $fl.PSObject.Properties) { if ($p.Value -eq $forcelistEntry) { $found = $true } }
if (-not $found) { exit 1 }
if (-not (Test-Path $policy)) { exit 1 }
foreach ($name in $expected.Keys) {
    $actual = (Get-ItemProperty -Path $policy -Name $name -ErrorAction SilentlyContinue).$name
    if ("$actual" -ne "$($expected[$name])") { exit 1 }
}
exit 0

Detection and remediation scripts, ready to upload (remove the .txt suffix after download):

Detect-ChromeExtensionPolicy.ps1.txt

Remediate-ChromeExtensionPolicy.ps1.txt

Verify on one device

1. The extension appears in chrome://extensions.
2. The configuration arrived: chrome://policy → Reload policies shows the Scribe extension's section with your values, and ExtensionInstallForcelist under Chrome policies.
3. Open Scribe in Chrome: signed in with no interaction.
4. If you set MinerVisibility to minimal: click the extension's toolbar icon - it shows the small status view instead of the regular extension.
5. After a configuration change, chrome://policy → Reload policies applies it; no restart needed.