This guide deploys the Scribe browser extension to Chrome through Intune, on Intune-managed Windows devices, and configures it: silent authentication through your Microsoft Entra identity, a reduced interface for background-capture users, and the other extension settings. It applies on managed devices only; on an unmanaged computer users get normal sign-in.
Prerequisites
- Intune-managed, Entra-joined Windows devices with Chrome installed.
- For silent authentication: single sign-on set up for your Scribe organisation with Entra as the identity provider (see Browser extension - set up single sign-on with Microsoft Entra).
- For silent authentication: users exist in Scribe with emails matching their Entra sign-in names.
- Scribe extension ID: okfkdaglfjjjfefdcppliegebpoegaii
Deploy
Everything is delivered as registry values under HKLM\SOFTWARE\Policies\Google\Chrome, with an Intune script. Two options, depending on your Windows licensing:
- Remediation (recommended): Intune → Devices → Scripts and remediations → Remediations. A detection script checks the values, a remediation script writes them, and it runs on a schedule, so changed values are put back. Requires Windows 10/11 Enterprise E3 or E5, Microsoft 365 F3/E3/E5, the education equivalents, or Windows 365 / Azure Virtual Desktop.
- Platform script: any licence. Intune → Devices → Scripts and remediations → Platform scripts, run in system context. Runs once per device; later changes to the values are not re-applied.
Example script, usable as a platform script or as the remediation half of a remediation pair. Set Domain to your SSO domain, adjust the other values and add any you need from the table below (MinerVisibility, for example) as further Set-ItemProperty lines on the policy key:
What it sets:
- CloudApAuthEnabled lets Chrome use the Windows sign-in identity for Microsoft sign-ins, so silent authentication works without the user signing in to anything in Chrome. Without it, each user signs in to a Microsoft 365 page in Chrome once.
- ExtensionInstallForcelist installs the extension.
- The values under 3rdparty\extensions\okfkdaglfjjjfefdcppliegebpoegaii\policy are the extension's settings - each one is listed in the table below.
Minimal mode. For users who only do background capture, you can add MinerVisibility as a string value minimal to the policy key: the extension reduces to a small status view, with no manual capture options and no regular popup or side panel. It works like the desktop app's minimal visibility mode.
All values the policy key accepts:
| Value name | Type and data | Effect |
|---|---|---|
| SilentLoginEnabled | DWORD 1 / 0 | Signs users in silently |
| Domain | String, your SSO domain | The domain users sign in with |
| SuppressWelcomeTab | DWORD 1 / 0 | Stops the welcome tab opening on first install |
| CheckAuthIntervalHours | String, a number of hours, minimum 0.1 | How often the extension re-checks sign-in status |
| MinerVisibility | String full / minimal | full is the normal extension. minimal reduces it to a small status view for users who only do background capture |
For a remediation, pair it with this detection script, which reports non-compliant when any value is missing or different (keep the values identical to the script above):
Detection and remediation scripts, ready to upload (remove the .txt suffix after download):
Verify on one device
- The extension appears in chrome://extensions.
- The configuration arrived: chrome://policy → Reload policies shows the Scribe extension's section with your values, and ExtensionInstallForcelist under Chrome policies.
- Open Scribe in Chrome: signed in with no interaction.
- If you set MinerVisibility to minimal: click the extension's toolbar icon - it shows the small status view instead of the regular extension.
- After a configuration change, chrome://policy → Reload policies applies it; no restart needed.