Deploy the extension with Microsoft Intune

An Intune deployment has two parts: a force-install policy that adds the Sorvek Discovery extension to Chrome and Edge, and a managed configuration that gives the extension each person's address and your organization's deployment key. With both in place, the extension enrolls itself the next time the browser starts, with no action from the employee.

Before you start

• The Administrator role in Sorvek, and the SaaS Discovery module active.
• Employee addresses present in the directory that Sorvek syncs (UPN or email). An unknown address is refused.
• Windows devices managed by Intune and joined to Entra ID or Active Directory, where the script finds the person's UPN.

Values to use

Step 1: force-install the extension

1. In Intune, open Devices > Configuration profiles > Create profile.
2. Choose Windows 10 and later, then the settings catalog.
3. For Edge, add "Control which extensions are installed silently" ("Configurer la liste des extensions installées en mode forcé" in French).
4. For Chrome, add "Configure the list of force-installed apps and extensions".
5. In both, add the force-install entry from the table.
6. Assign the profile to the target groups.

Step 2: generate the deployment key

1. In the Sorvek console, open Settings > Browser extension.
2. In the Deployment section, click the Chrome / Edge card.
3. Under Zero-touch deployment (Intune / GPO / Jamf), click Generate deployment key.
4. Click PowerShell template · Windows to download sorvek-extension-mdm-windows.ps1, which contains the key and both IDs.

Step 3: push the managed configuration

Run as SYSTEM, the script reads, for each open session, the person's UPN (from the device's Entra ID identity cache, otherwise from the Active Directory userPrincipalName attribute). It writes user_email and deployment_key under HKEY_USERS\<SID>\Software\Policies\Google\Chrome\3rdparty\extensions\<ID>\policy and under the Microsoft\Edge equivalent. A profile without a UPN is skipped and reported: the script never guesses an address. It does not install the extension.

1. In Intune, open Devices > Scripts and remediations > Remediations.
2. Create a script with sorvek-extension-mdm-windows.ps1, run in the system context.
3. Schedule it to run on a recurring basis (daily or hourly): each run only covers the sessions that are open.
4. Assign it to the same groups as the profile from step 1.

A scheduled task at sign-in, run as SYSTEM, also works. A GPO startup script on its own is not enough: no session is open at startup.

Check on a pilot device

1. Restart the browser.
2. Open chrome://policy (or edge://policy): ExtensionInstallForcelist contains the entry, and the extension's policy shows user_email and deployment_key.
3. In the person's session, in PowerShell: Get-ItemProperty "HKCU:\Software\Policies\Google\Chrome\3rdparty\extensions\<extension ID>\policy".
4. In the Sorvek console, in the Installations table on the Browser extension page: a row with the person's address, the Active status and the enrollment "MDM, key" followed by the key's fingerprint.

When it enrolls, the extension opens the "Extension deployed by your organization" tab in the background, which informs the employee without offering a choice: the features left optional are then active (see What the extension sees and what it sends). If no row appears, see Troubleshoot the extension.

Change the key

Click Regenerate, then confirm. The old key is refused immediately: download the script again and redeploy it. Devices already enrolled keep their access, unless you check Also disconnect devices enrolled with a deployment key (if the key has leaked): they then re-enroll on their own as soon as Intune pushes the new key to them.

For macOS, the same card offers PLIST template · macOS, designed for Jamf Pro or Kandji.