# Deploying Blank

Blank is a **managed** extension. Employees don't install it. An administrator force-installs it across the fleet through browser management, and each device enrolls automatically with your organization token. Managed installation is also what unlocks Blank's network-layer enforcement, which the browser grants only to policy-installed extensions.

## Before you start

- Admin access to your browser management console: the Google Admin console (Chrome), Microsoft Intune or Group Policy (Edge), or your MDM of choice.
- Your **organization token** from **Settings → Deployment** in the dashboard. It ties each enrolled device to your organization.
- The Blank extension ID and update URL (its Chrome Web Store or Edge Add-ons listing).

## Chrome (Google Admin console)

1. Go to **Devices → Chrome → Apps & extensions → Users & browsers**, and select the org unit to cover.
2. Add the Blank extension by ID and set the installation policy to **Force install**.
3. Under the extension's **Policy for extensions**, provide the managed configuration so devices enroll silently:

   ```json
   {
     "orgToken": { "Value": "YOUR_ORG_TOKEN" }
   }
   ```

Force-installed extensions can't be disabled or removed by the user, and the managed configuration is delivered by policy. There's no per-user setup and no sign-in.

## Edge (Intune or Group Policy)

Edge uses the same Chromium management model.

1. In **Intune → Configuration profiles** (or Group Policy), configure **Microsoft Edge → Extensions → Control which extensions are installed silently**, and add the Blank extension.
2. Deliver the same managed configuration (`orgToken`) via the Edge extension policy.

## Verify the rollout

- Within a few minutes of a device applying the policy, it enrolls and begins reporting. Enrolled devices and their installed-extension inventory appear under **Extensions** and across the [dashboard](/docs/dashboard/).
- A device that isn't policy-installed still runs the DOM-layer protection, but the network-layer backstop is inactive. The dashboard flags those devices as "enforcement is DOM-layer only" so you can spot a misconfigured rollout.

## Rotating the token

Change the token value in your management console and the browser pushes it to devices, with no reinstall. Blank re-enrolls under the new token and keeps the same device identity.