Blank
Start free

Deploying Blank

Blank is a managed extension. Employees don't install it. An administrator force-installs it across the fleet through browser management, and each device enrolls automatically with your organization token. Managed installation is also what unlocks Blank's network-layer enforcement, which the browser grants only to policy-installed extensions.

Before you start

  • Admin access to your browser management console: the Google Admin console (Chrome), Microsoft Intune or Group Policy (Edge), or your MDM of choice.
  • Your organization token from Settings → Deployment in the dashboard. It ties each enrolled device to your organization.
  • The Blank extension ID and update URL (its Chrome Web Store or Edge Add-ons listing).

Chrome (Google Admin console)

  1. Go to Devices → Chrome → Apps & extensions → Users & browsers, and select the org unit to cover.

  2. Add the Blank extension by ID and set the installation policy to Force install.

  3. Under the extension's Policy for extensions, provide the managed configuration so devices enroll silently:

    {
  "orgToken": { "Value": "YOUR_ORG_TOKEN" }
}

Force-installed extensions can't be disabled or removed by the user, and the managed configuration is delivered by policy. There's no per-user setup and no sign-in.

Edge (Intune or Group Policy)

Edge uses the same Chromium management model.

  1. In Intune → Configuration profiles (or Group Policy), configure Microsoft Edge → Extensions → Control which extensions are installed silently, and add the Blank extension.
  2. Deliver the same managed configuration (orgToken) via the Edge extension policy.

Verify the rollout

  • Within a few minutes of a device applying the policy, it enrolls and begins reporting. Enrolled devices and their installed-extension inventory appear under Extensions and across the dashboard.
  • A device that isn't policy-installed still runs the DOM-layer protection, but the network-layer backstop is inactive. The dashboard flags those devices as "enforcement is DOM-layer only" so you can spot a misconfigured rollout.

Rotating the token

Change the token value in your management console and the browser pushes it to devices, with no reinstall. Blank re-enrolls under the new token and keeps the same device identity.

View this page as Markdown →