Microsoft Intune (Windows)

Best for: Organizations managing Windows devices through Microsoft Intune.

On Windows the whole deployment is one Intune Remediation: a pair of PowerShell scripts that write the extension's managed configuration to the registry and then force-install the extension. Use the Microsoft Intune admin center to deploy it.

The order matters. The scripts write the configuration first and add the force-install entry last, so the extension already has its token the first time it starts. If the extension were installed before its configuration arrived, users would see a Setup required prompt until the policy caught up, which defeats Silent Onboarding. Keeping both writes in one script is the only way to guarantee that order, which is why we do not use a separate Settings-catalog policy for the force-install.

Remediations run as SYSTEM and re-run on a schedule until the detection script reports the device as configured, so devices that were offline, browsers installed later and rotated tokens all converge without manual intervention. Remediations require a Windows Enterprise or Education entitlement (Microsoft 365 E3, E5, F3 and Business Premium include it). If your tenant does not have one, deploy the remediation script below as a Platform script instead; it does the same work, but runs only once per device.

Already deployed the extension with a Settings-catalog policy?

Remove that policy before assigning the Remediation. Both write the same ExtensionInstallForcelist registry key, and the policy-delivered list overwrites the script's entry on every policy sync.

Step 1: Prepare the scripts

Both scripts start with the same settings block. Edit it identically in both files:

• Replace SLASHID_SENSOR_TOKEN with the activation code of your SlashID Sensors data source.
• Set $silentOnboarding to $false to keep the standard onboarding flow instead of Silent Onboarding.
• $browsers lists the browsers to configure. Chrome and Edge read their policies from different registry paths, and everything below that path is identical, so the scripts loop over the list. Writing the policy for a browser that is not installed is harmless: the keys sit unused and are picked up if that browser is installed later. Remove a browser only if you are sure you never deploy it.

Detection script

Save as slashid-detect.ps1. It exits 1 when any configured browser is missing the token, the silent-onboarding flag or the force-install entry, which tells Intune to run the remediation script.

$token            = "SLASHID_SENSOR_TOKEN"
$silentOnboarding = $true
$browsers         = @("Chrome", "Edge")

$extensionId = "jmmgnjennniheaocoocojcdidefgmapi"
$updateUrl   = "https://extension-install.slashid.com/updates.xml"
$policyRoots = @{
  Chrome = "HKLM:\SOFTWARE\Policies\Google\Chrome"
  Edge   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
}

foreach ($browser in $browsers) {
  $root          = $policyRoots[$browser]
  $policyPath    = "$root\3rdparty\extensions\$extensionId\policy"
  $forceListPath = "$root\ExtensionInstallForcelist"

  if (-not (Test-Path $policyPath)) {
    Write-Output "${browser}: managed configuration missing"
    exit 1
  }
  $policy = Get-ItemProperty -Path $policyPath
  if ($policy.sidEventStreamingToken -ne $token) {
    Write-Output "${browser}: token differs"
    exit 1
  }
  if ($silentOnboarding -and $policy.sidSilentOnboarding -ne 1) {
    Write-Output "${browser}: silent onboarding flag missing"
    exit 1
  }

  if (-not (Test-Path $forceListPath)) {
    Write-Output "${browser}: force-install list missing"
    exit 1
  }
  $forceList = Get-Item -Path $forceListPath
  $entry = $forceList.Property | Where-Object { $forceList.GetValue($_) -like "$extensionId;*" }
  if (-not $entry) {
    Write-Output "${browser}: force-install entry missing"
    exit 1
  }
}

Write-Output "SlashID Browser Extension policy present"
exit 0

Remediation script

Save as slashid-remediate.ps1. It writes the managed configuration, then adds the force-install entry, and is safe to run repeatedly.

$token            = "SLASHID_SENSOR_TOKEN"
$silentOnboarding = $true
$browsers         = @("Chrome", "Edge")

$extensionId = "jmmgnjennniheaocoocojcdidefgmapi"
$updateUrl   = "https://extension-install.slashid.com/updates.xml"
$policyRoots = @{
  Chrome = "HKLM:\SOFTWARE\Policies\Google\Chrome"
  Edge   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
}

try {
  foreach ($browser in $browsers) {
    $root          = $policyRoots[$browser]
    $policyPath    = "$root\3rdparty\extensions\$extensionId\policy"
    $forceListPath = "$root\ExtensionInstallForcelist"

    # Managed configuration first, so the extension never starts without it.
    # Create keys only when missing: New-Item -Force on an existing key has
    # been observed to clear its values.
    if (-not (Test-Path $policyPath)) {
      New-Item -Path $policyPath -Force | Out-Null
    }
    Set-ItemProperty -Path $policyPath -Name "sidEventStreamingToken" -Value $token -Type String
    if ($silentOnboarding) {
      Set-ItemProperty -Path $policyPath -Name "sidSilentOnboarding" -Value 1 -Type DWord
    } else {
      Remove-ItemProperty -Path $policyPath -Name "sidSilentOnboarding" -ErrorAction SilentlyContinue
    }

    if (-not (Test-Path $forceListPath)) {
      New-Item -Path $forceListPath -Force | Out-Null
    }
    $forceList = Get-Item -Path $forceListPath
    $names     = @($forceList.Property)
    $entryName = $names | Where-Object { $forceList.GetValue($_) -like "$extensionId;*" } | Select-Object -First 1
    if (-not $entryName) {
      $index = 1
      while ($names -contains "$index") { $index++ }
      $entryName = "$index"
    }
    Set-ItemProperty -Path $forceListPath -Name $entryName -Value "$extensionId;$updateUrl" -Type String
  }

  Write-Output "SlashID Browser Extension policy remediated"
  exit 0
}
catch {
  Write-Output "Remediation failed: $_"
  exit 1
}

The force-install value is the Chrome extension ID of the SlashID Browser Extension and the URL where devices look for updates. The script updates an existing entry for the extension in place rather than adding a duplicate, and otherwise takes the next free index so entries for other extensions are preserved.

Step 2: Create the Remediation in Intune

Navigate Devices -> Manage devices -> Scripts and remediations, open the Remediations tab and choose Create.

On the Settings step upload slashid-detect.ps1 as the detection script file and slashid-remediate.ps1 as the remediation script file. The wizard's defaults, shown above, do not suit these scripts; change them to the following (you may also wish to sign your scripts and enable the signature check):

• Run this script using the logged-on credentials: No (the scripts write to HKLM, which needs SYSTEM)
• Enforce script signature check: No
• Run script in 64-bit PowerShell: Yes

On the Assignments step select the groups of devices that should receive the extension and choose a schedule. Hourly is a good default while rolling out; daily is enough afterwards.

Verifying on a device

Open chrome://policy or edge://policy on a managed device. The force-install entry appears under ExtensionInstallForcelist, and the extension's managed values appear under its extension ID, as described in Managed configuration. In the Intune admin center the Remediation's device status shows each device as Without issues once detection passes.