Browser Extension · Step 5 of 7

Installing using MDM

Roll out to the fleet. The installer (MSI/pkg) is always required and installs both the native agent and the WebExtension; the optional browser policy only adds enforcement (force-install, pin, prevent removal). Pick your MDM below.

ℹ️

macOS order Deploy the two configuration profiles before the pkg so permissions are granted before the agent runs. On Windows the MSI is self-contained.

Microsoft Intune — Windows

Wrap the MSI

cmd

IntuneWinAppUtil.exe -c C:\Staging\QuilrExtension -s Quilr.msi -o C:\Staging\Out

Create the Win32 app

Apps → All apps → Add → Windows app (Win32), upload Quilr.intunewin. Name “Quilr Browser Extension,” publisher “Quilr AI.”

Field	Value
Install	`msiexec /i Quilr.msi TENANT=<TENANT-ID> /qn /norestart`
Install behavior	System
Device restart	No specific action

⛔

Parameter is TENANT Mandatory — obtain from support@quilr.ai.

🧩

Optional MSI properties The same command line accepts PROXY, BROWSERS, EMAIL, ENVIRONMENT, PINNED, SKIPDISCOVERY, EXTENSIONENV, UPDATEURL, FIREFOXINSTALLURL, and SKIPEXTENSIONSETTINGS — e.g. append PROXY=proxy.corp.local:8080 BROWSERS=chrome,edge. Full reference: Step 3 · MSI property reference. If you manage ExtensionSettings via Intune already (step 4 below), add SKIPEXTENSIONSETTINGS=1 so the installer doesn’t fight your policy.

Detection rule & assignment

Detection: MSI (auto) or a registry check that HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist contains piajhjohgigijkddhdpgbjdcfhmammbk. Assign as Required to the WIN-Quilr-Extension group.

Optional · enforce via browser policy

If you centrally manage extensions, add a Settings Catalog policy — “Configure extension management settings” under both Edge and Chrome:

json

{
  "piajhjohgigijkddhdpgbjdcfhmammbk": {
    "installation_mode": "force_installed",
    "override_update_url": true,
    "toolbar_state": "force_shown",
    "update_url": "https://quilr-extensions.quilr.ai/<TENANT-ID>/manifest.xml"
  }
}

Firefox has no Settings Catalog entry for ExtensionSettings — ingest the Mozilla ADMX templates, or push the registry values with a Platform Script / Remediation:

PowerShell (system)

$ff = 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\ExtensionSettings\firefox-extension@quilr.ai'
New-Item -Path $ff -Force | Out-Null
Set-ItemProperty $ff -Name installation_mode -Value 'force_installed' -Type String
Set-ItemProperty $ff -Name install_url -Value 'https://quilr-extensions.quilr.ai/firefox/prod/firefox-mv2-prod.xpi' -Type String
Set-ItemProperty $ff -Name updates_disabled -Value 0 -Type DWord

⚠️

Firefox layout is different Firefox is not Chromium: it expects a subkey per add-on with each property as its own registry value — a single JSON blob under …\ExtensionSettings is silently ignored and the add-on never installs. There is also no update_url field; the update endpoint is baked into the signed .xpi, so only install_url is needed.

Microsoft Intune — macOS

Gather three artifacts

Tenant pkg: https://quilr-extensions.quilr.ai/installer/mac/quilrai-browser-extension.pkg
Tenant .mobileconfig from the Quilr console (Settings → Browser Extension → Deployment → MDM → macOS / Intune)
File-Access .mobileconfig: https://quilr-extensions.quilr.ai/browser-agent/prod/mac/quilr_browser_util_Files_Access.mobileconfig

Upload both profiles (Device channel)

Devices → Configuration → Create → New Policy, macOS, Templates → Custom. Name them “Quilr Browser Extension — Tenant Approval” and “— File Access,” deployment channel Device, assign to MAC-Quilr-Extension.

Add the PKG app

Apps → Add → macOS app (PKG) (unmanaged), upload quilr-installer-mac.pkg, publisher “Quilr AI,” assign Required to the same group.

⚠️

Profiles before PKG Deploy the configuration profiles first so permissions are granted before the installer runs.

Jamf Pro — macOS

Gather three artifacts

Tenant pkg (CDN), tenant .mobileconfig (Quilr console → macOS / Jamf Pro), and the public File-Access .mobileconfig.

Deploy both profiles

Upload each .mobileconfig as a separate Configuration Profile — “Quilr Browser Extension — Tenant Approval” and “— File Access” — Computer Level, Install Automatically, scoped to your macOS group.

Package + policy

Upload the pkg (display name “Quilr Browser Extension,” category Endpoint Security). Create a policy “Install Quilr Browser Extension” — Recurring Check-in, Once per computer — attach the package and scope to the same group.

Kandji — macOS

Gather three artifacts

Tenant pkg (CDN), tenant .mobileconfig (Quilr console → macOS / Kandji), public File-Access .mobileconfig.

Custom Profiles (both mobileconfigs)

Library → Add Library Item → Custom Profile for each: “Quilr Browser Extension — Tenant Approval” and “— File Access.” Run on macOS; assign to your Blueprint. Profiles install first.

Custom App (pkg)

Library → Add Library Item → Custom App, upload the pkg, name “Quilr Browser Extension,” configure Audit & Enforce (request the script from Quilr support), assign to the same Blueprint.

ManageEngine Endpoint Central — Windows

Download the MSI

Retrieve https://quilr-extensions.quilr.ai/installer/windows/Quilr.msi and place it on the Endpoint Central server or upload it directly.

Add the package

Software Deployment → Add Package → Add Windows Package. Name “Quilr Browser Extension,” category Security, browse to Quilr.msi. In MSI/MSP Properties enter:

MSI properties

TENANT=<TENANT-ID>

⛔

Parameter is TENANT Same MSI and property as every other Windows deployment path (TENANTID belongs to the endpoint agent, not this MSI). Without it the extension installs but stays idle until reinstalled. Optional properties (PROXY, BROWSERS, SKIPEXTENSIONSETTINGS, …) go in the same MSI/MSP Properties field — see the Step 3 MSI property reference.

Install configuration

Configurations → Add Configuration → Install MSI Software. Name “Install Quilr Browser Extension,” select the package, Run as System, target WIN-Quilr-Extension, Deploy.

Optional · enforce via browser policy

Deploy ExtensionSettings via a Custom Script configuration:

PowerShell

$JSON = @'{"piajhjohgigijkddhdpgbjdcfhmammbk": {"installation_mode": "force_installed","override_update_url": true,"toolbar_state": "force_shown","update_url": "https://quilr-extensions.quilr.ai/<TENANT-ID>/manifest.xml"}}'@

foreach ($key in @('HKLM:\SOFTWARE\Policies\Microsoft\Edge','HKLM:\SOFTWARE\Policies\Google\Chrome')) {
  if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
  Set-ItemProperty -Path $key -Name 'ExtensionSettings' -Value $JSON -Type String
}

# Firefox uses a different layout: a subkey per add-on with one value per
# property (a single JSON blob is silently ignored). No update_url field —
# the update endpoint is baked into the signed .xpi.
$ff = 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\ExtensionSettings\firefox-extension@quilr.ai'
New-Item -Path $ff -Force | Out-Null
Set-ItemProperty $ff -Name installation_mode -Value 'force_installed' -Type String
Set-ItemProperty $ff -Name install_url -Value 'https://quilr-extensions.quilr.ai/firefox/prod/firefox-mv2-prod.xpi' -Type String
Set-ItemProperty $ff -Name updates_disabled -Value 0 -Type DWord

Microsoft Configuration Manager (SCCM) — Windows

Stage the MSI source

Download https://quilr-extensions.quilr.ai/installer/windows/Quilr.msi and place it on a UNC source share the site server can read, e.g. \\sccm\Sources\Apps\QuilrExtension\Quilr.msi.

Create the Application (MSI deployment type)

Software Library → Application Management → Applications → Create Application. Choose type Windows Installer (*.msi) and point it at Quilr.msi. Name “Quilr Browser Extension,” publisher “Quilr AI.” On the generated deployment type, override the install command line:

cmd

msiexec /i "Quilr.msi" TENANT=<TENANT-ID> /qn /norestart

⛔

Parameter is TENANT Same MSI and property as the Intune · Windows tab — mandatory, obtain from support@quilr.ai. Without it the extension installs but stays idle.

Detection, install behavior & distribute

Keep the auto-generated MSI product-code detection rule. Set installation behavior Install for system and logon requirement Whether or not a user is logged on. Distribute Content to your distribution points.

Deploy to a device collection

Deploy the application to the WIN-Quilr-Extension device collection with purpose Required and schedule As soon as possible; clients install on the next machine-policy cycle.

Optional · enforce via browser policy

SCCM only ships the MSI. To force-install / pin the extension, deliver the ExtensionInstallForcelist / ExtensionSettings policy for extension ID piajhjohgigijkddhdpgbjdcfhmammbk via Active Directory Group Policy (Administrative Templates → Edge / Chrome) — the same JSON shown in the Intune · Windows and ManageEngine tabs. AD-managed fleets usually push this through GPO already.

For Firefox, load the Mozilla ADMX templates into your GPO central store (Administrative Templates → Mozilla → Firefox → Extensions) and force-install add-on ID firefox-extension@quilr.ai from https://quilr-extensions.quilr.ai/firefox/prod/firefox-mv2-prod.xpi — or push the registry values shown in the ManageEngine tab (subkey per add-on; a single JSON blob is ignored by Firefox).

Validate after MDM rollout

Whichever platform you used, repeat the validation on a pilot device — install vector changed, runtime expectations didn’t. The full check-list (Console-side validation + on-device badges + functional tests) lives in Step 6 · Verify MDM Install. Promote pilot → production only after every check is green.

✅

Exit criteria for Step 5 Installer scoped to the pilot group and reporting success · pilot device passes all Step 4 checks · assignment promoted to production. If anything misbehaves, go to Step 6.

←BackValidate Manual Install Step 5 of 7 NextVerify MDM Install→