Browser Extension · Step 5 of 7

Installing using MDM

Roll out to the fleet. The installer (MSI/pkg) is always required and installs both the native agent and the WebExtension; the optional browser policy only adds enforcement (force-install, pin, prevent removal). Pick your MDM below.

ℹ️

macOS order Deploy the two configuration profiles before the pkg so permissions are granted before the agent runs. On Windows the MSI is self-contained.

Microsoft Intune — Windows

Wrap the MSI

cmd

IntuneWinAppUtil.exe -c C:\Staging\QuilrExtension -s Quilr.msi -o C:\Staging\Out

Create the Win32 app

Apps → All apps → Add → Windows app (Win32), upload Quilr.intunewin. Name “Quilr Browser Extension,” publisher “Quilr AI.”

Field	Value
Install	`msiexec /i Quilr.msi TENANT=<TENANT-ID> /qn /norestart`
Install behavior	System
Device restart	No specific action

⛔

Parameter is TENANT Mandatory — obtain from support@quilr.ai.

Detection rule & assignment

Detection: MSI (auto) or a registry check that HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist contains piajhjohgigijkddhdpgbjdcfhmammbk. Assign as Required to the WIN-Quilr-Extension group.

Optional · enforce via browser policy

If you centrally manage extensions, add a Settings Catalog policy — “Configure extension management settings” under both Edge and Chrome:

json

{
  "piajhjohgigijkddhdpgbjdcfhmammbk": {
    "installation_mode": "force_installed",
    "override_update_url": true,
    "toolbar_state": "force_shown",
    "update_url": "https://quilr-extensions.quilr.ai/<TENANT-ID>/manifest.xml"
  }
}

Microsoft Intune — macOS

Gather three artifacts

Tenant pkg: https://quilr-extensions.quilr.ai/<TENANT-ID>/browser-util/quilr-installer-mac.pkg
Tenant .mobileconfig from the Quilr console (Settings → Browser Extension → Deployment → MDM → macOS / Intune)
File-Access .mobileconfig: https://quilr-extensions.quilr.ai/browser-agent/prod/mac/quilr_browser_util_Files_Access.mobileconfig

Upload both profiles (Device channel)

Devices → Configuration → Create → New Policy, macOS, Templates → Custom. Name them “Quilr Browser Extension — Tenant Approval” and “— File Access,” deployment channel Device, assign to MAC-Quilr-Extension.

Add the PKG app

Apps → Add → macOS app (PKG) (unmanaged), upload quilr-installer-mac.pkg, publisher “Quilr AI,” assign Required to the same group.

⚠️

Profiles before PKG Deploy the configuration profiles first so permissions are granted before the installer runs.

Jamf Pro — macOS

Gather three artifacts

Tenant pkg (CDN), tenant .mobileconfig (Quilr console → macOS / Jamf Pro), and the public File-Access .mobileconfig.

Deploy both profiles

Upload each .mobileconfig as a separate Configuration Profile — “Quilr Browser Extension — Tenant Approval” and “— File Access” — Computer Level, Install Automatically, scoped to your macOS group.

Package + policy

Upload the pkg (display name “Quilr Browser Extension,” category Endpoint Security). Create a policy “Install Quilr Browser Extension” — Recurring Check-in, Once per computer — attach the package and scope to the same group.

Kandji — macOS

Gather three artifacts

Tenant pkg (CDN), tenant .mobileconfig (Quilr console → macOS / Kandji), public File-Access .mobileconfig.

Custom Profiles (both mobileconfigs)

Library → Add Library Item → Custom Profile for each: “Quilr Browser Extension — Tenant Approval” and “— File Access.” Run on macOS; assign to your Blueprint. Profiles install first.

Custom App (pkg)

Library → Add Library Item → Custom App, upload the pkg, name “Quilr Browser Extension,” configure Audit & Enforce (request the script from Quilr support), assign to the same Blueprint.

ManageEngine Endpoint Central — Windows

Download the MSI

Retrieve https://quilr-extensions.quilr.ai/Quilr.msi and place it on the Endpoint Central server or upload it directly.

Add the package

Software Deployment → Add Package → Add Windows Package. Name “Quilr Browser Extension,” category Security, browse to Quilr.msi. In MSI/MSP Properties enter:

MSI properties

TENANTID=<TENANT-ID>

⚠️

Confirm the property name The ManageEngine guide specifies TENANTID, while the Intune guide uses TENANT for the same MSI. If the extension stays idle after install, re-check this value with support@quilr.ai. Without it, the extension installs but stays idle until reinstalled.

Install configuration

Configurations → Add Configuration → Install MSI Software. Name “Install Quilr Browser Extension,” select the package, Run as System, target WIN-Quilr-Extension, Deploy.

Optional · enforce via browser policy

Deploy ExtensionSettings via a Custom Script configuration:

PowerShell

$JSON = @'{"piajhjohgigijkddhdpgbjdcfhmammbk": {"installation_mode": "force_installed","override_update_url": true,"toolbar_state": "force_shown","update_url": "https://quilr-extensions.quilr.ai/<TENANT-ID>/manifest.xml"}}'@

foreach ($key in @('HKLM:\SOFTWARE\Policies\Microsoft\Edge','HKLM:\SOFTWARE\Policies\Google\Chrome')) {
  if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
  Set-ItemProperty -Path $key -Name 'ExtensionSettings' -Value $JSON -Type String
}

Microsoft Configuration Manager (SCCM) — Windows

Stage the MSI source

Download https://quilr-extensions.quilr.ai/Quilr.msi and place it on a UNC source share the site server can read, e.g. \\sccm\Sources\Apps\QuilrExtension\Quilr.msi.

Create the Application (MSI deployment type)

Software Library → Application Management → Applications → Create Application. Choose type Windows Installer (*.msi) and point it at Quilr.msi. Name “Quilr Browser Extension,” publisher “Quilr AI.” On the generated deployment type, override the install command line:

cmd

msiexec /i "Quilr.msi" TENANT=<TENANT-ID> /qn /norestart

⛔

Parameter is TENANT Same MSI and property as the Intune · Windows tab — mandatory, obtain from support@quilr.ai. Without it the extension installs but stays idle.

Detection, install behavior & distribute

Keep the auto-generated MSI product-code detection rule. Set installation behavior Install for system and logon requirement Whether or not a user is logged on. Distribute Content to your distribution points.

Deploy to a device collection

Deploy the application to the WIN-Quilr-Extension device collection with purpose Required and schedule As soon as possible; clients install on the next machine-policy cycle.

Optional · enforce via browser policy

SCCM only ships the MSI. To force-install / pin the extension, deliver the ExtensionInstallForcelist / ExtensionSettings policy for extension ID piajhjohgigijkddhdpgbjdcfhmammbk via Active Directory Group Policy (Administrative Templates → Edge / Chrome) — the same JSON shown in the Intune · Windows and ManageEngine tabs. AD-managed fleets usually push this through GPO already.

Validate after MDM rollout

Whichever platform you used, repeat the validation on a pilot device — install vector changed, runtime expectations didn’t. The full check-list (Console-side validation + on-device badges + functional tests) lives in Step 6 · Verify MDM Install. Promote pilot → production only after every check is green.

✅

Exit criteria for Step 5 Installer scoped to the pilot group and reporting success · pilot device passes all Step 4 checks · assignment promoted to production. If anything misbehaves, go to Step 6.

←BackValidate Manual Install Step 5 of 7 NextVerify MDM Install→