Browser Extension · Step 5 of 7

Installing using MDM

Roll out to the fleet. The installer (MSI/pkg) is always required and installs both the native agent and the WebExtension; the optional browser policy only adds enforcement (force-install, pin, prevent removal). Pick your MDM below.

ℹ️

macOS order Deploy the two configuration profiles before the pkg so permissions are granted before the agent runs. On Windows the MSI is self-contained.

Microsoft Intune — Windows

Wrap the MSI

cmd

IntuneWinAppUtil.exe -c C:\Staging\QuilrExtension -s Quilr.msi -o C:\Staging\Out

Create the Win32 app

Apps → All apps → Add → Windows app (Win32), upload Quilr.intunewin. Name “Quilr Browser Extension,” publisher “Quilr AI.”

Field	Value
Install	`msiexec /i Quilr.msi TENANT=<TENANT-ID> /qn /norestart`
Install behavior	System
Device restart	No specific action

⛔

Parameter is TENANT Mandatory — obtain from support@quilr.ai.

Detection rule & assignment

Detection: MSI (auto) or a registry check that HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist contains piajhjohgigijkddhdpgbjdcfhmammbk. Assign as Required to the WIN-Quilr-Extension group.

Optional · enforce via browser policy

If you centrally manage extensions, add a Settings Catalog policy — “Configure extension management settings” under both Edge and Chrome:

json

{
  "piajhjohgigijkddhdpgbjdcfhmammbk": {
    "installation_mode": "force_installed",
    "override_update_url": true,
    "toolbar_state": "force_shown",
    "update_url": "https://quilr-extensions.quilr.ai/<TENANT-ID>/manifest.xml"
  }
}

Microsoft Intune — macOS

Gather three artifacts

Tenant pkg: https://quilr-extensions.quilr.ai/<TENANT-ID>/browser-util/quilr-installer-mac.pkg
Tenant .mobileconfig from the Quilr console (Settings → Browser Extension → Deployment → MDM → macOS / Intune)
File-Access .mobileconfig: https://quilr-extensions.quilr.ai/browser-agent/prod/mac/quilr_browser_util_Files_Access.mobileconfig

Upload both profiles (Device channel)

Devices → Configuration → Create → New Policy, macOS, Templates → Custom. Name them “Quilr Browser Extension — Tenant Approval” and “— File Access,” deployment channel Device, assign to MAC-Quilr-Extension.

Add the PKG app

Apps → Add → macOS app (PKG) (unmanaged), upload quilr-installer-mac.pkg, publisher “Quilr AI,” assign Required to the same group.

⚠️

Profiles before PKG Deploy the configuration profiles first so permissions are granted before the installer runs.

Jamf Pro — macOS

Gather three artifacts

Tenant pkg (CDN), tenant .mobileconfig (Quilr console → macOS / Jamf Pro), and the public File-Access .mobileconfig.

Deploy both profiles

Upload each .mobileconfig as a separate Configuration Profile — “Quilr Browser Extension — Tenant Approval” and “— File Access” — Computer Level, Install Automatically, scoped to your macOS group.

Package + policy

Upload the pkg (display name “Quilr Browser Extension,” category Endpoint Security). Create a policy “Install Quilr Browser Extension” — Recurring Check-in, Once per computer — attach the package and scope to the same group.

Kandji — macOS

Gather three artifacts

Tenant pkg (CDN), tenant .mobileconfig (Quilr console → macOS / Kandji), public File-Access .mobileconfig.

Custom Profiles (both mobileconfigs)

Library → Add Library Item → Custom Profile for each: “Quilr Browser Extension — Tenant Approval” and “— File Access.” Run on macOS; assign to your Blueprint. Profiles install first.

Custom App (pkg)

Library → Add Library Item → Custom App, upload the pkg, name “Quilr Browser Extension,” configure Audit & Enforce (request the script from Quilr support), assign to the same Blueprint.

ManageEngine Endpoint Central — Windows

Download the MSI

Retrieve https://quilr-extensions.quilr.ai/Quilr.msi and place it on the Endpoint Central server or upload it directly.

Add the package

Software Deployment → Add Package → Add Windows Package. Name “Quilr Browser Extension,” category Security, browse to Quilr.msi. In MSI/MSP Properties enter:

MSI properties

TENANTID=<TENANT-ID>

⚠️

Confirm the property name The ManageEngine guide specifies TENANTID, while the Intune guide uses TENANT for the same MSI. If the extension stays idle after install, re-check this value with support@quilr.ai. Without it, the extension installs but stays idle until reinstalled.

Install configuration

Configurations → Add Configuration → Install MSI Software. Name “Install Quilr Browser Extension,” select the package, Run as System, target WIN-Quilr-Extension, Deploy.

Optional · enforce via browser policy

Deploy ExtensionSettings via a Custom Script configuration:

PowerShell

$JSON = @'{"piajhjohgigijkddhdpgbjdcfhmammbk": {"installation_mode": "force_installed","override_update_url": true,"toolbar_state": "force_shown","update_url": "https://quilr-extensions.quilr.ai/<TENANT-ID>/manifest.xml"}}'@

foreach ($key in @('HKLM:\SOFTWARE\Policies\Microsoft\Edge','HKLM:\SOFTWARE\Policies\Google\Chrome')) {
  if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
  Set-ItemProperty -Path $key -Name 'ExtensionSettings' -Value $JSON -Type String
}

Validate after MDM rollout

Whichever platform you used, repeat the validation on a pilot device — install vector changed, runtime expectations didn’t. The full check-list (Console-side validation + on-device badges + functional tests) lives in Step 6 · Verify MDM Install. Promote pilot → production only after every check is green.

✅

Exit criteria for Step 5 Installer scoped to the pilot group and reporting success · pilot device passes all Step 4 checks · assignment promoted to production. If anything misbehaves, go to Step 6.

←BackValidate Manual Install Step 5 of 7 NextVerify MDM Install→