Who this guide is for: IT and Intune administrators who need to roll out Rockfort Orion to employees using Google Chrome or Microsoft Edge (Chromium).
What you are delivering: Employees get Rockfort Orion installed automatically (and kept up to date) like any other managed browser extension.
Your security or platform team should already have agreed with Rockfort (or your internal packaging team) on:
| Item | Plain-language description |
|---|---|
| Extension install package | A signed browser extension file (.crx) that Chrome/Edge can install in managed mode |
| Private Key | Must kept securely, It will be used for update patch to generate same Extension ID |
| Update address (update manifest) | A small XML file on an HTTPS website that tells the browser “what extension this is” and “where to download the latest package.” One line in Intune will point to this XML URL. |
| Extension ID | A fixed 32-character ID for Rockfort Orion. It must be exactly the same in every policy where the browser asks for an extension ID. Rockfort will give you this ID for the build you deploy. |
| HTTPS hosting | Your update XML and extension file are served over HTTPS from a server your organization allows (firewall, proxy, TLS). |
You will typically add three browser policies (names below are the Chrome policy IDs; Edge has equivalents in the Microsoft Edge admin templates or settings catalog).
In Intune (typical path): Devices → Windows → Configuration profiles → Create → Settings catalog or Templates → Administrative Templates and find using below three keywords
Policy : ExtensionInstallForcelist
User-visible outcome: The browser installs Orion and reenforces it if removed.
Value to enter (one line, example shape):
<extension_id_from_rockfort>;https://your-https-host/path/to/orion_update.xml
For Edge, use the profile section for Microsoft Edge and the same idea: Extension install force list.
Policy : ExtensionInstallSources
User-visible outcome: Without this, the browser often blocks the install because your package is not from the Chrome Web Store.
Example value:
https://your-https-host/*
Use the same host (or hosts) where the update XML and .crx live. Follow Google’s pattern rules for wildcards.
In Intune: Same configuration profile as above → Extension install sources.
Policy : ExtensionInstallAllowlist
User-visible outcome: On strict setups where only approved extensions may run, Orion is explicitly approved.
Example value (ID only—not a URL):
<extension_id_from_rockfort>
Use the same Extension ID as in the force-install line.
In Intune: Extension allow list / ExtensionInstallAllowlist (again, Edge has its own parallel setting).
User-visible outcome: Employees see the Orion icon on the toolbar (pinned / forced visible) without hunting in the puzzle menu.
Policy : ExtensionSettings
Enter a JSON object as the policy value
Sample JSON — replace the extension ID with the ID for your Rockfort Orion build, and replace update_url with your real HTTPS update manifest (same URL story as in Extension install force list):
{
"<extension_id_from_rockfort>": {
"installation_mode": "force_installed",
"update_url": "https:///your-https-host/path/to/orion_update.xml",
"override_update_url": true,
"toolbar_state": "force_shown"
}
}
| Field | Purpose |
|---|---|
installation_mode |
force_installed — browser installs and maintains the extension like a managed mandatory app. |
update_url |
HTTPS URL of your update.xml (autoupdate manifest). |
override_update_url |
When true, this policy URL wins over the update_url embedded in the extension package (useful if packaging and policy must stay aligned). |
toolbar_state |
force_shown — pins the extension so it stays visible on the toolbar. |
Consistency: Use the same extension ID and same update XML URL here as in Extension install force list (section 1) so users do not get conflicting instructions. Extension install sources and allow list (sections 2–3) should still allow your HTTPS host and extension ID.
Practical tip: Ship force install + install sources + allow list first, confirm Orion installs; then add
ExtensionSettingswithtoolbar_state(and the rest if you consolidate policy) in a second revision.
If your org uses a blocklist or “only store + allow list” mode, double-check that Rockfort Orion’s ID is on the allow list and not blocked by a wildcard rule. User impact: extension missing or disabled with little explanation until policy is fixed.
chrome://policy and confirm:
id;https://.../….xmledge://policy the same way.chrome://extensions → Rockfort Orion should appear and show as managed.| Step | Done? |
|---|---|
| Force-install list contains correct Extension ID + HTTPS update XML URL | ☐ |
| Install sources allow the HTTPS host serving files | ☐ |
| Allow list includes Orion’s ID (if your org requires allow lists) | ☐ |
| Profile assigned to pilot devices | ☐ |
chrome://policy / edge://policy shows values on a test machine |
☐ |
chrome://extensions: Orion present and managed |
☐ |
Optional: ExtensionSettings JSON (force shown / pin + optional update_url) |
☐ |