Chrome Browser Cloud Management

Deploy InvestigAItor to any device without domain join, GPO, or MDM. Chrome Browser Cloud Management (CBCM) lets you manage Chrome browsers from a web console, including force-installing extensions on standalone Windows, Mac, and Linux machines.

What is CBCM?

Chrome Browser Cloud Management is a free service from Google that lets you manage Chrome browsers from the Google Admin console. Once a browser is enrolled, you can push policies, force-install extensions, and configure settings remotely. No Active Directory, no GPO, no MDM required.

Prerequisites

• A Google Workspace or Cloud Identity account (free tier works)
• Chrome Browser Cloud Management enabled in the Google Admin console
• Chrome installed on target devices
• Your Enrollment Key from the InvestigAItor admin dashboard (Settings → General)

Step 1: Set up Chrome Browser Cloud Management

1. Go to admin.google.com
2. Navigate to Devices → Chrome → Managed browsers
3. If not already enabled, follow the prompts to enable Chrome Browser Cloud Management
4. Generate an enrollment token (this is Google's enrollment token, separate from InvestigAItor's)

Step 2: Enroll browsers

Each target device needs to enroll its Chrome browser once. There are two ways:

Option A: User self-enrollment

1. Send the user the CBCM enrollment token
2. The user opens Chrome → Settings → Managed browser
3. Enters the enrollment token
4. Chrome is now managed and appears in your Admin console

Option B: Installer with enrollment

1. Download the Chrome Enterprise installer from chromeenterprise.google
2. Deploy with the enrollment token baked in (see Google's CBCM enrollment guide)
3. Chrome enrolls automatically on first launch

Step 3: Force-install InvestigAItor

1. In the Google Admin console, go to Devices → Chrome → Apps & extensions → Managed browsers
2. Select the OU containing your enrolled browsers
3. Click + → Add from URL
4. Enter the update URL: https://investigaitor.org/extension-update.xml
5. Set installation policy to Force install

Or use the extension ID directly:

1. Click + → Add Chrome app or extension by ID
2. Enter: ncibbcpcjhieaffkncaeemcfihlhkcdg
3. Set the update URL to: https://investigaitor.org/extension-update.xml
4. Set installation policy to Force install

Step 4: Push managed configuration

In the same extension settings, scroll to Policy for extensions and add the following JSON:

{
  "setupToken": {
    "Value": "YOUR_SETUP_TOKEN"
  },
  "deviceName": {
    "Value": "$\{MACHINE_NAME\}"
  }
}

Replace YOUR_SETUP_TOKEN with the setup token from your admin dashboard (Settings → General).

The username is automatically detected from the Chrome profile. If the user is signed into Chrome with their work Google account, their email is used as the username.

Step 5: Configure Incognito and Guest mode

In the Admin console under Devices → Chrome → Settings → Managed browsers:

• Set Incognito mode to Allow extension in Incognito for InvestigAItor
• Set Guest mode to Disabled to prevent bypass

Step 6: Verify

• On an enrolled device, open chrome://policy and confirm ExtensionInstallForcelist shows the InvestigAItor entry
• Open chrome://extensions and confirm InvestigAItor is listed as Installed by enterprise policy
• Check the InvestigAItor dashboard for the device

Why CBCM?

Having issues? See the Troubleshooting page.