Install the extension

Put Safe-Desk in every browser, without anyone clicking Add.

The Safe-Desk extension runs in Chrome and Edge. Force-installing it means staff can't remove or turn it off. It still does nothing until each person signs it in with their own Safe-Desk account.

Available after launch The owner's setup console will carry an install kit with the extension ID, the policy values and a PowerShell line already filled in for your firm, and an IT admin role so you can reach it with your own account.

What gets installed

Chrome 116 or later, or Microsoft Edge, which runs Chrome Web Store extensions. Version 1.1.0 at the time of writing. The extension talks to one server, desk.sophiaxt.com, loads no remote code, and has no analytics.

Sites it protects

On these pages it checks pasted text and every outgoing message, and it stops file uploads by default. Other sites are untouched.

Permissions it asks for

Its page scripts run only on the sites in the table above.

Google Admin console (Chrome)

For firms that manage Chrome with Google Workspace or Chrome Enterprise Core. It applies to people signed in with a managed Google account and to enrolled browsers.

1. Sign in to the Google Admin console with an administrator account.
2. Go to Menu, Devices, Chrome, Apps & extensions. With Chrome Enterprise Core alone it is Menu, Chrome browser, Apps & extensions.
3. Choose Users & browsers at the top, and pick the organizational unit or group on the left.
4. Press the add button (+), choose Add Chrome app or extension by ID, and enter {{EXTENSION_ID}} from the Chrome Web Store. Available after launch
5. Click Safe-Desk in the list. In the right panel, under Installation policy, choose Force install. Pinning it to the toolbar is worth doing, so staff can see its status.
6. Click Save.

Source: Google, View and configure apps and extensions, checked 2026-09-23. Google's page states that users can't remove force-installed items.

Microsoft Intune

Edge, with the Settings catalog

1. In the Intune admin center, go to Devices, Configuration, Create, New policy.
2. Platform: Windows 10 and later. Profile type: Settings catalog. Create.
3. Name it, for example "Safe-Desk extension", then Next.
4. Add settings, search for ExtensionInstallForcelist ("Control which extensions are installed silently", under Microsoft Edge, Extensions) and enable it.
5. Add one entry: {{EXTENSION_ID}};https://clients2.google.com/service/update2/crx Available after launch
6. Assign it to the device or user group, then Review + create.

Chrome

Google notes that the Intune Settings catalog carries only a basic set of Chrome settings. The route Google documents is to import Chrome's administrative templates:

1. Download the Chrome policy templates from Google (the Chrome Enterprise bundle).
2. In Intune, import google.admx and google.adml first, then GoogleUpdate.admx and .adml, then chrome.admx and chrome.adml. Google says the first pair must go in first.
3. Create a profile: Devices, Windows, Configuration profiles, Create profile. Platform Windows 10 and later, profile type Templates, Imported Administrative templates.
4. Under Google, Google Chrome, Extensions, enable "Configure the list of force-installed apps and extensions" and add the same entry as for Edge.
5. Assign and create.

If your tenant's Settings catalog does list Chrome's force-install setting, it takes the same value.

Sources: Microsoft, Configure Microsoft Edge policy settings for Windows using Microsoft Intune; Google, Manage Chrome browser with Microsoft Intune. Both checked 2026-09-23. Intune moves its menus from time to time; if a name differs, search the Settings catalog for the policy name.

Group Policy and the registry

With the Chrome or Edge administrative templates installed, the policies are at:

• Chrome: Computer Configuration, Administrative Templates, Google, Google Chrome, Extensions, "Configure the list of force-installed apps and extensions".
• Edge: Computer Configuration, Administrative Templates, Microsoft Edge, Extensions, "Control which extensions are installed silently".

Both are the ExtensionInstallForcelist policy. Each entry is the 32-letter extension ID, a semicolon, and the update address. Safe-Desk is published on the Chrome Web Store, so both browsers use the Chrome Web Store update address. The same values written straight to the registry:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="{{EXTENSION_ID}};https://clients2.google.com/service/update2/crx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist]
"1"="{{EXTENSION_ID}};https://clients2.google.com/service/update2/crx"

If a machine already has force-installed extensions, value 1 is taken; use the next free number, or the script below, which does that for you. Don't import a .reg file over a list you haven't read.

Sources: Chromium's definition of ExtensionInstallForcelist and Google's policy page; Microsoft, ExtensionInstallForcelist for Edge and the ExtensionSettings guide, which gives the Chrome Web Store update address for Edge. All checked 2026-09-23.

PowerShell for RMM tools

For NinjaOne, Datto, ConnectWise, Intune scripts or anything else that runs a script as SYSTEM. It is safe to run again and again: it adds Safe-Desk only if it isn't there, takes the next free number, never changes or removes anyone else's entry, and -Uninstall removes only Safe-Desk's own entries.

# Safe-Desk: force-install (or remove) the browser extension in Chrome and Edge.
# Run as SYSTEM or an administrator. Examples:
#   .\safe-desk-extension.ps1                    # Chrome and Edge
#   .\safe-desk-extension.ps1 -Browser Chrome
#   .\safe-desk-extension.ps1 -Uninstall
param(
  [ValidateSet("Chrome", "Edge", "Both")] [string] $Browser = "Both",
  [switch] $Uninstall
)
$ErrorActionPreference = "Stop"
$ExtensionId = "{{EXTENSION_ID}}"
$UpdateUrl = "https://clients2.google.com/service/update2/crx"
if ($ExtensionId -notmatch '^[a-p]{32}$') { throw "Set ExtensionId to Safe-Desk's 32-letter extension ID first." }

$keys = @()
if ($Browser -ne "Edge")   { $keys += "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist" }
if ($Browser -ne "Chrome") { $keys += "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist" }

foreach ($key in $keys) {
  if (-not (Test-Path $key)) {
    if ($Uninstall) { Write-Output "$key : nothing to remove"; continue }
    New-Item -Path $key -Force | Out-Null
  }
  $item = Get-Item -Path $key
  # Our entries: any value whose ID part is Safe-Desk's, whatever number it sits under.
  $ours = @($item.GetValueNames() | Where-Object { ([string]$item.GetValue($_)).Split(";")[0].Trim() -eq $ExtensionId })
  if ($Uninstall) {
    foreach ($name in $ours) { Remove-ItemProperty -Path $key -Name $name }
    Write-Output "$key : removed $($ours.Count) value(s)"
    continue
  }
  if ($ours.Count -gt 0) { Write-Output "$key : already present as value $($ours -join ', ')"; continue }
  $used = @($item.GetValueNames() | Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ })
  $next = 1
  while ($used -contains $next) { $next++ }
  New-ItemProperty -Path $key -Name "$next" -PropertyType String -Value "$ExtensionId;$UpdateUrl" | Out-Null
  Write-Output "$key : added as value $next"
}

The browsers read policy changes on their own within a short while. To see it at once, open chrome://policy or edge://policy and choose Reload policies. When a Safe-Desk entry is removed from the list, the browser uninstalls the extension.

Mac configuration profile

Chrome reads policy from the com.google.Chrome preference domain and Edge from com.microsoft.Edge. This profile sets ExtensionInstallForcelist for both. Replace each GENERATE-A-UUID with the output of uuidgen (four different values), then deploy it through your MDM. In Intune you can instead use a Preference file profile per browser with only the key and its array; Jamf takes it as a Custom Settings payload.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadDisplayName</key><string>Safe-Desk browser extension</string>
  <key>PayloadIdentifier</key><string>com.sophiaxt.safedesk.extension</string>
  <key>PayloadType</key><string>Configuration</string>
  <key>PayloadUUID</key><string>GENERATE-A-UUID-1</string>
  <key>PayloadVersion</key><integer>1</integer>
  <key>PayloadScope</key><string>System</string>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key><string>com.google.Chrome</string>
      <key>PayloadIdentifier</key><string>com.sophiaxt.safedesk.extension.chrome</string>
      <key>PayloadUUID</key><string>GENERATE-A-UUID-2</string>
      <key>PayloadVersion</key><integer>1</integer>
      <key>ExtensionInstallForcelist</key>
      <array><string>{{EXTENSION_ID}};https://clients2.google.com/service/update2/crx</string></array>
    </dict>
    <dict>
      <key>PayloadType</key><string>com.microsoft.Edge</string>
      <key>PayloadIdentifier</key><string>com.sophiaxt.safedesk.extension.edge</string>
      <key>PayloadUUID</key><string>GENERATE-A-UUID-3</string>
      <key>PayloadVersion</key><integer>1</integer>
      <key>ExtensionInstallForcelist</key>
      <array><string>{{EXTENSION_ID}};https://clients2.google.com/service/update2/crx</string></array>
    </dict>
  </array>
</dict>
</plist>

The fourth UUID is spare, for when you add Safe-Desk to an existing profile instead. Removing the profile removes the extension.

Sources: Google, Set Chrome browser policies on managed Macs; Microsoft, Configure Microsoft Edge for macOS using a property list. Both checked 2026-09-23.

What staff will see

• The browser says it is managed by your organization, in its menu and on its settings pages. That wording comes from Chrome and Edge, not from Safe-Desk.
• On the extensions page, Safe-Desk shows as installed by an administrator, with no Remove button and the on switch locked.
• Until the person signs in, the Safe-Desk icon shows OFF and a notice at the bottom left of each protected chat page says Safe-Desk is not checking messages there. Pages work as they normally would.
• Once signed in, a small "2 protected" style mark by the chat box shows when placeholders went in, and a notice explains anything that was stopped.

How sign-in works after install

Force-installing puts the extension in the browser. It does not sign anyone in, and there is no policy that signs staff in for them: each person signs in with their own account, which is what ties the log and their own real values to them.

• Sign in with Safe-Desk. Available after launch The person clicks the Safe-Desk icon and Sign in with Safe-Desk. A Safe-Desk window opens; they sign in (or are already signed in), check that the page names the Safe-Desk extension and their own account, and choose Allow. The extension receives a device credential for that browser. It is an OAuth code flow with PKCE, run in the browser's own sign-in window.
• Connection code. In Safe-Desk, Settings, Get a connection code gives an 8-character code that works once, for 10 minutes. The person types it into the extension popup and presses Connect. This works today.

The browser then appears under Connected browsers in that person's Settings, where they or you (signed in as them) can disconnect it. Disabling a staff member in the Staff tab signs out their browsers the next time the extension checks in with Safe-Desk, which happens on their next paste or send.

Available after launch A signed-in extension sends a heartbeat every 30 minutes with only its version, the kind of device, the sites it covers and whether the person paused it. Never a page, text or history. The owner's coverage view shows each person's devices and when each last checked in, and the owner gets an alert, at most once a day per person, when a device is paused, signed out, or silent for more than a working day.