Deploy Browser Extensions via Kandji

This guide shows you how to create a Custom Profile in Kandji to force-install the Anzenna browser extension on managed Mac computers. Kandji uses Apple's standard .mobileconfig format, so the same XML payload structure works for both Chrome and Edge — you just need separate profiles for each browser.

Prerequisites

Kandji admin access with permission to create Library Items
Target computers assigned to a Kandji Blueprint
Google Chrome or Microsoft Edge installed on target devices
Custom installation URL from Anzenna support

Required Step

Before beginning deployment, contact Anzenna support to obtain a custom installation URL for your domain. This link is essential for the configuration process.

Overview

Kandji delivers browser extension policies as Custom Profiles (Library Items). You provide a .mobileconfig file containing the ExtensionInstallForcelist key for your target browser. Kandji pushes it to all computers in the assigned Blueprint automatically.

Works for both Chrome and Edge — use a separate Custom Profile for each browser
The extension installs silently; users cannot remove it
Profiles apply on the next Kandji agent check-in

Step-by-Step Instructions

1. Create the .mobileconfig File

Copy the appropriate XML template below into a text editor, replace the placeholder with the Anzenna-supplied installation link, and save the file with a .mobileconfig extension.

The link format includes:

Extension ID
Update URL
Configuration parameters

Example format (use your actual link from support):

<extension-id>;https://anzenna.ai/update-url

2. XML Template for Microsoft Edge

Save the file as edge_extension_policy.mobileconfig.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
      <dict>
          <key>ExtensionInstallForcelist</key>
          <array>
              <string>PASTE_ANZENNA_INSTALLATION_STRING_HERE</string>
          </array>
          <key>PayloadDisplayName</key>
          <string>Microsoft Edge</string>
          <key>PayloadIdentifier</key>
          <string>com.microsoft.Edge.GENERATE-UUID-2-HERE</string>
          <key>PayloadType</key>
          <string>com.microsoft.Edge</string>
          <key>PayloadUUID</key>
          <string>GENERATE-UUID-2-HERE</string>
          <key>PayloadVersion</key>
          <integer>1</integer>
      </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>Anzenna Extension - Edge</string>
  <key>PayloadIdentifier</key>
  <string>anzenna.GENERATE-UUID-1-HERE</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>GENERATE-UUID-1-HERE</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

3. XML Template for Google Chrome

Save the file as chrome_extension_policy.mobileconfig. Note the PayloadType is set to com.google.Chrome.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
      <dict>
          <key>ExtensionInstallForcelist</key>
          <array>
              <string>PASTE_ANZENNA_INSTALLATION_STRING_HERE</string>
          </array>
          <key>PayloadDisplayName</key>
          <string>Google Chrome</string>
          <key>PayloadIdentifier</key>
          <string>com.google.Chrome.GENERATE-UUID-2-HERE</string>
          <key>PayloadType</key>
          <string>com.google.Chrome</string>
          <key>PayloadUUID</key>
          <string>GENERATE-UUID-2-HERE</string>
          <key>PayloadVersion</key>
          <integer>1</integer>
      </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>Anzenna Extension - Chrome</string>
  <key>PayloadIdentifier</key>
  <string>anzenna.GENERATE-UUID-1-HERE</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>GENERATE-UUID-1-HERE</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

4. Generate UUIDs and Replace Placeholders

Before saving your file, generate unique UUIDs to replace the placeholders:

macOS: Run uuidgen in Terminal
Windows: Run [guid]::NewGuid().ToString().ToUpper() in PowerShell
Online: Visit uuidgenerator.net

Each .mobileconfig file requires two unique UUIDs:

UUID-1: Identifies the root Configuration Profile (the PayloadUUID in the outer dict)
UUID-2: Identifies the inner browser extension payload (the PayloadUUID in the nested dict)

If you deploy both Chrome and Edge, you need 4 unique UUIDs total — 2 per profile. Never reuse UUIDs across multiple profiles, as this can cause one profile to silently overwrite another.

5. Create a Custom Profile in Kandji

Log in to your Kandji instance
Navigate to Library in the left sidebar
Click the Add new button in the top-right corner, then select Custom Profile from the options
Set the Name to something descriptive, e.g. "Edge - Force Install - Anzenna" or "Chrome - Force Install - Anzenna"
Click Upload File and select your .mobileconfig file, then click Save
After the Library Item is created, open it and assign it to the appropriate Blueprints so Kandji knows which devices to target

Deployment Timeline

Kandji pushes the profile to enrolled Macs on the next agent check-in. You can trigger an immediate check-in from the Kandji dashboard by selecting the device and clicking Run All under Library Items.

Deploying to Both Browsers

If deploying to both Chrome and Edge, repeat step 5 for each .mobileconfig file. Each browser requires its own Custom Profile.

Verifying Deployment

Check Profile Status in Kandji

Navigate to Devices in Kandji
Select a target device and open the Library Items tab
Locate your Custom Profile and confirm the status shows as Pass

Verify on End-User Device (macOS Ventura and later)

Go to System Settings > General > Device Management
Click the profile named after your Blueprint (e.g., "Corporate Standard")
Inside the Blueprint view, look for the item matching your PayloadDisplayName (e.g., "Anzenna Extension - Chrome")
Double-click that item to confirm the extension ID and update URL are being enforced

Verify in the Browser

For Edge:

Open Edge and navigate to:
```
edge://extensions
```
The Anzenna extension will appear with a briefcase icon, indicating it is managed by your organization. The user cannot toggle it off or remove it.
Navigate to edge://policy and confirm ExtensionInstallForcelist is listed under the Microsoft Edge section

For Chrome:

Open Chrome and navigate to:
```
chrome://extensions
```
The Anzenna extension will appear with a briefcase icon
Navigate to chrome://policy and search for ExtensionInstallForcelist to confirm the extension ID is present

Troubleshooting

Incorrect Installation String Format

The policy applies but the extension does not install:

Verify the string is exactly extension-id;update-url — no extra spaces, line breaks, or characters
The update URL must be a direct link to an XML manifest file, not a browser Web Store landing page

Wrong Browser Targeted

Profile applies but the extension does not appear in the expected browser:

Chrome requires PayloadType: com.google.Chrome
Edge requires PayloadType: com.microsoft.Edge
These values must also match in PayloadIdentifier. Update the XML, re-upload the file in Kandji, and re-save the Library Item.

Profile Not Appearing on Device

The Custom Profile is not showing up under Device Management:

Confirm the device is assigned to the correct Blueprint
Trigger a manual agent check-in from the Kandji dashboard
Review the device's Library Item history in Kandji for error messages

Duplicate or Invalid UUIDs

Profile fails to install or silently overwrites another profile:

Each .mobileconfig file requires two unique UUIDs — one for the configuration profile, one for the payload
If you copy a template and forget to regenerate UUIDs, the new profile may overwrite the previous one
Generate fresh UUIDs for every profile using uuidgen (macOS) or [guid]::NewGuid() (PowerShell)
Verify UUIDs are uppercase and properly formatted (e.g., A1B2C3D4-E5F6-7890-ABCD-EF1234567890)

Need help? Contact

Anzenna Support

for assistance.

Prerequisites​

Overview​

Step-by-Step Instructions​

1. Create the .mobileconfig File​

2. XML Template for Microsoft Edge​

3. XML Template for Google Chrome​

4. Generate UUIDs and Replace Placeholders​

5. Create a Custom Profile in Kandji​

Verifying Deployment​

Check Profile Status in Kandji​

Verify on End-User Device (macOS Ventura and later)​

Verify in the Browser​

Troubleshooting​

Incorrect Installation String Format​

Wrong Browser Targeted​

Profile Not Appearing on Device​

Duplicate or Invalid UUIDs​

Related Resources​