Skip to content
Avanet
My account
My account

Loading …
Customer portal Account settings

Install and remove the Sophos Protected Browser extension

Sophos Workspace Protection

The Sophos Protected Browser extension can be installed manually on individual Windows and Mac devices or centrally via Active Directory GPO, Google Enterprise Core, Microsoft Intune and Jamf Pro. The appropriate installer is obtained from Sophos Fusion (formerly Sophos Central). For Chrome, check both the enforced policy and the visible extension afterwards.

This guide covers the extension for existing browsers. Deploying and updating the full Sophos Protected Browser is a separate task.

Choose the appropriate deployment method

  • Manual: for a small pilot or individual Windows and Mac devices. This method also includes the rollback steps documented by Sophos.
  • Active Directory GPO: for domain-joined Windows devices with Google Chrome.
  • Google Enterprise Core: for registered Chrome browsers on Windows and macOS.
  • Microsoft Intune: for managed Windows and Mac devices with Google Chrome or Microsoft Edge.
  • Jamf Pro: for managed Macs with Google Chrome or Microsoft Edge.

Start with a few devices and exactly the browser that will be used later. The ZIP files contain policy, profile, script and utility files depending on the deployment path. Do not mix files from different deployment paths.

Requirements, licence and roles

Before downloading, My Products > Protected Browser and the area Browser extension under My Environment > Installers or My Environment > Installers > Protected Browser must be available in the correct Sophos Central tenant. No separate licence designation is specified for these procedures. Therefore, do not infer any further licence or role assumptions from the visibility of a menu. The required roles differ depending on the procedure:

  • Manual on Windows: The Windows device is enrolled in an MDM solution; administrator access to the Windows device and Sophos Fusion is required. This method supports Google Chrome, Comet, and Microsoft Edge; the downloaded ZIP file also includes Atlas.
  • Manual on macOS: The Mac is enrolled in an MDM solution; administrator access to both the Mac and Sophos Fusion is required. Sophos lists Google Chrome, Atlas, Comet and Microsoft Edge as supported browsers, however the current download package may only include profiles for Chrome, Atlas and Edge. If the profiles for Comet are missing in the current package, profiles for another browser must not be used. Download the package again and clarify the missing Comet files with Sophos Support before proceeding. Existing MDM configurations for ExtensionForceinstallList must be removed before manual installation: macOS does not merge a managed and a locally installed profile, it only applies one of them.
  • Active Directory GPO: Required are an AD administrator account for the Group Policy Editor, a Sophos Fusion admin account, local administrator rights on the target devices, the Chrome ADMX template, and permission to install extensions from external sources. The GPO is already linked to the target OU. An SMB share is available for the extension, which domain computers can access in read-only mode.
  • Google Enterprise Core: The Chrome browsers are registered and assigned to the designated organisational unit. Administrator access to target devices, the Google Admin console and Sophos Fusion is required.
  • Microsoft Intune: An account for Intune and Sophos Fusion is required, as well as administrator access to the target devices. Chrome and Edge may install extensions from external sources.
  • Jamf Pro: A Jamf Pro admin account, a Sophos Fusion admin account and administrator access to the target devices are required. Chrome and Edge may install extensions from external sources.

The additional extension utility is only necessary if device posture policy objects are to be used in web policies. It is called ExtensionUtility.exe on Windows and ExtensionUtility.pkg on macOS. Do not install this additional component as a precaution if you do not use the feature.

Download installation files in Sophos Fusion

Depending on the distribution method, Sophos refers to this step as Download installation files from Sophos Central or Download the installer from Sophos Central. In both cases, it refers to the ZIP package associated with the chosen procedure.

  1. In Sophos Central, open My Environment > Installers. In the manual method and for Google Enterprise Core, Sophos specifies the more precise path as My Environment > Installers > Protected Browser.
  2. Under Browser extension, select the intended path and the operating system:
    • Manual > Windows or Manual > Mac
    • Active Directory (GPO) > Windows
    • Google Enterprise with the appropriate operating system
    • Microsoft Intune with the appropriate operating system
    • JAMF > Mac.
  3. Unpack the downloaded ZIP file into a controlled working folder. Use only the files and values contained therein for the pilot.

For GPO and Intune, the extension URL from this package is required. Google Enterprise Core requires the extension ID, extension URL and ExtensionSettings.json. Jamf and the manual Mac method use browser-dependent .mobileconfig files. In the manual Mac method, the package must include profiles belonging to the intended browser. If Comet profiles are missing, this is a stop condition and not a reason to rename or reuse Chrome, Atlas or Edge profiles.

Install extension manually

Install the extension on Windows devices

  1. Open the unpacked folder on the target device.
  2. Double-click on the browser installation file. For Chrome, this is ChromeForceInstallExtension.reg; confirm Run and Yes. This will write the extension details into the Windows registry.
  3. Double-click on the file with the extension settings. For Chrome, this is ChromeExtensionSettings.reg; confirm again Run and Yes.
  4. Only if device posture policy objects are required: start ExtensionUtility.exe and confirm Yes.

After setup, the extension prompts the user to log in with their credentials.

Install the extension on Mac devices

Important: Before this step, check whether ExtensionForceinstallList is already managed via MDM. Remove this MDM configuration first. Without this cleanup, macOS may continue to apply only the managed profile instead of the local profiles.

  1. Double-click the browser’s force install file in the unzipped folder, for Chrome for example ChromeForceInstallExtension.mobileconfig.
  2. Open System Settings, search for Profiles and install the downloaded profile. For Chrome, the sample profile is called Install Island Extension Chrome. Confirm Install with the administrator password.
  3. Double-click on the file with the extension settings, for Chrome for example ChromeExtensionSettings.mobileconfig.
  4. Install the configuration profile under Profiles > Downloaded. The Chrome example is called Setup Island Extension on Chrome.
  5. Only if device posture policy objects are required: start ExtensionUtility.pkg, click on Continue and Install and enter the administrator password.

After completion, the extension prompts the user to log in.

Deploy the extension centrally

Configure Group Policy Object for installing the extension

  1. Open the prepared GPO and go to Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions.
  2. Open Configure the list of force-installed apps and extensions, select Enabled and click on Show under Options.
  3. Under Show contents, paste the extension URL copied from Sophos Fusion. Confirm and save the setting.
  4. Copy the contents of the downloaded ChromeExtensionSettings.xml.
  5. In the same GPO, go to Computer Configuration > Preferences > Windows Settings > Registry. Right-click on Registry, paste the XML content, name the registry entry, and save it.

Install the extension utility: The browser extension can be deployed using the above GPO settings. For the optional ExtensionUtility.exe, Sophos additionally describes a startup script via Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup and an SMB share. However, the verification path used is not clearly described as a local installation indicator. Therefore, do not use the script as an executable template. If device posture policy objects require the utility, stop at this point and have Sophos Support or an approved, tested internal packaging process confirm the verification path, execution context, and pre- and post-installation checks for your environment. The extension policy can be validated initially on a pilot OU regardless.

Google Enterprise Core

For the step Install the Protected Browser extension on your devices, the extension ID, custom URL and settings file are stored together in the Google Admin console:

  1. Open Chrome browser > Apps & extensions > Users & browsers in the Google Admin console and select the intended organisational unit.
  2. Click the plus symbol at the bottom right and then on Add Chrome app or extension by ID.
  3. Enter the Extension ID copied from Sophos Fusion.
  4. Select From a custom URL and enter the copied extension URL. Save.
  5. Under Installation policy, first select Allow install and then Force install.
  6. Open Policy for extensions, upload ExtensionSettings.json from the Sophos ZIP file and save again.
  7. Install ExtensionUtility.exe or ExtensionUtility.pkg on the target devices only if web policies use device posture policy objects.

The organisational unit determines the scope. For the pilot, therefore, choose a limited OU with few registered browsers rather than enforcing the setting tenant-wide immediately.

Configure Microsoft Intune to install the extension

Windows

  1. In the Microsoft Intune Admin Center, go to Devices > Windows > Configuration profiles > Create > New policy.
  2. Select Windows 10 and later as the platform and Settings catalog as the profile type. Create and name the profile.
  3. Under Configuration settings, click on Add settings.
  4. For Chrome, open Google > Google Chrome > Extensions, enable Configure the list of force-installed apps and extensions and enter the extension URL from Sophos Central. For Edge, use Microsoft Edge > Extensions accordingly.
  5. Confirm with OK and Apply.
  6. Go to Devices > Windows > PowerShell scripts and upload the script obtained from Sophos Central for the browser, for Chrome for example ChromeExtensions.ps1.
  7. Under Assignments, first select only the pilot devices. Check Review + create and click on Create.

macOS

  1. Go to Devices > macOS > Configuration profiles and click on Create Profile.
  2. Select Templates, then Custom and Create. Name the profile and select Device channel as the deployment channel.
  3. Upload the Force installation file from the Sophos ZIP file under Configuration profile file, for example ChromeForceInstallExtension.mobileconfig for Chrome.
  4. First assign the profile to the pilot devices and create it.
  5. Repeat the process with a second profile for the extension settings, in Chrome with ChromeExtensionSettings.mobileconfig.

If device posture policy objects are required, also run the ExtensionUtility.exe or ExtensionUtility.pkg installer included in the package on the devices where the extension is installed.

Jamf Pro

The Jamf process here includes the two configuration profiles:

  1. Create a configuration profile for the force installation settings. Open Computers > Configuration Profiles, click on Upload and upload the force install file: ChromeForceInstallExtension.mobileconfig or EdgeForceInstallExtension.mobileconfig.
  2. Assign a name and description, select Browser as category, Computer level as level, and Install automatically as distribution method. Initially limit to the pilot devices under Scope and save.
  3. Create a configuration profile for the custom extension settings: Repeat the process for ChromeExtensionSettings.mobileconfig or EdgeExtensionSettings.mobileconfig.

If the web policies also require the optional ExtensionUtility.pkg, stop after these two configuration profiles. Set packaging, policy, triggers and rollback in a separate, approved and tested Jamf procedure; do not adopt the Intune or manual installation steps for this. The two browser profiles can initially be tested on the pilot devices without this additional component.

Validate installation

For a Chrome deployment with GPO or Google Enterprise Core the check is straightforward:

  1. Open Chrome on a pilot device.
  2. Call chrome://policy and click on Reload policies.
  3. Check in Chrome Policies whether ExtensionInstallForcelist exists and has the status OK.
  4. Call chrome://extensions and check if the Protected Browser extension is visible. The message Sophos extension is installed and managed by the organization. may be displayed.

In a manual installation, the login prompt is also an expected outcome. For Intune and Jamf, there is no equivalent, accurate status display available. The rollout therefore remains limited to the pilot until the intended profiles or scripts have reached the device and the expected browser result is visible. A successful assignment in the management console alone does not prove the local installation.

If the extension programme is required, check separately whether its installer has completed on the pilot device. Do not assume that the utility is also installed just because a browser extension is visible.

Troubleshooting by symptom

ExtensionInstallForcelist is missing or does not have the status OK

First, check whether the device is really in the assigned OU or pilot group. Then verify that exactly the extension URL from the current Sophos package has been entered. For GPO, this includes the installed Chrome ADMX template, the GPO link, and the registry entries imported from ChromeExtensionSettings.xml. Afterwards, reload the policies in chrome://policy and repeat the check.

The policy is present, but the extension is not visible

Open chrome://extensions and check there again. For Google Enterprise Core, in addition to the ID and custom URL, Force install as well as the uploaded ExtensionSettings.json must be present. For GPO, Configure the list of force-installed apps and extensions must be enabled. Do not change multiple levels at the same time; first correct the missing part on a pilot device and validate again.

The manual installation on the Mac does not work

Check whether ExtensionForceinstallList is already managed by MDM. Remove the managed configuration before the local profile. Then check under System Settings > Profiles > Downloaded if both the Force-Install profile and the profile with the extension settings have been installed. macOS does not merge these local profiles with a conflicting MDM configuration.

The extension is visible, but device posture objects do not work

The browser extension and the extension programme are two separate components. Check whether ExtensionUtility.exe or ExtensionUtility.pkg has been installed on this specific device. For GPO, read access of the computer account to the designated SMB share alone is not sufficient: use the startup script only when the verification path, execution context and pre-/post-checks are approved and tested. For Jamf, packaging, policy, trigger and rollback must also be defined in a separate, approved and tested procedure. Then check again on the same pilot device before expanding the scope.

A central rollout cannot be reliably rolled back

Do not extend the assignment and leave the pilot group unchanged. Do not attempt any local partial uninstallation while a central force-install policy is active. The mandatory limits and further procedures for centrally managed uninstallations are outlined in the following offboarding section.

Uninstall extension and complete offboarding

Document the browser, installation path and existing profiles or registry files before the rollback. Users will then lose the functionality provided by the extension. Therefore, start the rollback on a test device and check it before a wide-scale removal.

Manual on Windows

  1. Use the uninstall folder from the same Sophos ZIP file as for the installation.
  2. Double-click on ExtensionUninstaller.reg to remove the extension.
  3. If the extension programme has been installed, open PowerShell with the required administrator rights and execute the command documented by Sophos.
powershell.exe -Command "& { msiexec /q /x $((New-Object -ComObject 'WindowsInstaller.Installer').RelatedProducts('{B0D532EB-39A8-497B-8DD8-6A3ACCE97532}')); }"

Then open the browser on the test device and check that the extension is no longer displayed. If it is still present, stop the broad rollback and check whether a GPO, Intune, or other MDM policy is enforcing it again.

Manual under macOS

  1. Open System Settings and search for Profiles.
  2. Remove both the force-install profile and the profile with the custom extension settings. Confirm each with the administrator password.
  3. If ExtensionUtility.pkg has been installed, open a terminal with an administrator account and run the uninstaller documented by Sophos.
sudo /usr/local/island/island-nmh/uninstall

Then check on the test device that both profiles have been removed and that the extension no longer appears in the browser. If a profile is still assigned via MDM, stop the local removal and first remove the managed assignment through the responsible MDM process.

For Google Enterprise Core, Intune and Jamf Pro, establish a complete uninstallation procedure for the deployment method in use before rollout. While the GPO method does include steps for rollback, there is no comprehensive procedure for the joint removal of assignment, registry entries, Force-Install policy and, if applicable, the utility. Allow Sophos Support or an internally approved and tested process to determine the rollback based on the profiles, policies and packages actually created. Until then, do not expand the assignment and keep the pilot group unchanged. Do not remove local files or individual profiles, registry entries, policies or the utility on suspicion while a central Force-Install policy is active.

Operations and lifecycle

Do not keep an old unpacked ZIP file as a supposed reference installation permanently. Download the files again via the Sophos Fusion path intended for the chosen method before any planned changes and record which file was distributed to which pilot group. After changes in GPO, OU assignment, Intune profiles or Jamf scope, check the policy and extension again on a pilot device.

Regular operational checks include:

  • does the assigned scope still match the intended devices and browsers;
  • whether competing local and MDM profiles exist on Macs;
  • whether the extension utility is used only where device posture policy objects are required;
  • the documented manual rollback still works on a test device;
  • whether owners and an escalation path for centrally managed uninstallations are defined.

Plan migration or decommissioning dates only based on current product information from Sophos. If there is a change in the deployment method, first validate the new pilot configuration and only then decommission the old method in a controlled manner.

This guide covers the extension, its distribution methods and safe manual removal. Licensing, identities, DNS, ZTNA and general Sophos Fusion roles are not part of the extension installation. Likewise, deploying the complete Sophos Protected Browser is a separate lifecycle and update process described in Deploy and keep Sophos Protected Browser up to date.