Deploy ConcealBrowse on macOS using N-able N-central Deploy ConcealBrowse on macOS using N-able N-central
  1. Conceal
  2. ConcealBrowse™
  3. Deploying to Mac

Deploy ConcealBrowse on macOS using N-able N-central

Description

Deploy the ConcealBrowse extension and helper to multiple browsers on macOS endpoints seamlessly with N-able N-central's Mac Scripting and Device Management for Apple (DMA).

This is a two stage process as required by macOS architecture.

Stage 1 deploys the ConcealBrowse helper application which authenticates the browser extension(s) and provides you with telemetry such as the hostname and logged in username.

Stage 2 configures your browsers to install and require ConcealBrowse from each browser's web store.

Applies to

  • N-able N-central
  • macOS 13+
  • Google Chrome
  • Microsoft Edge
  • Brave browser
  • Mozilla Firefox

Requirements

  • N-central version ~2023
  • N-central Device Management for Apple (DMA) must be configured with a valid Apple push certificate
  • macOS devices must have the N-central Agent installed
  • macOS devices must be enrolled in N-central Device Management for Apple (DMA)

Gather your IDs

  1. Log in to https://dashboard.conceal.io
  2. (Optional for multi-tenants) Choose the specific tenant
  3. At the top right, click DOWNLOAD EXTENSION
  4. Scroll down to find your CompanyID and SiteID, note these for use in later steps

Stage 1: Install ConcealBrowse Helper application

Upload the installation script

  1. In the N-central dashboard, navigate to Configuration > Scheduled Tasks > Script/Software Repository
  2. Click Add > Mac Scripting
  3. Name: Install ConcealBrowse Helper macOS
  4. Description: We recommend including a link to this article
  5. File Name: Download and browse to the file attached to this article, it can be found at the bottom of the page "Install-ConcealBrowse-PKG-N-central.sh"
  6. Command Line Parameters: After the script name, we recommend adding placeholders to help later when you run the script. Append --companyid="InsertYourCompanyIdHere" --siteid="InsertYourSiteIdHere"
    1. Example with placeholders: Install-ConcealBrowse-PKG-N-central.sh --companyid="InsertYourCompanyIdHere" --siteid="InsertYourSiteIdHere"
  7. Click OK to finish the upload

Run the script on test device(s)

  1. In the N-central dashboard, navigate to Actions > Run a Mac Script
  2. (Optional) Task Name: name your script run as desired
  3. Credentials: select Use root credentials
  4. Location: From N-able N-central's Script Repository
  5. Repository Item: Install ConcealBrowse Helper macOS (uploaded earlier)
  6. Command Line Parameters: Using the CompanyID and SiteID gathered earlier, replace the InsertYourCompany/SiteIdHere text with the IDs
    1. Example with values: Install-ConcealBrowse-PKG-N-central.sh --companyid="12345678-9012-3456-7890-123456789012" --siteid="abcdefgh-ijkl-mnop-qrst-uvwxyzabcdef"
  7. Click the Targets tab
  8. Select device(s) to run the script on
  9. (Optional) Modify the settings in the Schedule and Notifications tabs
  10. Click Save to execute the script according to the chosen schedule

Monitor the script run

  1. In the N-central dashboard, navigate to Views > Job Status
  2. Click on the job name of the mac script run
  3. If needed, click the Status tab
  4. Review the per device script output for any errors

Stage 2: Deploy the ConcealBrowse Extension to each browser

We highly recommend verifying that the ConcealBrowse helper application has installed on endpoints before configuring your browsers to install the ConcealBrowse Extension. If the extension is installed prior to the helper, the user will be prompted to log in which may cause confusion and disruption for your support team.

These steps may vary depending on how you manage each browser. As this article is targeted to N-central, we will assume you manage your browsers with N-central.

Preparation

  1. In the N-central dashboard, navigate to Configuration > Device Management for Apple
  2. Click the Profiles tab
  3. Review the existing profiles to see if you have a profile for your browser(s). From our testing you can only have one profile per application.
    • If you do NOT have a profile for your browsers, refer to the next section named: If you need to create a profile
    • If you already have a profile, scroll down to the section: If you already have a profile

If you need to create a profile

We recommend the attached Multi-Browser mobileconfig file for Chrome, Edge, Brave, and Firefox to customers who do not currently manage their browser settings, this allows for rapid deployment in one step.

  1. In the N-central dashboard, navigate to Configuration > Device Management for Apple
  2. Click the Profiles tab
  3. Click Upload Profile
  4. Choose either Account or Customer for profile scope
  5. Profile name: Multi-Browser ConcealBrowse Extension
  6. Profile description: we recommend including a link to this article
  7. At the bottom of this article, click the download attachment link for Multi-Browser ConcealBrowse Extension.mobileconfig
  8. Drag the Multi-Browser ConcealBrowse Extension.mobileconfig to Upload profile, or browse to it
  9. Click Upload

Install the Multi-Browser ConcealBrowse Extension configuration profile on devices

  1. In Device Management for Apple, click the Devices tab
  2. Select the device(s) to which you want to install the ConcealBrowse extension
  3. Click the Install profiles button that appears
  4. Select the Multi-Browser ConcealBrowse Extension profile
  5. Click Install
  6. This change takes effect almost immediately
  7. See the section: Verify the configuration profile has applied to your test device(s)

If you already have a profile

  1. Find the existing profile
  2. Click the three dots in the Actions column
  3. Choose Download profile
  4. Open the downloaded profile in your favorite editor
  5. Verify the PayloadType matches the browser you intend to configure
    - Chrome: com.google.chrome
    - Brave: com.brave.browser
    - Edge: com.microsoft.edge
    - Firefox: org.mozilla.firefox
  6. Search the Property List for "ExtensionSettings", it’s unlikely to be present.
    • If ExtensionSettings is present you will need to merge the following into the existing ExtensionSettings section.
  7. For Chrome or Brave, within the PayloadContent, add the following: 
    <key>ExtensionSettings</key>
    <dict>
      <key>jmdpihfpelphmllgmamebdbelmobjfpg</key>
      <dict>
        <key>installation_mode</key>
        <string>force_installed</string>
        <key>toolbar_pin</key>
        <string>force_pinned</string>
        <key>update_url</key>
        <string>https://clients2.google.com/service/update2/crx</string>
      </dict>
    </dict>
  8. For Edge, within the PayloadContent, add the following: 
    <key>ExtensionSettings</key>
    <dict>
      <key>ojjdicpccncniljgdmjcepenkkpmnnmk</key>
      <dict>
        <key>installation_mode</key>
        <string>force_installed</string>
        <key>toolbar_state</key>
        <string>force_shown</string>
        <key>update_url</key>
        <string>https://edge.microsoft.com/extensionwebstorebase/v1/crx</string>
      </dict>
    </dict>
  9. For Firefox, within the PayloadContent, add the following: 
    <key>ExtensionSettings</key>
    <dict>
      <key>concealbrowse@conceal.io</key>
      <dict>
        <key>installation_mode</key>
        <string>force_installed</string>
        <key>install_url</key>
        <string>https://conceal-browse.conceal.io/firefox/latest/concealbrowse.xpi</string>
      </dict>
    </dict>
  10. Save your modified mobileconfig
  11. Upload the modified mobileconfig to the existing or a new profile and test that it works as expected
  12. See the section: Verify the configuration crofile has applied to your test device(s)

Verify the configuration profile has applied to your testing device(s)

  1. Open System Settings on a targeted Mac
  2. Navigate to
    1. macOS version 15+: General > Device Management
    2. macOS version <15: Privacy & Security > Profiles
  3. When applied, you will see a profile named Multi-Browser ConcealBrowse Extension as named in an earlier step
  4. Open, or reopen, the targeted browser and the ConcealBrowse extension will be automatically installed. The extension will also automatically register to your Conceal dashboard thanks to the helper installed in Stage 1.
  5. You may check the browser configuration by looking at its policy page, restarting the browser causes it to check for new policies:
    - Chrome: chrome://policy
    - Brave: brave://policy
    - Edge: edge://policy
    - Firefox: about:policies

Recommended Step: Disable incognito and guest mode

It’s not possible to enforce extension usage in Incognito/InPrivate or Guest mode. Therefore it is recommended to disable them by adding the following to your browser's mobileconfig configuration.

Chrome and Brave:

<key>IncognitoModeAvailability</key>
<integer>1</integer>
<key>BrowserGuestModeEnabled</key>
<false/>

Edge:

<key>InPrivateModeAvailability</key>
<integer>1</integer>
<key>BrowserGuestModeEnabled</key>
<false/>

Firefox:

<key>DisablePrivateBrowsing</key>
<true/>

References

Attachments

Multi-Browser ConcealBrowse Extension.mobileconfig (4 KB) Install-ConcealBrowse-PKG-N-central.sh (6 KB)

Was this article helpful?

0 out of 0 found this helpful

Related articles

Articles in this section