Browser Phishing Protection is automatically deployed by the Endpoint Agent when its policy settings are enabled for macOS. If your organization prefers to manage browser extensions via a Mobile Device Management (MDM) tool, follow the instructions below to deploy Browser Phishing Protection for Chrome, Brave, Edge, and Firefox browsers.
- In Nebula, go to Configure > Policies.
- Enable and configure Browser Phishing Protection in the policy settings. For more information, see Protection policy settings in Nebula.
- Check the checkbox for Prevent endpoint agent from installing web extension on MDM managed endpoints. This prevents the endpoint agent from installing the browser extension and allows your MDM to handle the installation process.
- Save the policy and repeat the steps for multiple policies as needed.
- Add the property lists (plists) below to your MDM configuration. They can be added manually, or with the ThreatDown Browser Phishing Protection - Browser Extensions at the bottom of this article.
For resources on creating custom configurations for common MDMs, see:
For Windows instructions, see Browser Phishing Protection MDM deployment on Windows - Nebula.
CAUTION - If you already manage and install other browser extensions through an MDM, manually add these plists to your existing configuration file. Uploading another configuration file may conflict with your existing managed browser extensions.
Mozilla Firefox
Preference domain: org.mozilla.firefox
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EnterprisePoliciesEnabled</key>
<true/>
<key>ExtensionSettings</key>
<dict>
<key>bpp@threatdown.com</key>
<dict>
<key>install_url</key>
<string>https://cloud.threatdown.com/firefox/latest.xpi</string>
<key>installation_mode</key>
<string>force_installed</string>
</dict>
</dict>
</dict>
</plist>Google Chrome
Preference domain: com.google.Chrome
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ExtensionInstallForcelist</key>
<array>
<string>ajbghephkehcmphjmenfpkmjiolhjalk;https://clients2.google.com/service/update2/crx</string>
</array>
</dict>
</plist>Brave Browser:
Preference domain: com.brave.Browser
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ExtensionInstallForcelist</key>
<array>
<string>ajbghephkehcmphjmenfpkmjiolhjalk;https://clients2.google.com/service/update2/crx</string>
</array>
</dict>
</plist>Microsoft Edge
Preference domain: com.microsoft.Edge
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ExtensionInstallForcelist</key>
<array>
<string>jmnhicbkdlfeaimeidnpbbmgbgfobpel;https://edge.microsoft.com/extensionwebstorebase/v1/crx</string>
</array>
</dict>
</plist>Notes
- If the browser is open, the extension installs when the browser is restarted.
- If the end user already has Malwarebytes Browser Guard installed, it is automatically disabled when deploying Browser Phishing Protection.
- End users can disable the Browser Phishing Protection extension in Google Chrome and Microsoft Edge when using incognito mode. Ensure that incognito mode is restricted to prevent users from bypassing the extension.