How to Detect Domain Applications Using SpinProtect

1. Open Google Admin Console

2. Navigate to Devices > Chrome > Apps & extensions

3. Select Users & browsers

4. Select the yellow plus icon, then select Add from Chrome Web Store

5. In the pop-up window, enter the SpinProtect extension App ID: pjdkicnffioipghpfkejfmnpbhffbmea then press Select

6. On the new page, under “Installation policy”, select Force install + pin to browser toolbar, then press Save

7. The SpinProtect for Google Workspace Chrome extension will now automatically install to every managed Chrome browser within your Google Workspace organization.

Why didn’t my application appear?

1. The Chrome browser is not updated.
2. The synchronization function in the Chrome browser is disabled.
3. The user is not signed into their corporate Google Workspace account on the Chrome browser.

As a required first step, ensure that your organization is utilizing Active Directory and that all devices are enrolled in Microsoft Intune. You can head to Devices – Microsoft Endpoint Manager admin center to ensure that all devices are successfully connected.

In case devices aren’t enrolled, follow these guides to begin:

• For Windows devices: https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-methods
• For macOS devices: https://learn.microsoft.com/en-us/mem/intune/enrollment/macos-enroll

1. Navigate to Microsoft Intune admin center

2. Select Devices

3. Navigate to Manage Devices > Configuration > Policies > Create > New Policy

4. Create a profile by:
   1. Setting Platform accordingly: Windows 10 and later, macOS, Linux, etc…
   2. Setting Profile type to: Settings catalog
   3. Select Create

Note: Separate profiles are required if your organization uses multiple platforms. If another profile needs to be created, complete the following steps for the selected platform and return to this step to create a different profile for other platforms.

5. Complete the Basics section by entering Name and Description (optional).

6. Under Configuration settings section, select +Add settings > Locate the category for Microsoft Edge\Extensions (the category name may vary depending on the selected platform) > Select Control which extensions are installed silently 

7. In the Configuration Settings section, ensure the “Control which extensions are installed silent” setting is enabled and enter the following information:

pjdkicnffioipghpfkejfmnpbhffbmea;https://clients2.google.com/service/update2/crx

8. Complete the remaining policy settings, including the device assignments, and save the profile. 

As a required first step, ensure that your organization is utilizing Active Directory and that all devices are enrolled in Microsoft Intune. You can head to Devices – Microsoft Endpoint Manager admin center to ensure that all devices are successfully connected.

In case devices aren’t enrolled, follow these guides to begin:

• For Windows devices: https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-methods
• For macOS devices: https://learn.microsoft.com/en-us/mem/intune/enrollment/macos-enroll

1. Navigate to Microsoft Intune admin center

2. Select Devices

3. Navigate to Manage Devices > Configuration > Policies > Create > New Policy

4. Create a profile by:

1. Setting Platform accordingly: Windows 10 and later, macOS, Linux, etc…
2. Setting Profile type to: Settings catalog
3. Select Create

Note: Separate profiles are required if your organization uses multiple platforms. If another profile needs to be created, complete the following steps for the selected platform and return to this step to create a different profile for other platforms.

5. Complete the Basics section by entering Name and Description (optional).

6. Under Configuration settings section, select +Add settings > Locate the category for Google Chrome Extensions (the category name may vary depending on the selected platform) > Select Configure the list of force-installed apps and extensions > Select Extension/App IDs and update URLs to be silently installed (Device)

7. In the Configuration Settings section, ensure the “Control which extensions are installed silent” setting is enabled and enter the following information:

albelcopcckbhpemmbppkgnbpbglmgac;https://clients2.google.com/service/update2/crx

8. Complete the remaining policy settings, including the device assignments, and save the profile. 

As a required first step, ensure that your organization is utilizing Active Directory and that all devices are enrolled in Microsoft Intune. You can head to Devices – Microsoft Endpoint Manager admin center to ensure that all devices are successfully connected.

In case devices aren’t enrolled, follow these guides to begin:

• For Windows devices: https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-methods
• For macOS devices: https://learn.microsoft.com/en-us/mem/intune/enrollment/macos-enroll

1. Navigate to Microsoft Intune admin center

2. Select Devices

3. Navigate to Manage Devices > Configuration > Policies > Create > New Policy

4. Create a profile by:

4. Setting Platform accordingly: Windows 10 and later, macOS, Linux, etc…
5. Setting Profile type to: Settings catalog
6. Select Create

Note: Separate profiles are required if your organization uses multiple platforms. If another profile needs to be created, complete the following steps for the selected platform and return to this step to create a different profile for other platforms.

5. Complete the Basics section by entering Name and Description (optional).

6. Under Configuration settings section, select +Add settings > Locate the category for Microsoft Edge\Extensions (the category name may vary depending on the selected platform) > Select Control which extensions are installed silently 

7. In the Configuration Settings section, ensure the “Control which extensions are installed silent” setting is enabled and enter the following information:

albelcopcckbhpemmbppkgnbpbglmgac;https://clients2.google.com/service/update2/crx

Complete the remaining policy settings, including the device assignments, and save the profile. 

By combining SpinOne and SpinProtect, customers can manage the full security lifecycle of OAuth applications and browser extensions – detection, remediation, prevention. 

For example, organizations that discover high risk OAuth applications or browser extensions may want to completely prevent end users from accessing anything related to it. SpinOne manages the application itself, while SpinProtect manages browser extensions and prevents end users from accessing the websites associated with the blocked application or browser extension. 

SpinProtect can also be used to simply block unsanctioned websites that may not be safe for work (adult, gambling, etc…).

SpinMonitor provides visibility and management over installed browser extensions. SpinProtect includes SpinMonitor’s capabilities, as well as the ability to manage website domains, also known as Domain Applications. 

SpinOne, SpinSPM, and SpinCRX customers have access to SpinProtect.

For your convenience, we’ve drafted the following draft note that can be used as an internal memo regarding the deployment of SpinProtect: SpinProtect Extension Communication Draft.pdf