IT deployment steps for managed (force-install) and unmanaged deployment models.
What gets deployed, what permissions are needed, and what your employees will see.
Enterprise (MDM) rollout: For managed Chrome / Edge, IT pushes a policy JSON into chrome.storage.managed with your organization's apiKey and deploymentGroupKey (from Dashboard → Settings → Keys & Distribution). The extension manifest includes a managed_schema so those keys validate against the published schema. Use the Deployment Models section below for Google Workspace and Microsoft Intune walkthroughs.
Choose the model that fits your environment. Managed is recommended for production rollouts.
Confirm the extension is active and detection is flowing to your dashboard.
After installation, the Privent icon should appear in the Chrome extensions toolbar. A grey icon means inactive (not yet activated). A white icon means active.
Navigate to chat.openai.com, claude.ai, or gemini.google.com. The page should load normally - no visible change to the UI.
Type a prompt that contains a fake sensitive string - for example: "My SSN is 123-45-6789". Submit it. The extension should intercept and score it.
Within a few seconds, a new detection event should appear in your admin dashboard with a risk score, category (PII), and risk level (medium or high depending on your policy thresholds).
Common issues and how to resolve them.
The extension is installed but not activated. For managed deployments, verify the managed configuration JSON contains a valid apiKey and deploymentGroupKey. For unmanaged, ensure the user has clicked the activation link and completed the flow.
Confirm the apiKey belongs to an active organization in the admin dashboard. API keys are scoped to a deployment group - ensure deploymentGroupKey matches the intended group for this rollout.
Check that the extension is active (white icon) on the supported GenAI domain. Confirm the browser allows the extension on the target domain. Review the service worker logs in Chrome DevTools → Extensions → Privent → Service Worker.
Verify your organization policy thresholds in the admin dashboard. If both warnThreshold and blockThreshold are set to 1.0, all prompts will ALLOW. Lower thresholds to start seeing risk events.
Chrome may cache managed policies for up to 8 hours. Force a policy refresh with chrome://policy → Reload policies. For Intune, allow 24h for MDM sync to propagate.
