Install the extension automatically
Force-install for Chrome and Edge on Windows and macOS, automatic Microsoft sign-in and the optional hardening.
In this step you use browser policy to force-install the BeeSensible extension in Chrome and Edge. The extension then appears on its own in the browser of every employee in your target group, and employees cannot remove it. Together with the sign-in script from the previous step, this means the extension recognises the work account and starts the sign-in itself. At the end of this article you find measures you can take in addition, for a sign-in without a Microsoft screen in Chrome and for private windows.
Windows
Create a configuration profile
In Intune, choose Devices → Configuration → Create → New policy → Windows 10 and later → Settings catalog.
Add the forcelist entry for each browser
In the settings picker, search for ExtensionInstallForcelist. The setting exists under both Google Chrome and Microsoft Edge, and you add it for both browsers. Each time, pick the device variant, so that the policy applies to every user on the device, and paste the value for that browser. Each value consists of the extension ID and, after the semicolon, the update address of that browser's store:
cnlogmngeghlgbncagnoodfjkbaknnbo;https://clients2.google.com/service/update2/crxplnhmaecddjmliagaedlgagopdcahlgb;https://edge.microsoft.com/extensionwebstorebase/v1/crxAssign to your target group
Assign the profile to the same group as the sign-in script, so that every employee receives both the extension and the sign-in hint.
macOS
For macOS, the console generates a configuration profile (.mobileconfig) that force-installs the extension in the browsers from your deployment profile. The Mac must be enrolled in Intune, and the browser must already be installed, because the profile does not install a browser itself.
Download the profile
Upload it as a custom profile
In Intune, choose Devices → macOS → Configuration → New policy → Templates → Custom.
Do not use the Settings catalog for this. The profile from the console configures every browser in your deployment profile in a single file, and you upload that file as a custom profile.
Pick the device channel and assign
For the deployment channel, choose the device channel, upload the profile and assign it to your target group. You cannot change the channel after saving; if you picked the wrong one, create a new profile.
This profile only handles the extension. Sign-in to the right organisation is handled by the profile from On a Mac, and the desktop app for macOS by the package from The desktop app.
Automatic Microsoft sign-in
Once both the sign-in script and the forced installation are on a device, the extension recognises the employee's work account. The employee then does not need to type an address or pick an account, because the extension starts the sign-in itself using the sign-in hint. Since5.5.14 the extension recognises the work account from the sign-in script; Since5.5.17 it also tries to complete the sign-in in Edge without an account picker. You can see which version is on a device at chrome://extensions or edge://extensions. Whether a Microsoft screen still appears during sign-in depends on the browser:
With the CloudAPAuthEnabled policy, the sign-in completes without a password or confirmation. Tested31 August 2026
Without it, Microsoft asks for confirmation or a password the first time. Not yet validated
On a device joined to Microsoft Entra ID, Edge signs the user in to Microsoft web apps automatically, without any extra policy.
Whether this also makes the BeeSensible sign-in silent has not been established, so expect a Microsoft window to appear. Extra Edge policies make no difference here, because BeeSensible's sign-in flow decides this, not the browser. Not yet validated
After a successful sign-in, BeeSensible keeps using the existing session for as long as it is valid, so the employee does not have to sign in again each time.
Microsoft still asks to pick an account
If Microsoft still asks for an account, work through the following causes in this order:
- The sign-in hint is missing or unusable. Run the registry commands for the sign-in script. If
loginHintis missing, literally says{{UserPrincipalName}}or has no @ sign, the extension ignores the hint. The console counts such a client under Managed configuration not filled in. - The extension is older than the versions mentioned above. A newer version arrives through the store, and you have to wait for it.
- The domain of the work address is not verified in BeeSensible.
- No identity provider is connected, which is why BeeSensible shows the regular sign-in screen. See Identity.
Edge still shows the old account picker
Check the version at edge://extensions. Microsoft Edge Add-ons delivers new versions later than the Chrome Web Store, and as long as the minimum version is not available there, the extension does not recognise the work account. All you can do then is wait, because policy cannot force a version.
Optional hardening
The measures in this section are additions. The extension and the sign-in work without them, but with these policies the sign-in in Chrome completes without a Microsoft screen, and you can decide what happens in private windows. Optional
Silent sign-in in Chrome (CloudAPAuthEnabled)
Chrome (version 111 or newer) only passes the user's Windows sign-in on to Microsoft when this policy is on. Without it, Microsoft asks for confirmation even though the user is already signed in to Windows.
CloudAPAuthEnabledSearch the Settings catalog for this name; the display name is "Allow automatic sign-in to Microsoft cloud identity providers". Pick the device variant, set it to Enabled and assign it to your target group. The policy applies to the whole device, but not in Incognito windows. Bear in mind that with this policy Chrome shares information about the device and the account with Microsoft during Microsoft sign-ins, as Edge already does by default.
The sign-in is not automatic in Chrome
If CloudAPAuthEnabled is not true in chrome://policy, the device has not yet received the policy. Sync the device, then close all Chrome windows and start Chrome again so that it reads the policy.
Private windows (Incognito and InPrivate)
In a private window, the extension only runs if the user allows it, and browser policy cannot grant that permission on the user's behalf. Without an extra measure, BeeSensible therefore does not work in a private window. Chrome and Edge each offer a different way to deal with this:
Chrome on Windows and macOS cannot force an extension into Incognito windows; that policy only exists on ChromeOS. You therefore have two options. You can disable Incognito mode for the whole browser by setting IncognitoModeAvailability to 1, which takes effect after a browser restart. Or you accept that BeeSensible does not work in Incognito windows and follow in the console how many clients this affects.
From Edge 139, you can make InPrivate depend on the extension with the policy MandatoryExtensionsForInPrivateNavigation. As long as the user has not allowed BeeSensible in InPrivate, an InPrivate window then opens no page at all. Set the policy through the Settings catalog, with the Edge extension ID as the value:
plnhmaecddjmliagaedlgagopdcahlgbSince5.5.17 the extension reports at sign-in whether it may run in private windows, and the console counts how many clients are covered. If you withdraw the forced installation later, remove these policies as well. This matters most for the InPrivate policy, because otherwise Edge keeps requiring an extension that is no longer there; see Rolling back.
