Chrome Enterprise Jamf Deployment on Mac: A Practical Guide

Deploying Google Chrome Enterprise on Mac at scale requires more than simple package installation. Jamf Pro provides the infrastructure to push Chrome Enterprise to managed Macs, configure enterprise policies, and maintain browser settings across your organization. This guide covers the practical implementation details developers and IT professionals need.

Understanding Chrome Enterprise on macOS

Chrome Enterprise combines the Chromium browser with additional management features, enterprise support, and extended Group Policy support. Unlike the standard Chrome channel, Enterprise builds receive extended stability windows and can be managed through Google’s Admin console or local configuration profiles.

The browser supports two deployment methods: the standard DMG installer and the Enterprise installer (.pkg). For Jamf deployments, the Enterprise PKG provides the most control over installation behavior and subsequent updates.

Preparing Your Jamf Pro Environment

Before deployment, ensure your Jamf Pro server can distribute the Chrome Enterprise package. Download the appropriate installer from the Google Chrome Enterprise bundle page—you need a Google Workspace or Chrome Enterprise Premium subscription to access the Enterprise-specific builds.

Downloading Chrome Enterprise

# Download the Chrome Enterprise DMG (then convert to PKG)
curl -o chrome-enterprise.dmg "https://dl.google.com/chrome/mac/enterprise/googlechromeenterprise.dmg"

# Extract and convert to PKG using pkgbuild or Packages
hdiutil attach chrome-enterprise.dmg
cp "/Volumes/Google Chrome/Google Chrome.app/Contents/Resources/Google Chrome.pkg" ~/Desktop/
hdiutil detach "/Volumes/Google Chrome"

For scripted downloads, you can also access direct download URLs through your Google Admin console or use the gsutil command if you have buckets configured.

Creating the Jamf Policy

Jamf Pro uses policies to trigger installations. Create a new policy scoped to your target computers.

Policy Configuration Steps

Create Policy: Navigate to Computers > Policies > New
General: Set triggering to match your deployment strategy (Recurring Check-in, Startup, or Manual)
Packages: Add the Chrome Enterprise PKG
Scripts: Include post-install configuration scripts if needed
Scope: Target appropriate computer groups

The package priority determines installation order when multiple packages deploy simultaneously. Chrome Enterprise should install before configuration profiles that depend on its presence.

Configuration Profiles for Chrome Enterprise

Jamf Configuration Profiles apply settings to managed Macs through macOS preferences. Chrome reads enterprise policies from multiple sources, with Preference Manifests (.plist files) taking precedence.

Creating the Configuration Profile

Create a Configuration Profile in Jamf Pro with the following payload structure:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.google.Chrome</key>
    <dict>
        <key>ExtensionInstallForcelist</key>
        <array>
            <string>gfdkimpbcpahaombhbimeihdjnejgicl;https://clients2.google.com/service/update2/crx</string>
        </array>
        <key>HomepageLocation</key>
        <string>https://yourcompany.com/dashboard</string>
        <key>ManagedBookmarks</key>
        <array>
            <dict>
                <key>toplevel_name</key>
                <string>Engineering</string>
            </dict>
            <dict>
                <key>name</key>
                <string>Jira</string>
                <key>url</key>
                <string>https://jira.yourcompany.com</string>
            </dict>
        </array>
        <key>DefaultBrowserSettingEnabled</key>
        <false/>
        <key>BrowserSignin</key>
        <integer>0</integer>
    </dict>
</dict>
</plist>

This configuration forces installation of specific extensions, sets a company homepage, configures managed bookmarks, and disables Chrome as the default browser—common enterprise requirements.

Applying via Jamf

Upload this plist as a custom Configuration Profile in Jamf Pro. The profile applies to /Library/Preferences/com.google.Chrome.plist on managed Macs. Users cannot modify settings marked as mandatory through the management framework.

Extension Management Strategies

Browser extensions represent both productivity tools and security risks. Chrome Enterprise provides several mechanisms for controlling extension deployment.

Force-Installing Extensions

The ExtensionInstallForcelist policy installs extensions automatically and prevents users from removing them. Use extension IDs from the Chrome Web Store:

<key>ExtensionInstallForcelist</key>
<array>
    <string>extension-id-1;update-url-1</string>
    <string>extension-id-2;update-url-2</string>
</array>

The update URL typically follows the pattern: https://clients2.google.com/service/update2/crx

Blocking Extensions

Prevent specific extensions from being installed using ExtensionInstallBlocklist:

<key>ExtensionInstallBlocklist</key>
<array>
    <string>extension-id-to-block</string>
</array>

Automated Updates with Jamf

Keeping Chrome Enterprise updated requires coordinating Jamf Smart Software Update policies with Google’s update infrastructure.

Update Channel Configuration

Set the update channel through configuration policy:

<key>AutoUpdateCheckPeriod</key>
<integer>4</integer>
<key>ProtocolHandler</key>
<array>
    <string>https</string>
</array>

Jamf Pro’s Smart Software Update feature can target specific versions, but Chrome Enterprise typically handles its own updates through Google Update services. You may need to disable automatic Chrome updates if your organization requires staged rollouts through Jamf.

# Disable Chrome Auto-Update via launchd (run as root)
launchctl unload /Library/LaunchDaemons/com.google.keystone.daemon.plist

Verification and Troubleshooting

After deployment, verify installation and configuration on client machines.

Checking Installation

# Verify Chrome Enterprise is installed
ls "/Applications/Google Chrome.app/Contents/Info.plist"
# Check the bundle identifier - Enterprise shows as Google Chrome Enterprise
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleIdentifier

Checking Configuration

# View applied Chrome preferences
defaults read /Library/Preferences/com.google.Chrome
# Check extension policies
defaults read /Library/Preferences/com.google.Chrome ExtensionInstallForcelist

Common Issues

Extension force-install fails: Verify the extension ID and update URL are correct. Some extensions require manifest version 2 or 3—check Google documentation for compatibility.

Configuration not applying: Ensure the Configuration Profile is scoped to the correct computers. Restart Chrome after applying new policies—the browser reads preferences on launch.

Update failures: Check network connectivity to clients2.google.com. Corporate proxies may require configuration through ProxySettings in your Chrome configuration profile.

Security Considerations

Chrome Enterprise on Mac integrates with macOS security frameworks. Consider these hardening steps:

Enable SafeBrowsingProtectionLevel to configure phishing and malware protection
Configure RemoteDebuggingPort only for authorized management tools
Set IncognitoModeAvailability to disable private browsing if compliance requires it
Use PasswordManagerEnabled to control whether Chrome stores credentials

<key>SafeBrowsingProtectionLevel</key>
<string>2</string>
<key>PasswordManagerEnabled</key>
<false/>
<key>IncognitoModeAvailability</key>
<integer>1</integer>

Conclusion

Deploying Chrome Enterprise through Jamf Pro combines package distribution with macOS Configuration Profiles to achieve enterprise browser management. The key is structuring your Jamf policies, Configuration Profiles, and update mechanisms to work together. Start with basic package deployment, add configuration profiles for your required policies, then refine your update strategy based on organizational needs.

For teams managing development environments, Chrome Enterprise’s extension management and managed bookmarks provide consistent tooling across machines. The combination of Jamf’s device management and Chrome’s enterprise policies gives administrators the control needed for secure, standardized browser deployments.

Built by theluckystrike — More at zovo.one