Skip to main content
Question

Force Install Multiple Chromium Based Extensions using separate profiles to the same devices

  • September 10, 2026
  • 5 replies
  • 67 views
Forum|alt.badge.img+2

Hey,

First-time poster. We have an issue where we want to force install certain chromium-based extensions to certain devices. This is fine, add the custom plist with the ExtensionInstallForcelist with the GUID and update the manifest URL. This is then deployed to the required subset of users.

The issue we have is scaling this with multiple extensions. This is fine if there is no overlap on the devices where this is being deployed but as soon as Extension A & Extension B are deployed to one device with multiple profiles then only one wins.

Any ideas on how to deploy multiple extensions across multiple profiles when there might be overlap in the scope of devices? I’ve tried using just the plist within the preferences folder but it seems like it only respects/looks for policy within Managed Preferences instead.

Many thanks for your help.

    5 replies

    AJPinto
    Forum|alt.badge.img+26
    • AJPinto
    • Legendary Contributor
    • September 10, 2026

    From my experiences Chromium only supports a single config profile extension payload. You can't have one config profile for each extension as it just turns in to a race condition. If you need different groups of people to have different extensions you need to have all the extensions they need in each profile and scope/exclude devices so only one profile goes to that device containing extensions. Because of this I broke extensions out of my other configs for chrome/edge/etc. 

      Forum|alt.badge.img+2
      • jamie915
      • Author
      • New Contributor
      • September 10, 2026

      From my experiences Chromium only supports a single config profile extension payload. You can't have one config profile for each extension as it just turns in to a race condition. If you need different groups of people to have different extensions you need to have all the extensions they need in each profile and scope/exclude devices so only one profile goes to that device containing extensions. Because of this I broke extensions out of my other configs for chrome/edge/etc. 

      Hey ​@AJPinto ,

      Thanks for your reply. I did think of this option but was really hoping to avoid having profiles with all the permutations and an array of includes and excludes, but yeah, you’re right...it only supports one profile configuring that particular key at any one time.

      Maybe that is the only option.

      Chubs
      Forum|alt.badge.img+26
      • Chubs
      • Jamf Heroes
      • September 10, 2026

      Your best bet is to configure Chrome Enterprise Core (free) and enroll your devices there.  You can create different OUs and tokens per OU.  That way you can mix/match which extensions you want on which set of devices (token based).  I’ll be more than happy to help if this is the route you want to go.

      The other benefit is that the policy updates through CEC is declarative instead of relying on a third party patching service.

      Either way (profile based via ​@AJPinto’s way or CEC), let us know if you need help!

      I find your lack of faith disturbing
        Forum|alt.badge.img+2
        • jamie915
        • Author
        • New Contributor
        • September 10, 2026

        Your best bet is to configure Chrome Enterprise Core (free) and enroll your devices there.  You can create different OUs and tokens per OU.  That way you can mix/match which extensions you want on which set of devices (token based).  I’ll be more than happy to help if this is the route you want to go.

        The other benefit is that the policy updates through CEC is declarative instead of relying on a third party patching service.

        Either way (profile based via ​@AJPinto’s way or CEC), let us know if you need help!

        Cheers ​@Chubs . I'll take a look into this and see if something we would be able to deploy in our environment.

          Chubs
          Forum|alt.badge.img+26
          • Chubs
          • Jamf Heroes
          • September 10, 2026

          Your best bet is to configure Chrome Enterprise Core (free) and enroll your devices there.  You can create different OUs and tokens per OU.  That way you can mix/match which extensions you want on which set of devices (token based).  I’ll be more than happy to help if this is the route you want to go.

          The other benefit is that the policy updates through CEC is declarative instead of relying on a third party patching service.

          Either way (profile based via ​@AJPinto’s way or CEC), let us know if you need help!

          Cheers ​@Chubs . I'll take a look into this and see if something we would be able to deploy in our environment.

          For clarity, this only enrolls the browser.  The token can be deployed via a configuration profile via JAMF.  You can manually move devices around inside of CEC after they are enrolled if you don’t want to generate multiple tokens.   Cheers!  

          I find your lack of faith disturbing
            Terms & ConditionsAccessibility statement