Extension Auto Login

Extension Auto Login & Enterprise Policy

Deploy the DataMagik Automate browser extension to your whole organization and have every user signed in automatically — no manual login, no shared passwords. This works by pushing a managed policy (a bearer token plus environment settings) to Chrome or Edge through Microsoft Intune, Windows Group Policy (GPO), the Google Admin Console, or any MDM that can write browser policy. The extension reads that policy on startup and signs the user in.

Key concept: two separate policies

Chrome and Edge extensions require two separate policies for force-install plus auto-login:

1. ExtensionSettings — forces the extension to install (only installation_mode and update_url).
2. 3rdparty managed storage — provides the bearer token and environment settings to chrome.storage.managed.

Authentication priority

The extension resolves its login in this order:

1. User-set token — takes priority if the user has logged in manually or set their own token.
2. Managed policy token — used as a fallback when no user token exists.

This lets users override the enterprise default when needed while still providing a zero-touch default for everyone else.

Configuration options

The DataMagik Automate extension ID is hppahoaiaihchdpnoegknnodnjleogdi.

Option A: PowerShell deployment (recommended)

The easiest and most reliable method. These ready-made scripts write the registry keys directly for both Chrome and Edge — no ADMX template import required. Download the scripts, set your token at the top, and upload them to Intune (or run them under any tool that executes PowerShell as SYSTEM).

Step 1: Download the scripts

⬇ Deploy-DataMagikExtension.ps1 one-time deploy ⬇ Detect-DataMagikPolicy.ps1 remediation detect ⬇ Remediate-DataMagikPolicy.ps1 remediation fix ⬇ Check-DataMagikPolicy.ps1 diagnostics

Open Deploy-DataMagikExtension.ps1 and edit the CONFIGURATION block at the top — set $BearerToken to your dcp_ token, and adjust $Environment, $LockEnvironment, and $Browsers as needed. The rest of the script needs no changes.

# CONFIGURATION — edit before uploading to Intune
$BearerToken     = "dcp_YOUR_ACTUAL_TOKEN"   # From Your Account > API Keys
$Environment     = "production"               # "production" or "staging"
$LockEnvironment = $false                      # $true to lock environment switching
$Browsers        = "Both"                      # "Both", "Chrome", or "Edge"

Step 2: Deploy via Intune (Platform Script)

1. In Intune go to Devices > Scripts and remediations > Platform scripts > Add > Windows 10 and later.
2. Upload the edited Deploy-DataMagikExtension.ps1.
3. Settings:
   • Run this script using the logged-on credentials: No (runs as SYSTEM).
   • Run script in 64-bit PowerShell: Yes.
   • Enforce script signature check: No (or sign the script).
4. Assign to a device group.
5. Users must restart their browser after the policy applies.

Step 3 (optional): Self-healing with a Remediation

A Platform Script runs once. To automatically re-apply the policy if it ever drifts (for example after a token rotation or a machine re-image), use an Intune Remediation — the Detect-DataMagikPolicy.ps1 / Remediate-DataMagikPolicy.ps1 pair that Intune re-runs on a schedule.

1. Edit Remediate-DataMagikPolicy.ps1 with the same token / environment values you used in the deploy script.
2. In Intune go to Devices > Scripts and remediations > Remediations > Create.
3. Upload Detect-DataMagikPolicy.ps1 as the detection script and Remediate-DataMagikPolicy.ps1 as the remediation script.
4. Run both in 64-bit PowerShell, not as the logged-on user. Schedule Daily or Every 8 hours, then assign to a device group.

Option B: Microsoft Intune (OMA-URI)

Manual OMA-URI configuration. Requires the Chrome ADMX templates to be imported into Intune for Chrome policies; Edge ADMX is built in.

Policy 1: Force-install the extension

OMA-URI (Chrome):

./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionSettings

OMA-URI (Edge):

./Device/Vendor/MSFT/Policy/Config/Edge~Policy~microsoft_edge~Extensions/ExtensionSettings

Data type: String    Value:

{
  "hppahoaiaihchdpnoegknnodnjleogdi": {
    "installation_mode": "force_installed",
    "update_url": "https://clients2.google.com/service/update2/crx"
  }
}

Policy 2: Managed storage (bearer token + environment)

This is a separate OMA-URI policy — not nested inside ExtensionSettings.

OMA-URI (Chrome):

./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy

OMA-URI (Edge):

./Device/Vendor/MSFT/Policy/Config/Edge~Policy~microsoft_edge/3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy

Data type: String    Value:

{
  "bearerToken": "dcp_YOUR_BEARER_TOKEN_HERE",
  "environment": "production",
  "lockEnvironment": false
}

Option C: Windows Group Policy (GPO)

Step 1: Install Chrome ADMX templates

1. Download the Chrome ADMX templates from Google Chrome Enterprise.
2. Copy chrome.admx to \\domain\sysvol\domain\Policies\PolicyDefinitions\ (and the matching .adml to the language subfolder).

Step 2: Force-install

1. Open Group Policy Management Console (gpmc.msc).
2. Navigate to Computer Configuration > Administrative Templates > Google Chrome > Extensions.
3. Open Configure extension installation allow/blocklist.
4. Add: hppahoaiaihchdpnoegknnodnjleogdi;https://clients2.google.com/service/update2/crx

Step 3: Configure managed storage via registry

The bearer token and settings live in the 3rdparty registry path:

Chrome:

HKLM\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy

Edge:

HKLM\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy

Or apply this registry file (datamagik-policy.reg):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy]
"bearerToken"="dcp_YOUR_BEARER_TOKEN_HERE"
"environment"="production"
"lockEnvironment"=dword:00000000

Option D: Google Admin Console

1. Navigate to Devices > Chrome > Apps & extensions.
2. Find or add the DataMagik Automate extension by ID: hppahoaiaihchdpnoegknnodnjleogdi.
3. Set Installation policy to "Force install".
4. In the Policy for extensions field, enter:

{
  "bearerToken": { "Value": "dcp_YOUR_BEARER_TOKEN_HERE" },
  "environment": { "Value": "production" },
  "lockEnvironment": { "Value": false }
}

Generating a bearer token

1. Sign in to DataMagik.
2. Open Your Account > API Keys (or have an admin generate one).
3. Create a new API key — the token starts with dcp_.
4. Copy the full token into your managed policy.

Verification & diagnostics

1. Extension settings page

Open the extension popup and go to Settings. The Enterprise Policy Diagnostics card at the top shows the overall status (Configured / Partially Configured / Not Configured), whether chrome.storage.managed is accessible, the bearer token's presence and validation status, the environment and lock settings, and any specific issues to fix.

2. Chrome / Edge policy page

1. Open chrome://policy (or edge://policy) and click Reload policies.
2. Confirm the extension appears under ExtensionSettings with status OK, and that the 3rdparty policy shows bearerToken, environment, and lockEnvironment.

3. Managed storage directly

If auto-login still fails, check managed storage from the extension's service worker console (chrome://extensions > Developer mode > service worker):

chrome.storage.managed.get(null, (result) => {
  if (chrome.runtime.lastError) {
    console.error('No managed storage:', chrome.runtime.lastError.message)
  } else {
    console.log('Managed storage:', JSON.stringify(result, null, 2))
  }
})

You should see {bearerToken: "dcp_...", environment: "production", lockEnvironment: false}. "Storage manifest not found" means no managed policy is deployed for this extension.

Troubleshooting