GenGuard: GPO and Intune rollout
Practical GPO/Intune checklist to force-install GenGuard and push tenant configuration.
GenGuard: GPO and Intune rollout
Use this checklist after GenGuard entitlement, policy ownership, and a pilot group are established. Exact administrative labels vary by browser and management-platform release. Cloud Portal → Deployment and your browser vendor’s current enterprise documentation are the sources of truth for tenant values and policy placement.
Before you start
- Confirm the supported Windows and browser versions in your environment.
- Confirm that Chrome or Edge administrative templates are current where GPO requires them.
- Open Deployment and obtain the extension and organization configuration for the correct tenant and browser.
- Create separate pilot and production assignments so deployment can advance or roll back by ring.
- Resolve policy conflicts from older extension deployments or overlapping MDM and GPO scope.
- Prepare synthetic allowed and blocked test cases.
Intune workflow
- Create a browser configuration profile using the policy type your organization supports.
- Add the GenGuard extension to the browser force-install policy using the value from Deployment.
- Add the managed organization configuration exactly as displayed for that tenant.
- Assign both settings to the same pilot users or devices unless your design intentionally separates them.
- Check for conflicting profiles and review the management service’s deployment status.
- Synchronize a pilot device, restart the browser when needed, and confirm the browser reports the policies as managed.
- Validate Browser Agents and Live Events before broad assignment.
Use a consistent assignment model. Mixing a user-targeted installation policy with a device-targeted tenant configuration can produce partial deployment when only one side applies.
GPO workflow
- Use the approved Chrome or Edge administrative templates already maintained by your organization.
- Configure the browser’s extension force-install policy with the GenGuard value from Deployment.
- Configure the tenant-specific managed settings in the location documented by Deployment.
- Link the GPO to a pilot OU and verify security filtering and inheritance.
- Refresh policy through your normal administrative method, then restart the browser if required.
- Confirm the effective policy on the endpoint and verify that a standard user cannot remove the extension.
- Run controlled policy tests and confirm portal reporting.
Avoid configuring the same browser through both GPO and Intune unless co-management ownership is explicit. When settings disagree, effective behavior may be difficult to diagnose.
Validation checklist
- Device received the intended management profile or GPO.
- Browser reports the force-install and organization settings as managed.
- Extension is present and non-removable by a standard user.
- Browser Agents identifies the correct endpoint and shows a recent check-in.
- An allowed synthetic test completes normally.
- A blocked synthetic test produces the expected user result and Live Event.
- Browser restart and user sign-in do not remove management.
- Policy and assignment changes are recorded in your change process.
Troubleshooting sequence
- Confirm the device or user is in the intended assignment or OU.
- Check management-platform status before troubleshooting GenGuard itself.
- Inspect effective browser policy and look for duplicate or conflicting entries.
- Verify the extension value and organization configuration came from the same tenant.
- Restart the browser and confirm it is the managed browser channel.
- Check Browser Agents Last Seen.
- Reproduce with synthetic data and review Live Events.
If installation succeeds but tenant reporting does not, focus on managed organization configuration and conflicts. If neither installation nor configuration applies, focus on GPO/MDM assignment and browser policy ingestion.
Production expansion
Expand in measured rings. Track installation coverage, recently active Browser Agents, block volume, business exceptions, and support cases. Keep pilot devices enrolled after production rollout so future policy changes can be validated first.