Extension Auto Login

DataMagik Automate — Enterprise Policy Configuration & Diagnostics

This guide explains configuration and troubleshooting for the DataMagik Automate browser extension using enterprise management tools including Microsoft Intune, Windows Group Policy (GPO), and other MDM solutions.

Key Concept: Two Separate Policies

Chrome and Edge extensions require two separate policies for force-install + auto-login:

1. ExtensionSettings — forces the extension to install (only installation_mode and update_url)
2. 3rdparty managed storage — provides the bearer token and environment settings to chrome.storage.managed

Priority Order

The extension uses this authentication priority:

1. User-set token — Takes priority if user has logged in manually or set their own token
2. Managed policy token — Used as fallback when no user token exists

This allows users to override enterprise settings while providing default configuration.

Configuration Options Reference

Supported managed settings:

Option A: PowerShell Deployment (Recommended)

The easiest and most reliable method. Writes registry keys directly — no ADMX template import required. Works for both Chrome and Edge.

Step 1: Download the Script

Download Deploy-DataMagikExtension.ps1 from your DataMagik administrator or the extension documentation.

Step 2: Configure

Edit the configuration section at the top of the script:

$BearerToken     = "dcp_YOUR_ACTUAL_TOKEN"    # From DataMagik > Settings > API Keys
$Environment     = "production"                # "production" or "staging"
$LockEnvironment = $false                      # $true to lock environment switching
$Browsers        = "Both"                      # "Both", "Chrome", or "Edge"

Step 3: Deploy via Intune

1. In Intune: Devices > Scripts and remediations > Platform scripts > Add > Windows 10 and later
2. Upload the script
3. Settings:
   • Run this script using the logged-on credentials: No (runs as SYSTEM)
   • Run script in 64-bit PowerShell: Yes
   • Enforce script signature check: No
4. Assign to a device group

The script also supports Remediation mode (detect + auto-fix) for self-healing. See the included Detect-DataMagikPolicy.ps1 and Remediate-DataMagikPolicy.ps1 scripts.

Option B: Microsoft Intune (OMA-URI)

Manual OMA-URI configuration. Requires Chrome ADMX templates to be imported into Intune for Chrome policies. Edge ADMX is built-in.

Policy 1: Force Install the Extension

OMA-URI (Chrome):

./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionSettings

OMA-URI (Edge):

./Device/Vendor/MSFT/Policy/Config/Edge~Policy~microsoft_edge~Extensions/ExtensionSettings

Data type: String

Value:

{
  "hppahoaiaihchdpnoegknnodnjleogdi": {
    "installation_mode": "force_installed",
    "update_url": "https://clients2.google.com/service/update2/crx"
  }
}

Policy 2: Managed Storage (Bearer Token + Environment)

This is a separate OMA-URI policy — not nested inside ExtensionSettings.

OMA-URI (Chrome):

./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy

OMA-URI (Edge):

./Device/Vendor/MSFT/Policy/Config/Edge~Policy~microsoft_edge/3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy

Data type: String

Value:

{
  "bearerToken": "dcp_YOUR_BEARER_TOKEN_HERE",
  "environment": "production",
  "lockEnvironment": false
}

Option C: Windows Group Policy (GPO)

Step 1: Install Chrome ADMX Templates

1. Download Chrome ADMX templates from Google Chrome Enterprise
2. Copy chrome.admx to \\domain\sysvol\domain\Policies\PolicyDefinitions\

Step 2: Force Install

1. Open Group Policy Management Console (gpmc.msc)
2. Navigate to: Computer Configuration > Administrative Templates > Google Chrome > Extensions
3. Open Configure extension installation allow/blocklist
4. Add: hppahoaiaihchdpnoegknnodnjleogdi;https://clients2.google.com/service/update2/crx

Step 3: Configure Managed Storage via Registry

The bearer token and settings go in the 3rdparty registry path:

Chrome path:

HKLM\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy

Edge path:

HKLM\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy

Or use this registry file (datamagik-policy.reg):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\hppahoaiaihchdpnoegknnodnjleogdi\policy]
"bearerToken"="dcp_YOUR_BEARER_TOKEN_HERE"
"environment"="production"
"lockEnvironment"=dword:00000000

Google Admin Console

1. Navigate to Devices > Chrome > Apps & extensions
2. Find or add the DataMagik Automate extension by ID: hppahoaiaihchdpnoegknnodnjleogdi
3. Set Installation policy to "Force install"
4. In the Policy for extensions field, enter:

{
  "bearerToken": {
    "Value": "dcp_YOUR_BEARER_TOKEN_HERE"
  },
  "environment": {
    "Value": "production"
  },
  "lockEnvironment": {
    "Value": false
  }
}

Generating Bearer Tokens

1. Log in to DataMagik
2. Navigate to Settings > API Keys (or your admin may generate them)
3. Create a new API key — the token will start with dcp_
4. Copy the full token for use in the managed policy

Verification & Diagnostics

1. Extension Settings Page

The extension Settings page includes an Enterprise Policy Diagnostics card that shows:

• Overall policy status (Configured / Partially Configured / Not Configured)
• Whether chrome.storage.managed is accessible
• Bearer token presence and validation status (first 10 characters shown)
• Environment and lock settings
• Specific issues and what needs to be fixed

Open the extension popup, go to Settings, and check the diagnostics card at the top.

2. PowerShell Diagnostic Script

Run Check-DataMagikPolicy.ps1 on the target machine to verify registry configuration:

.\Check-DataMagikPolicy.ps1                    # Check both Chrome and Edge
.\Check-DataMagikPolicy.ps1 -Browser Chrome    # Chrome only
.\Check-DataMagikPolicy.ps1 -Browser Edge      # Edge only

The script checks all registry paths, validates the bearer token against the API, and reports issues with recommendations.

3. Chrome Policy Page

1. Open Chrome and navigate to chrome://policy (or edge://policy for Edge)
2. Click Reload policies
3. Verify:
   • The extension appears under ExtensionSettings with status OK (not "Warning")
   • The 3rdparty policy shows bearerToken, environment, and lockEnvironment

4. Check Managed Storage Directly

If auto-login fails, verify storage using the service worker console:

1. Navigate to chrome://extensions and enable Developer mode
2. Find DataMagik Automate and click service worker
3. Run:

chrome.storage.managed.get(null, (result) => {
  if (chrome.runtime.lastError) {
    console.error('No managed storage:', chrome.runtime.lastError.message)
  } else {
    console.log('Managed storage contents:', JSON.stringify(result, null, 2))
  }
})

You should see: {bearerToken: "dcp_...", environment: "production", lockEnvironment: false}

If you see "Storage manifest not found", it means Chrome has no managed policy deployed for this extension.

Troubleshooting

Security Considerations

1. Token Security: Bearer tokens are stored in Chrome's managed storage, protected by the OS. Consider using tokens with minimal required permissions.
2. Token Rotation: Plan for periodic token rotation by updating the policy configuration.
3. User Override: Users can override the managed token by logging in with their own credentials. Set lockEnvironment to prevent environment changes, but user authentication always takes priority.
4. Audit Logging: DataMagik logs authentication events for monitoring managed token usage.