Enrollment ties one browser to your organization. Until a browser is enrolled, shim blocks prompts and file attachments in recognized ChatGPT, Claude, Gemini, Grok and Perplexity composers and asks the employee to finish setup.

Managed browsers enroll themselves with an enrollment key that IT sets beside apiUrl. A one-time code enrolls a single browser by hand. A key or code enrolls into one team, or No team, and the browser starts on that team’s policy, so create the team first.

Create a one-time code

1. In the console, open Devices and choose Add browser, then One browser. When no browser is enrolled yet, the steps are on the page itself.
2. Under Joins team, choose the team the browser should join, or No team. A team you just created, or one open in Devices, is preselected.
3. Choose Create enrollment code.
4. Copy the code and the platform URL shown beside it.

Each code enrolls one browser, works once and expires after 10 minutes. An organization can hold up to 100 unused codes at a time. Only administrators can create codes.

Enroll the browser

1. Open the shim extension from the browser toolbar and choose Open settings.
2. Under Enroll this browser, enter the Platform URL, paste the One-time enrollment code and give the browser a Device name of up to 80 characters.
3. Choose Enroll this browser. The browser asks for no extra permission.

The browser receives its own device credential and the policy of its team, or the default policy. It appears in Devices as soon as enrollment completes and updates with each sync. For the first browser, check its policy, its reports and a test request.

Enrollment keys

An enrollment key enrolls every managed browser that has it, into one team or No team, until an administrator revokes it. Set it as the enrollmentKey managed setting; see Managed settings.

Only administrators create and see keys:

1. In the console, open Devices and choose Add browser, then Managed rollout. When no browser is enrolled yet, the steps are on the page itself.
2. Under Joins team, choose the team the browsers should join, or No team. A team you just created, or one open in Devices, is preselected.
3. Choose Create enrollment key. The console shows the key only this once and stores it hashed, so copy it now or use the IT policy beside it, which already holds it. While the key is shown, its team stays fixed; Choose another team returns to the team choice. Closing the dialog keeps the key active. A successful creation shows the key even if the following workspace refresh fails; copy it before closing. Revoking that key clears it from the shown IT policy.
4. Under IT policy, choose the browser and the operating system, then copy or download the policy and deploy it. The Windows and macOS files replace any ExtensionSettings you already set, and a second Linux file that sets it conflicts; when you have one, paste the entry Copy shim’s entry copies inside it instead, or on macOS merge shim’s entry from the generated profile’s ExtensionSettings into yours. See Install the extension.

The IT policy holds your console’s address and this release’s extension ID. Opened later, it shows ENROLLMENT_KEY in place of a key, so replace that with the key you deployed or create a new one. When the console can’t serve this release’s signed package, the policy says so: browsers can’t install or update from it until the console’s image includes the package.

Active keys lists each key’s team and when it was created. To revoke one, choose Revoke beside it and confirm. A revoked key enrolls nothing more, so browsers not yet enrolled with it, such as new laptops and profiles, stay blocked in AI apps until you deploy another key; browsers it already enrolled stay enrolled until you revoke them. Deleting a key’s team moves the key to No team.

Browser limit

An organization can have up to 500 enrolled browsers that aren’t revoked. At the limit, keys and codes enroll nothing more and the extension says the organization has reached its browser limit. Revoked browsers don’t count. Devices lists every browser that isn’t revoked and the 500 most recently revoked. A browser that was reset, or removed from browser policy and added back, enrolls again as a new device, and the old one counts until you revoke it. Each Chrome or Edge profile that runs the extension is its own device.

Check a browser

The extension’s settings show the state of This browser. On a browser with a managed enrollment key, they say it is Managed by your organization in place of the enrollment form and offer no Reset this browser. Until such a browser enrolls, its settings and the toolbar popup show Enrolling, or Can’t enroll when an invalid or revoked key, a revoked browser or a full organization stops it, each with its own message.

Field	Meaning
Policy	The name and version of the policy cached on this browser
Pending events	Reports waiting to be uploaded
Composer	What the last observed AI composer looked like: Ready, Empty draft, Degraded or Unsupported

Sync policy and audit events fetches the current policy and uploads pending reports immediately. The extension also syncs every minute on its own, and its status says when it last synced, such as Synced 2 minutes ago.

In the console, Devices groups browsers by team. Choose All devices, a team or No team, then search or filter by status. Each browser shows its team, its policy and whether it runs the current version, its status and when it last reported.

Status	Meaning
Active	Reported in the last 7 days. Online now means a report in the last 5 minutes
Needs attention	Its last report said its policy is missing or expired, reports can’t upload, or Send was unavailable
Inactive	No report for more than 7 days. The browser may be unused, or shim may have been removed
Revoked	Access was revoked; the browser can no longer sync

Updating next to a policy means the browser hasn’t synced its current version yet. Online browsers update within about a minute.

Select a browser to open its details: its status, its policy and where it comes from, its recent detected requests, the AI apps it used and the AI app accounts seen in its requests (both for administrators only) and its device ID. Administrators can move it to another team, give it its own policy, rename it or revoke it there. Use J and K to step through the list.

Teams

Teams group browsers, for example by department, and give them a policy together. Choose New team under Devices, name it and choose its policy, or keep Default policy. Before any browser is enrolled, New team is at the top of the page, and the new team is chosen under Joins team for the first code or key. Open a team to change its policy, edit it or delete it. Deleting a team moves its browsers to No team; they then use the default policy unless they have their own.

Revoke a browser

Open the device under Devices and choose Revoke access, then confirm. The device stays in the list as revoked and no longer counts toward the browser limit. A revoked browser doesn’t enroll itself again with its key, and a browser with a managed enrollment key can’t be reset from its settings. To enroll it again, remove shim from that browser’s ExtensionSettings policy, so the browser uninstalls it and clears its storage, wait until chrome://extensions (edge://extensions in Edge) no longer lists shim, then add it back: it enrolls with the key within a minute as a new device in the key’s team. A policy you gave the old device alone doesn’t carry over to the new one.

A browser without an enrollment key needs a new code after a reset. See Upgrade and reset.