How are you deploying Okta Browser plugins to users? Skip to main content
https://support.okta.com/help/answers?id=906f0000000xzloiao&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fanswers
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Ask Search:
MidCap Administrator AdminMidCap Administrator Admin 

How are you deploying Okta Browser plugins to users?

Not exactly an Okta question but how is everyone deploying the IE/Chrome/Firefox plugins to end users who are not local admins?

I am running into issues on this.

Thanks!
James GarvinJames Garvin (Okta)
You can do it via GPO and it isn't too bad, just escalate the priveleges.  If you have SCCM or some software deployment tool you can do that too.

You'll just need to follow Chrome's deployment here: 
https://developer.chrome.com/extensions/packaging

Firefox will require some fiddling, as it isn't super friendly anymore.

IE, when you deploy the MSI, just use the /q for a quiet installation.  Remember the browswer will have to be restarted, so you may want to have a way to open/close the browser to make sure the plugin registered.  
Parth SwadasParth Swadas
Hi,

Go to settings -> Customization -> Browser plugin and change to below :
IT manages Okta Plugin -> No
Enable Okta toolbar for group -> Everyone

Now if users are assigned SWA applications, then they will get prompt to install plug-in. It takes a few sec only and pretty easy. In Chrome / Firefox, users will be install plug-ins. On IE, admin rights are required which can be achieved through GPO.
MidCap Administrator AdminMidCap Administrator Admin
Anyone have an example of GPO with this working?  I cant seem to find the right settings and plugins arent being installed for local users.

Thanks!
Okta AgentOkta Agent

We only have a couple of users that are set up this way. They cannot be trusted not to go get that free iPad on the internet. LOL 

I just logged in as admin and installed it for them but that wouldn't be a good idea for large organizations. 

Carter MaxwellCarter Maxwell
We push Okta to workstations with PDQ Deploy. It runs the MSI package with /q as an admin on their box. It installs without issue. We haven't been able to enable it automatically for our users though. We've tried the GPO to enable the add-on automatically but it has never worked. We still have to go into IE Tools > Manage add-ons > Select OktaBHO Class > Enable for each and every user. It is especially frusterating on conference room computers since each time someone logs in for the first time, it has to be enabled.

Here's the documentation we are following for reference.
https://support.okta.com/help/articles/Knowledge_Article/27598646-Installing-Plugin-3-x-with-Internet-Explorer-9-and-10?fs=RelatedArticle&l=en_US

None of our users have admin on their workstations.
Andre Dupre KuiperAndre Dupre Kuiper
We're using SCCM and I was able to get it working in a test environment. Our users do not have admin rights.

First, we did have to whitelist the OktaHelpder and OktaBHO following the instructions on the guide that Carter mentions. However, Instead of "User Configuration" I set it under Computer Configuration instead of User Config as suggested in the Okta guide. 

https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy 

I then add as an application with script installer using the following code.
REM force quit any running IE
c:\windows\system32\Taskkill /IM iexplore.exe /F
REM install Okta plugin
msiexec.exe /i "okta.swa.ie-5.6.3.msi" /q

Detection Method
HKEY_LOCAL_MACHINE\SOFTWARE\Okta\IE Plugin\Version
Type = String
Equals = 5.6.3

User Experience
Behavior: Install for system
Logon: whether or not user is logged in 
Visibility: Hidden

Still having trouble with the uninstall command line. It runs the uninstaller but isn't successful.
REM force close IE
c:\windows\system32\Taskkill /IM iexplore.exe /F
REM Uninstall via msi
msiexec.exe /x "%~dp0okta.swa.ie-5.6.3.msi"

 
Rob PragerRob Prager
For Chrome is is quite easy. Take a look at this screenshot of my config. I setup a Chrome GPO, used at the Computer layer as ADM template. With this setup the install is transparent to your users and there is no other need for pushing packages via software deployment tools. IE is a little more work, but I will post that next.
User-added image
Rob PragerRob Prager
For IE you will need to create a new GPO. I decided to install via the User Configuration rather than Computer Configuration. The difference being, if done at the User layer, the software package will install at user login vs. Computer layer when the software package is installed at power on/startup. 

User Configuration/Software Settings - right click Software installation, selection New/Package, locate your package/software (ideally use the IE .msi installer) and ensure it is on a share/location where accessible to all authenticated users. Deployment will be Assigned, option is to install at logon.

User Configuration/Administrative Templates/Windows Components/Internet Explorer/Security Features/Add-on Management - double click Add-on List, Enable it, select Add-on List SHOW, enter:
Value Name / Value
{E411779C-5CFE-413F-A57B-18C55A4EFADA} / 1
{302700E7-59EF-49EC-9439-EA590552D1ED} / 1
Select OK. Then Select OK again.

User Configuration/Administrative Templates/Windows Components/Internet Explorer - double click Automatically activate newly installed add-ons, Enable, Selection OK.

GPO is all done.

User-added image
User-added image
User-added image

Good luck!