Implementing Application Experience Management

On Windows, deployment and removal is handled by the 1E Client service itself without any user interaction.

Deployment

1. By default for 1E Client, AXM web monitoring is disabled, you can enable it by toggling the Module.Interaction.WebSessions.Enabled configuration setting to true. You can do this by one of the following methods:

   • Setting it in the 1E.Client.conf file.

   • Setting it at install time be passing the mentioned property to MSIEXEC.

   • Use the Client Deployment Assistant (CDA) to deploy the 1E Client, and change the value of Module.Interaction.WebSession from false to true, prior to running the CDA.

   • If you have already deployed the 1E Client, you can run this instruction using Endpoint Troubleshooting:

     Set 1E Client configuration property <agentconfig> to <agentconfigvalue> and restart the service after a short random delay

     With the values selected:  Set 1E Client configuration property "Module.Interaction.WebSession.Enabled" to "true" and restart the service after a short random delay

2. When enabled, the 1E Client service ensures the correct registry settings are in place for the AXM browser extension on each startup. The deployment is carried out for both Google Chrome and Microsoft Edge browsers.

3. At this point the AXM extension will be deployed by the running 1E Client service. You can find it under the extensions page after a browser restart.

4. You will be able to see the Your browser is managed by your organization on the extension page as follows:

   

   

Removal

You can remove the AXM extension using the 1E Client service.

If the Module.Interaction.WebSessions.Enabled is set to false, the 1E Client will delete the relevant registry key values corresponding to the 1E Client and remove the AXM extension. The same process is also triggered when the 1E Client is uninstalled.

You can deploy the MacOS configuration profile in two ways, MDM or manually.

Configuration Profile for 1E Web Extension for MAC OS: 1E Web Plugin.mobileconfig

MDM:

• Your IT team must deploy this configuration profile using their respective MDM tool.

• If the browser (Chrome or Edge) is already running it will need to be restarted before the web extension loads.

Manual steps (User Interaction):

1. Download the configuration profile for Mac OS.

2. Double click the file to install the configuration profile.

3. A notification will show on the top right corner of the window.

   

4. Navigate to the profile window using this path: choose Apple menu > System Settings, click Privacy and Security in the sidebar, then click Profiles.

5. Click the 1E Web Extension Settings entry in the downloaded list and complete the steps to set up the admin password as prompted.

6. At this point the AXM extension will be deployed by the running 1E Client service if the Module.Interaction.WebSessions.Enabled configuration setting is set to true. After restarting the browser you can find it under the extensions page.

7. You will be able to see the Your browser is managed by your organization on the extension page.

Removal

You can remove the MacOS extension using either MDM which is the preferred way, or using manual steps (user interaction).

MDM (preferred)

• Your IT team should pull this configuration profile back using their respective MDM tool.

• If the browser (Chrome or Edge) is already running it will need to be restarted before the web extension unloads.

Manual steps (user interaction)

Navigate to the profile window as follows:

1. On your Mac, choose Apple menu > System Settings, click Privacy and Security in the sidebar, then click Profiles.

2. Select the 1E Web Extension Settings entry form the list.

3. Click the “-” icon at the bottom to remove the selected profile and select Remove button on the window.

   

4. Enter the password for admin account to complete the removal of the 1E Web Extension Configuration Profile.

The deployment is handled by the 1E Client service itself without any user interaction. You can also deploy manually.

Deployment using the 1E Client service

The 1E Client service is responsible for deploying and removing the 1E AXM browser extension according to the value of the configuration setting Module.Interaction.WebSession.Enabled. If set to true, the 1E AXM browser extension is deployed and removed if set to false. Refer to 1E Client configuration for details.

Manual steps

1. Create the following directory if it does not already exist:

   1. Google Chrome /etc/opt/chrome/policies/managed

   2. Microsoft Edge /etc/opt/edge/policies/managed

2. If the above directory was already present and a *.json file already existed, add the following key value pairs corresponding to the AXM extension. These keys are arrays of strings and if already present in the *.json file add the values to the corresponding keys as strings to the array.

   1. ExtensionInstallAllowlist: [ceiaibmchnpfjpehgahbnefnchamhgop]

   2. ExtensionInstallForcelist: [ceiaibmchnpfjpehgahbnefnchamhgop;http://localhost:7781/axm/web/extension.xml]

   3. ExtensionInstallSources: [http://localhost:7781/*]

3. If a *.json is not present create an empty file named Policies.json and add the following lines to it:

   Copy

   {
     "ExtensionInstallAllowlist":["ceiaibmchnpfjpehgahbnefnchamhgop"],
     "ExtensionInstallForcelist":["ceiaibmchnpfjpehgahbnefnchamhgop;http://localhost:7781/axm/web/extension.xml"],
     "ExtensionInstallSources":["http://localhost:7781/*"]
   }

4. At this point the AXM extension will be deployed by the running the 1E Client service if the Module.Interaction.WebSessions.Enabled configuration setting is set to true. You should be able to find it under the extensions page after a browser restart.

5. You will be able to see the Your browser is managed by your organization on the extension page as follows:

   

Removal

You can remove the AXM extension using the 1E Client service. If the Module.Interaction.WebSessions.Enabled is set to false, the 1E Client will delete the relevant registry key values corresponding to the 1E Client and remove the AXM extension. The same process is also triggered when the 1E Client is uninstalled.

Manual steps

To remove the extension you can remove the values from the *.json file added as part of the deployment steps. If a *.json file was not already being used to manage the browser you can completely delete the file.

When AXM Web Monitoring is enabled, the 1E Client service manages the browser extension by writing the relevant registry key values for Chrome and Edge. When the Module.Interaction.WebSessions.Enabled setting is set to false, or when the 1E Client is uninstalled, the 1E Client service automatically removes those registry key values, which causes the AXM browser extension to be unloaded from the browser.

If the browser is already running when this change occurs, it will need to be restarted before the extension unloads. This is expected behaviour, the extension is only present and active when the 1E Client service is running and AXM Web Monitoring is enabled.

When AXM Web Monitoring is enabled, AXM configures browser extension policies at the machine level to ensure the AXM browser extension is always present and cannot be removed by the user. To do this, AXM creates or updates several Chrome and Edge enterprise registry policies, including ExtensionInstallAllowlist, ExtensionInstallForcelist, and related keys.

If no machine-level extension policy exists prior to AXM installation, AXM creates the relevant registry keys and adds its own extension. Chrome and Edge give machine-level policies higher precedence than cloud-delivered policies, such as those managed through Intune. Once a machine-level ExtensionInstallAllowlist exists, the browser treats that list as authoritative and ignores any Intune-managed allowlist.

AXM is designed to append its extension to any existing machine-level policies rather than replacing them. However, if extensions are managed exclusively through Intune, those extensions do not exist in the local machine registry. When AXM creates a machine-level allowlist for the first time, the browser switches to using that list exclusively. This can appear as though AXM has overwritten the Intune-managed allowlist, but AXM has not removed any existing machine-level entries, the behaviour is caused by browser policy precedence.

Workaround: If you manage your browser extension policies through Intune, you should also add any required extensions to the machine-level registry policy alongside AXM's entries. Managing allowed extensions solely through Intune is not supported when AXM Web Monitoring is enabled, as machine-level policies will always take precedence.

To install AXM browser through Intune, you must follow these steps:

1. Set Module.Interaction.WebExtension.ManagedDeployment config in 1E client to false.

2. Setup a browser extension policy in Intune with:

{

"ceiaibmchnpfjpehgahbnefnchamhgop": {

"installation_mode": "force_installed",

"update_url": "http://localhost:7781/axm/web/extension.xml"

}

}