Deploy Haven to everyone with Google Workspace

Does each person have to install it?

No, not if you push it from the Admin console:

Setting Haven's installation policy to 'Force install + pin to browser toolbar' in the Google Admin console installs Haven silently, keeps its icon visible on the toolbar, and stops users removing it.

Before the push, send staff a short note that a security extension is coming and who to ask about it.

Before you start

• This applies to managed Chrome on ChromeOS, Windows, macOS and Linux, for users signed in to a browser profile managed by your Workspace domain.
• You need an admin account with the Chrome management privilege, under Services and Chrome Management.
• Installing and pinning Haven across a Google Workspace organization needs no setup on the Haven side.
• Installing or pushing the Haven extension does not add anyone to your Haven organization; that happens through Haven's invite or sign in flow.

The value you need

On the Chrome Web Store, the Haven extension is listed under the name Haven, publisher starthaven.com, with the extension ID becohfjpbibfjlfeiphcjecdjbdhomgi.

Option 1: the Admin console (most organizations)

1. Sign in to the Google Admin console and go to Devices, then Chrome, then Apps & extensions, then Users & browsers.
2. In the left-hand tree, select the organizational unit or group to deploy to. Settings apply to everyone below that unit unless something lower overrides them. To pilot first, see the OU or Group guide.
3. Click + in the lower right and choose Add from Chrome Web Store.
4. Search for Haven or paste the extension ID, and check the listing shows the publisher starthaven.com.
5. Set Installation policy to Force install + pin to browser toolbar.
6. Leave Permissions at the default. Haven needs its declared permissions to work, so the Admin console Permissions setting should stay at its default.
7. Click Save.

To force the policy onto one machine straight away, open chrome://policy and click Reload policies.

Option 2: a policy file

If you manage Chrome policy as JSON or through the registry, for example with Intune, Jamf or an RMM, set ExtensionSettings for the Haven extension ID:

• installation_mode: force_installed installs Haven and stops users removing it.
• toolbar_pin: force_pinned pins the icon and stops users unpinning it.
• update_url: https://clients2.google.com/service/update2/crx, so the browser pulls Haven from the Chrome Web Store.

Deliver it through whatever manages those browsers: Group Policy on Windows, a configuration profile on macOS, or the JSON policy file on Linux and ChromeOS. Pick one method per organizational unit. Using the Admin console and a policy file on the same unit can produce conflicting policy.

Optional: automatic sign in

Automatic Haven sign-in on managed Chrome needs three things: Haven's sign-in client set to Trusted in the Google Admin console's App access control for the same people you force-installed Haven for, a Chrome profile signed in to the person's Workspace account, and a Haven organization with a verified domain and automatic enrollment turned on.

To approve Haven's sign in app: in the Admin console go to Security, then Access and data control, then API controls, then App access control. Choose Add app, then OAuth App Name Or Client ID, search for the Haven sign in client ID your Haven contact gives you (it ends in .apps.googleusercontent.com), choose the same OU or group you deployed to, and set access to Trusted.

Confirm it worked

1. Open chrome://extensions on a targeted machine. Haven shows as Installed by your administrator, switched on, with no Remove button.
2. The Haven icon is pinned on the toolbar.
3. chrome://policy lists the Haven extension ID under ExtensionInstallForcelist or ExtensionSettings.

What this does not cover

• Microsoft Edge. This guide covers Chrome only.
• Adding people to your Haven organization. See the Set up your Haven organization guide.