Installing using MDM

Use this instead of the tenant-only preinstall script below when Macs cannot contact Quilr Discovery. Every environment key shown must be present. Ask support@quilr.ai for each value because the URLs depend on where the tenant is onboarded. Change browsers to firefox,safari when an existing-customer rollout must leave Chrome/Edge untouched.

#!/bin/bash
set -euo pipefail
umask 077
cat > /tmp/quilr-be-install.json <<'EOF'
{
  "tenant_id": "<TENANT-ID>",
  "skip_discovery": "1",
  "PLASMO_PUBLIC_TENANTID": "<TENANT-ID>",
  "PLASMO_PUBLIC_BFF_ENDPOINT": "<VALUE-FROM-QUILR-SUPPORT>",
  "PLASMO_PUBLIC_OAUTH_URL": "<VALUE-FROM-QUILR-SUPPORT>",
  "PLASMO_PUBLIC_OAUTH_LOGIN_URL": "<VALUE-FROM-QUILR-SUPPORT>",
  "PLASMO_PUBLIC_DLP_END_POINT": "<VALUE-FROM-QUILR-SUPPORT>",
  "PLASMO_PUBLIC_UPDATE_URL": "<VALUE-FROM-QUILR-SUPPORT>",
  "BASE_URL": "<VALUE-FROM-QUILR-SUPPORT>",
  "browsers": "chrome,edge,firefox,safari"
}
EOF
chown root:wheel /tmp/quilr-be-install.json
chmod 600 /tmp/quilr-be-install.json
exit 0

• Tenant pkg: https://quilr-extensions.quilr.ai/installer/mac/quilrai-browser-extension.pkg
• Tenant .mobileconfig from the Quilr console (Settings → Browser Extension → Deployment → MDM → macOS / Intune)
• File-Access .mobileconfig: https://quilr-extensions.quilr.ai/browser-agent/prod/mac/quilr_browser_util_Files_Access.mobileconfig

Devices → Configuration → Create → New Policy, macOS, Templates → Custom. Name them “Quilr Browser Extension — Tenant Approval” and “— File Access,” deployment channel Device, assign to MAC-Quilr-Extension.

Deploy as a separate macOS shell-script app (system context), Required, same group, ordered to run before the PKG. The pkg reads /tmp/quilr-be-install.json (/Users/Shared/… is a copy only).

Existing customers (Chrome/Edge already installed — Firefox + Safari only)

#!/bin/bash
set -euo pipefail
mkdir -p /tmp /Users/Shared
cat > /tmp/quilr-be-install.json <<'EOF'
{
  "tenant_id": "<TENANT_ID>",
  "browsers": "firefox,safari"
}
EOF
cp /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json
chmod 644 /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json

New customers (new-certificate installer — all browsers)

#!/bin/bash
set -euo pipefail
mkdir -p /tmp /Users/Shared
cat > /tmp/quilr-be-install.json <<'EOF'
{
  "tenant_id": "<TENANT_ID>",
  "browsers": "chrome,edge,firefox,safari"
}
EOF
cp /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json
chmod 644 /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json

Apps → Add → macOS app (PKG) (unmanaged), upload quilr-installer-mac.pkg, publisher “Quilr AI,” assign Required to the same group.

Tenant pkg (CDN), tenant .mobileconfig (Quilr console → macOS / Jamf Pro), and the public File-Access .mobileconfig.

Upload each .mobileconfig as a separate Configuration Profile — “Quilr Browser Extension — Tenant Approval” and “— File Access” — Computer Level, Install Automatically, scoped to your macOS group.

Attach as a policy script that runs before the package. The pkg reads /tmp/quilr-be-install.json (/Users/Shared/… is a copy only).

Existing customers (Chrome/Edge already installed — Firefox + Safari only)

#!/bin/bash
set -euo pipefail
mkdir -p /tmp /Users/Shared
cat > /tmp/quilr-be-install.json <<'EOF'
{
  "tenant_id": "<TENANT_ID>",
  "browsers": "firefox,safari"
}
EOF
cp /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json
chmod 644 /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json

New customers (new-certificate installer — all browsers)

#!/bin/bash
set -euo pipefail
mkdir -p /tmp /Users/Shared
cat > /tmp/quilr-be-install.json <<'EOF'
{
  "tenant_id": "<TENANT_ID>",
  "browsers": "chrome,edge,firefox,safari"
}
EOF
cp /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json
chmod 644 /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json

Upload the pkg (display name “Quilr Browser Extension,” category Endpoint Security). Create a policy “Install Quilr Browser Extension” — Recurring Check-in, Once per computer — attach the preinstall script (Before), then the package, and scope to the same group.

Tenant pkg (CDN), tenant .mobileconfig (Quilr console → macOS / Kandji), public File-Access .mobileconfig.

Library → Add Library Item → Custom Profile for each: “Quilr Browser Extension — Tenant Approval” and “— File Access.” Run on macOS; assign to your Blueprint. Profiles install first.

Add a Custom Script on the Blueprint that runs before the Custom App pkg. The pkg reads /tmp/quilr-be-install.json (/Users/Shared/… is a copy only).

Existing customers (Chrome/Edge already installed — Firefox + Safari only)

#!/bin/bash
set -euo pipefail
mkdir -p /tmp /Users/Shared
cat > /tmp/quilr-be-install.json <<'EOF'
{
  "tenant_id": "<TENANT_ID>",
  "browsers": "firefox,safari"
}
EOF
cp /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json
chmod 644 /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json

New customers (new-certificate installer — all browsers)

#!/bin/bash
set -euo pipefail
mkdir -p /tmp /Users/Shared
cat > /tmp/quilr-be-install.json <<'EOF'
{
  "tenant_id": "<TENANT_ID>",
  "browsers": "chrome,edge,firefox,safari"
}
EOF
cp /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json
chmod 644 /tmp/quilr-be-install.json /Users/Shared/quilr-be-install.json

Library → Add Library Item → Custom App, upload the pkg, name “Quilr Browser Extension,” configure Audit & Enforce (request the script from Quilr support), assign to the same Blueprint after the preinstall Custom Script.

Retrieve https://quilr-extensions.quilr.ai/installer/windows/Quilr.msi and place it on the Endpoint Central server or upload it directly.

Software Deployment → Add Package → Add Windows Package. Name “Quilr Browser Extension,” category Security, browse to Quilr.msi. In MSI/MSP Properties enter:

TENANT=<TENANT-ID>

Configurations → Add Configuration → Install MSI Software. Name “Install Quilr Browser Extension,” select the package, Run as System, target WIN-Quilr-Extension, Deploy.

Deploy ExtensionSettings via a Custom Script configuration:

$JSON = @'{"piajhjohgigijkddhdpgbjdcfhmammbk": {"installation_mode": "force_installed","override_update_url": true,"toolbar_state": "force_shown","update_url": "https://quilr-extensions.quilr.ai/<TENANT-ID>/manifest.xml"}}'@

foreach ($key in @('HKLM:\SOFTWARE\Policies\Microsoft\Edge','HKLM:\SOFTWARE\Policies\Google\Chrome')) {
  if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
  Set-ItemProperty -Path $key -Name 'ExtensionSettings' -Value $JSON -Type String
}

# Firefox uses a different layout: a subkey per add-on with one value per
# property (a single JSON blob is silently ignored). No update_url field —
# the update endpoint is baked into the signed .xpi.
$ff = 'HKLM:\SOFTWARE\Policies\Mozilla\Firefox\ExtensionSettings\firefox-extension@quilr.ai'
New-Item -Path $ff -Force | Out-Null
Set-ItemProperty $ff -Name installation_mode -Value 'force_installed' -Type String
Set-ItemProperty $ff -Name install_url -Value 'https://quilr-extensions.quilr.ai/firefox/prod/firefox-mv2-prod.xpi' -Type String
Set-ItemProperty $ff -Name updates_disabled -Value 0 -Type DWord

Download https://quilr-extensions.quilr.ai/installer/windows/Quilr.msi and place it on a UNC source share the site server can read, e.g. \\sccm\Sources\Apps\QuilrExtension\Quilr.msi.

Software Library → Application Management → Applications → Create Application. Choose type Windows Installer (*.msi) and point it at Quilr.msi. Name “Quilr Browser Extension,” publisher “Quilr AI.” On the generated deployment type, override the install command line:

msiexec /i "Quilr.msi" TENANT=<TENANT-ID> /qn /norestart

Keep the auto-generated MSI product-code detection rule. Set installation behavior Install for system and logon requirement Whether or not a user is logged on. Distribute Content to your distribution points.

Deploy the application to the WIN-Quilr-Extension device collection with purpose Required and schedule As soon as possible; clients install on the next machine-policy cycle.

SCCM only ships the MSI. To force-install / pin the extension, deliver the ExtensionInstallForcelist / ExtensionSettings policy for extension ID piajhjohgigijkddhdpgbjdcfhmammbk via Active Directory Group Policy (Administrative Templates → Edge / Chrome) — the same JSON shown in the Intune · Windows and ManageEngine tabs. AD-managed fleets usually push this through GPO already.

For Firefox, load the Mozilla ADMX templates into your GPO central store (Administrative Templates → Mozilla → Firefox → Extensions) and force-install add-on ID firefox-extension@quilr.ai from https://quilr-extensions.quilr.ai/firefox/prod/firefox-mv2-prod.xpi — or push the registry values shown in the ManageEngine tab (subkey per add-on; a single JSON blob is ignored by Firefox).