Deploy device configurations

Device Configuration Profiles let you centrally manage browser policies from the Keep Aware console. Define policies once, assign them to device groups, and let Keep Aware automatically sync configurations to endpoints—no MDM or Group Policy required.

What is a Device Configuration Profile?

A Device Configuration Profile is a collection of browser policies that you create and manage in the Keep Aware console. Once assigned to device groups, profiles automatically sync to endpoints running the Keep Aware client. This provides:

• Centralized management - Configure policies in one place, deploy everywhere
• Automatic sync - Devices automatically receive policy updates
• Priority-based resolution - When multiple profiles apply, higher priority wins
• Browser-specific control - Set global policies or target specific browsers

Creating a Device Configuration Profile

1. Navigate to Profiles in the Keep Aware console
2. Click Create profile and select Device configuration profile
3. Configure the profile:
   • Name - A descriptive name for the profile
   • Description - Optional details about the profile's purpose
   • Priority - Set precedence when multiple profiles apply (1=Lowest to 5=Highest)
   • Policies - Configure browser policies using the JSON editor
4. Assign to groups or enable All Devices for tenant-wide deployment
5. Click Save

Supported policies

Device Configuration Profiles support the following browser policies:

PrivateModeAvailable

Controls whether users can open private/incognito browsing sessions.

Values: true (available), false (disabled)

DeveloperToolsAvailable

Controls whether users can open browser developer tools.

Values: true (available), false (disabled)

DisableBrowserGuestMode

Controls whether guest browsing mode is available.

Values: true (disabled), false (available)

ForcedInPrivateMode

Ensures the Keep Aware extension remains active in private/incognito sessions.

Values: true (forced), false (normal)

Homepage

Sets the browser homepage URL.

Values: A valid URL string (e.g., "https://intranet.company.com")

NewTabPage

Sets the page that opens in new tabs.

Values: A valid URL string (e.g., "https://portal.company.com")

PasswordManagerEnabled

Controls the browser's built-in password manager.

Values: true (enabled), false (disabled)

Supported browsers: Chrome, Edge, Firefox, Brave

GenAISidecarEnabled

Controls built-in AI assistant features in browsers.

Values: true (enabled), false (disabled)

Browser-specific features controlled:

• Chrome: Gemini
• Edge: Copilot
• Firefox: GenerativeAI features

AutofillEnabled

Controls browser autofill for addresses and payment methods.

Values: true (enabled), false (disabled)

ExtensionSettings

Advanced configuration for browser extension behavior, including installation modes and permissions.

Values: A map of extension IDs to configuration objects

Installation modes:

• allowed - Extension can be installed by users
• blocked - Extension cannot be installed
• force_installed - Extension is automatically installed (requires update_url)
• normal_installed - Extension is installed but can be disabled by users

See Extension allowlist for a full example.

Policy configuration structure

Policies are configured using JSON with browser selectors:

{
  "*": {
    "DeveloperToolsAvailable": false,
    "PrivateModeAvailable": false,
    "DisableBrowserGuestMode": true
  },
  "chrome": {
    "Homepage": "https://google.com"
  },
  "firefox": {
    "Homepage": "https://mozilla.org"
  }
}

Browser selectors

Selector	Description
*	Global policies applied to all browsers
chrome	Google Chrome
edge	Microsoft Edge
firefox	Mozilla Firefox
brave	Brave Browser
safari	Apple Safari
duckduckgo	DuckDuckGo Browser
arc	Arc Browser
vivaldi	Vivaldi Browser
chromium	Chromium
dia	Dia Browser
atlas	ChatGPT Atlas
comet	Perplexity Comet

Browser-specific policies override global (*) policies for that browser.

Priority and conflict resolution

When a device belongs to multiple groups with different profiles assigned:

1. Each profile has a priority level (1-5)
2. Higher priority profiles take precedence
3. The server resolves conflicts and sends the final merged policy set

Priority levels:

• 5 = Highest
• 4 = High
• 3 = Medium
• 2 = Low
• 1 = Lowest

How sync works

1. Device check-in - The Keep Aware client periodically reports device status
2. Hash comparison - The server responds with a profile hash; the client compares it to the last synced hash
3. Sync if needed - If hashes differ, the client fetches the updated profile
4. Policy application - Policies are merged and applied to all browsers
5. Browser refresh - Browser policy caches are updated

Sync happens automatically during regular device check-ins. No manual intervention is required.

Verifying profile sync

Use the Keep Aware CLI to verify profile status on a device:

# Check sync status
keepaware profile status

# View current profile and policies
keepaware profile get

# Force a manual sync
sudo keepaware profile fetch

Status output

$ keepaware profile status
Profile Status: In sync
Server Hash:  abc123...
Local Hash:   abc123...
Last Synced:  2025-01-28 14:30:00

View applied policies

$ keepaware profile get
Profile Hash: abc123...
Policies:
  * (Global):
    DeveloperToolsAvailable: false
    DisableBrowserGuestMode: true
  chrome:
    Homepage: https://intranet.company.com

Example configurations

Security lockdown

Disable developer tools, guest mode, and private browsing across all browsers:

Security Lockdown

{
  "*": {
    "DeveloperToolsAvailable": false,
    "DisableBrowserGuestMode": true,
    "PrivateModeAvailable": false,
    "ForcedInPrivateMode": true
  }
}

AI controls

Disable built-in AI assistants while keeping password managers enabled:

AI Controls

{
  "*": {
    "GenAISidecarEnabled": false,
    "PasswordManagerEnabled": true
  }
}

Corporate homepage with browser overrides

Set a default homepage with browser-specific customization:

Corporate Homepage

{
  "*": {
    "Homepage": "https://intranet.company.com",
    "NewTabPage": "https://portal.company.com"
  },
  "firefox": {
    "Homepage": "https://intranet.company.com/firefox"
  }
}

Extension allowlist

Allow specific extensions like uBlock Origin. Combine with other security settings:

Extension Allowlist

{
  "*": {
    "DeveloperToolsAvailable": false,
    "PrivateModeAvailable": false,
    "ExtensionSettings": {
      "ddkjiahejlhfcafbddmgiahcphecmpfh": {
        "installation_mode": "allowed",
        "update_url": "https://clients2.google.com/service/update2/crx"
      }
    }
  }
}

Troubleshooting

Profile not syncing

1. Verify the device is checking in successfully in the console
2. Check that the device belongs to a group assigned to the profile
3. Run keepaware profile fetch to force a sync and view any errors

Policies not applying to browser

1. Verify policies are synced: keepaware profile status
2. Check browser policy page:
   • Chrome: chrome://policy
   • Edge: edge://policy
   • Firefox: about:policies
3. Restart the browser after policy changes

Priority conflicts

If unexpected policies are applied:

1. Check which profiles are assigned to the device's groups
2. Verify priority levels—higher priority profiles override lower ones
3. Review the merged policy in keepaware profile get