How do I roll out FrontTailor via group policy?

With the browser policies ExtensionSettings or ExtensionInstallForcelist, from the store or self-hosted with your own update.xml. FrontTailor’s own configuration comes via managed storage, on Windows in the registry under 3rdparty\extensions.

How do I restrict FrontTailor to certain SAP hosts?

With the allowedHosts policy. On other hosts the popup shows a block notice and FrontTailor does not connect. An empty list blocks all hosts.

How do I switch off single modules?

With the modules policy, for example {"ai": false}. The tab disappears and the extension refuses the module’s messages, without a restart.

Does every user still have to grant the domain?

Yes. Even with a policy, every user grants a domain once in the popup. allowedHosts only restricts.

Enterprise deployment

For IT administrators: force-install FrontTailor in Chrome and Edge – from the store or self-hosted – and use policies to decide on which hosts it runs, which systems are PROD and which modules are active.

Edition: from Enterprise
Installation: ExtensionSettings or ExtensionInstallForcelist
Configuration: managed storage (chrome.storage.managed)
Tools: GPO, registry, Intune, macOS profile, Linux JSON
Takes effect: without restart

Three ways to distribute

Way	Extension ID	Updates
Chrome Web Store	assigned by the Chrome Web Store	automatically via the store
Edge Add-ons	assigned by Edge Add-ons – a different ID than in the Chrome Web Store	automatically via Edge Add-ons
Sideload (self-hosted)	derived from the fixed key of the signed CRX	via your own `update.xml`

Every policy refers to the ID of the way you actually use. A policy for the Chrome Web Store ID does not apply to the Edge ID or to the sideload ID. The examples use <extension-id> as a placeholder.

Requirements

Chrome or Edge 137 or later.
Self-hosted extensions can only be forced on managed devices: on Windows in an Active Directory domain, joined to Microsoft Entra ID or enrolled in Chrome Enterprise Core; on macOS via MDM, MCX or Chrome Enterprise Core. On Linux they can always be installed. For Edge on Windows without a domain join, forced installation is limited to extensions from Edge Add-ons.
For the sideload, an HTTPS web server for update.xml and the CRX.

Force the installation

Recommended for the sideload: the ExtensionSettings policy with override_update_url. Then the browser installs and updates only via your update.xml; FrontTailor’s manifest has no update URL of its own.

{
  "<extension-id>": {
    "installation_mode": "force_installed",
    "update_url": "https://<update-host>/fioritailor/update.xml",
    "override_update_url": true,
    "toolbar_pin": "force_pinned"
  }
}

installation_mode: force_installed (cannot be uninstalled) or normal_installed (can be disabled).
toolbar_pin is optional; minimum_version_required enforces a minimum version.
For the store variant, drop update_url and override_update_url; the ID is then the store ID.

Alternatively ExtensionInstallForcelist with one entry <extension-id>;<update-url> each:

Browser and way	Update URL
Chrome, Chrome Web Store	`https://clients2.google.com/service/update2/crx`
Edge, Edge Add-ons	`https://edge.microsoft.com/extensionwebstorebase/v1/crx`
Chrome or Edge, sideload	`https://<update-host>/fioritailor/update.xml` (for later updates also `ExtensionSettings`)

The update.xml names the ID, the CRX address and the version. Serve the CRX with Content-Type: application/x-chrome-extension and the update.xml without a long cache time. The browser only downloads a version higher than the installed one.

<?xml version='1.0' encoding='UTF-8'?>
<gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'>
  <app appid='<extension-id>'>
    <updatecheck codebase='https://<update-host>/fioritailor/fioritailor-0.1.0.crx'
                 version='0.1.0' prodversionmin='137' />
  </app>
</gupdate>

Configure FrontTailor

FrontTailor reads its own policy from the browser’s managed storage. The schema ships with the extension (managed-schema.json). Changes take effect without a restart: badge, PROD status and tabs update right away.

Key	Type	Effect
`allowedHosts`	list	FrontTailor can only be activated on matching hosts; elsewhere the popup shows a block notice instead of the grant question. An empty list blocks all hosts.
`prodHosts`	list	Matching hosts count as PROD: badge red, runtime changes locked, cannot be switched off in the popup (Host profiles and PROD).
`modules`	object	Switches modules off with `false`, e.g. `odata`, `ai`, `teamsync`, `backend`. The tab disappears, and the background refuses the module’s messages. Overview, system info and badge cannot be switched off.
`licenseKey`	text	Licence key for all users; wins over one entered by the user (Licence and editions).
`trial`	boolean	`false` switches off the 7-day trial of new installations.
`teamSync`	object	Enforced team packages, trusted keys, signature requirement, fetch interval (Team packages).
`issueReporter`	object	Allowed targets and mandatory masking rules for “Report a problem”.
`ticketTargets`, `allowedTicketHosts`	list	Preset ticket targets (Jira, GitHub, GitLab, Azure DevOps, ServiceNow) and allowed ticket hosts. Never put tokens or passwords in here.
`aiEndpoint`, `aiProvider`, `aiAllowedProviders`	text, list	Fixed endpoint and provider of the AI assistant; an empty `aiEndpoint` switches it off.
`aiRequirePiiMasking`	boolean	Masks e-mail, phone, IBAN and long digit sequences before every AI request, cannot be switched off.
`ai.persistKeys`	boolean	`false`: AI keys stay in memory only; stored ones are deleted.
`bookRecommendations`	boolean	`false` hides the book recommendations for everyone.
`telemetry`	boolean	Read but not used: FrontTailor sends no telemetry.

Patterns for allowedHosts and prodHosts: fiori.example.com matches the host on any port, *.example.com the domain and all subdomains, https://*.example.com HTTPS only, fiori.example.com:44300 only this port, * all hosts. Case does not matter, a path in the pattern is ignored.

{
  "allowedHosts": ["*.fiori.example.com", "https://s4dev.example.com"],
  "prodHosts": ["*.prod.fiori.example.com"],
  "modules": { "odata": true, "tools": false },
  "bookRecommendations": false
}

Where the policy goes

System	Location
Chrome on Windows	`HKLM\Software\Policies\Google\Chrome\3rdparty\extensions\<extension-id>\policy`; lists as subkeys with numbered values, booleans as `REG_DWORD`
Edge on Windows	the same path under `Microsoft\Edge` (not officially documented by Microsoft)
Chrome on macOS	configuration profile with the preference domain `com.google.Chrome.extensions.<extension-id>`
Chrome on Linux	`/etc/opt/chrome/policies/managed/`, JSON under `3rdparty.extensions.<extension-id>`
Chrome Enterprise Core	Admin console › Apps & extensions, JSON with a `Value` per key
Intune	installation via the Settings Catalog; the extension policy on Windows via a custom profile or a script that sets the registry values

There is no ADMX for FrontTailor; with GPO you distribute the registry structure via Group Policy Preferences. The registry form for lists and objects has not been verified on a real Windows client yet – check it with chrome://policy before the rollout.

Profiler Companion

The CPU deep profile of the performance profiler (from Pro) runs via the separate, free extension FrontTailor Profiler Companion; only it holds the debugger permission. If you want the deep profile, force both extensions, each with its own ID. If you don’t, don’t install the companion or block it with "installation_mode": "blocked". On PROD hosts FrontTailor never starts the deep profile anyway.

Check the rollout

Open chrome://policy or edge://policy and Reload policies. ExtensionInstallForcelist and ExtensionSettings must appear without errors; Chrome shows FrontTailor’s policy in a section of its own with the extension ID.
Open chrome://extensions: FrontTailor is installed, marked as managed by your organisation and cannot be removed.
Open a host from prodHosts: the badge is red, PROD is set and locked in the popup.
Open a host outside allowedHosts: the popup shows the block notice instead of the grant question.
Open an allowed host: the grant question appears as usual (grant).

Per domainEven with a policy, every user grants the domain once in the popup. allowedHosts only restricts; a grant without a user click is not provided.