The Substly browser extension is an important tool to help detect Shadow IT and monitor SaaS usage across your organization. Following this guide, deployment should take minutes.
Let's get started!
Step 1: Activate your Extension in Substly
Go to your Substly Extension view and press Activate.
Download the 📦 Substly ADMX files.
Copy your unique Substly Key.
Step 2: Import the Substly ADMX files to Intune
Go to Intune Admin Center and Devices → Configuration → Import ADMX.
Import the Substly .admx and .adml files for Windows, Chrome and Edge.
⚠️ Make sure Windows ADMX is processed first
For Intune to process additional ADMX files, Windows.admx must be in place.
Upload Windows.admx first and make sure it is fully processed before proceeding. If you already have such a file, you do not have to import it again.
Step 3: Create a policy for the Substly Client Key
Jump to Policies to create a configuration profile.
Select Windows 10 and later as platform, with the profile type Templates.
Find or scroll down to Imported Administrative templates and create.
Name the new policy Substly Client Key.
In the Configuration settings step, open Computer Configuration → Substly → Chrome Extension.
Click on Client key.
Check Enabled and paste in your unique Substly key.
Assign the policy to all Devices, and save.
Repeat these steps for Edge.
✅ Assign the policy to all Devices
The policy itself does not deploy anything to users, only configures future
deployment. We recommend assigning the policy to all devices in this step.
❌ Do not use Excluded groups by mistake
When setting your scope, note that Intune has Included groups above and Excluded groups right below. Make sure to work in the Included section.
Step 4: Deploy the Substly Extension
Create a new policy, with the profile of Settings catalog.
Name this policy Substly Extension Force Install.
In this policy, add settings for Chrome and Edge using the Settings picker.
Add Chrome settings.
Find and select the category:
Google Google Chrome Extensions.
Scroll to the subcategory:
Configure the list of force-installed apps and extensions.
In the left-hand view, Enable this setting to see an input field.
Input the Extension ID and update URL for Chrome:
fkjmkdagklhjcebfnejjkjmfclgnplgd;https://clients2.google.com/service/update2/crx
Staying in the same policy, add Edge settings.
Find and select the category:
Microsoft Edge\Extensions
Scroll to the subcategory:
Control which extensions are installed silently
In the left-hand view, Enable this setting to see an input field.
Input the Extension ID and update URL for Edge:
ghjglhcgjblhpnfcpkgpjbekjmmhjamn;https://edge.microsoft.com/extensionwebstorebase/v1/crx
Assign the policy to your target device group.
⚠️ Deploying additional browser extensions?
Intune does not support multiple policies for silently installing a browser extension - in such cases, it will only deploy one of them.
If you already have such a policy, or add one in the future, make sure to deploy all extensions through a single policy profile.
Optional: Deploy PowerShell script for user identification
If your organization is on an Entra environment, this step might be necessary in order to cover Chrome. If anonymous authentication is sufficient, you can skip this step.
Download our PowerShell script:
In Intune, go to Devices → Scripts and remediations → Platform scripts.
Add a new Platform script.
Select the type Windows 10 and later.
Name it Substly Extension User Key Setter.
In the next step, upload the script under Script location.
Toggle all options in this view to No.
Assign to all Devices and create.
All done! Welcome to real-time SaaS discovery 🥳
Congratulations on a successful deployment of the Substly Extension!
You are now ready to help your organization detect, monitor and handle shadow IT and SaaS usage.
💬 FAQ
Can't find the answer to your particular question? Get in touch.
Q: Are users notified when the Substly Extension is installed?
A: No. Users will not be notified, and do not have to take any action.
Q: Can users see the Substly Extension?
A: Yes, but only if they actively review their browser extensions. There are also Substly features that allow you to communicate with users via the extension.
Q: Can users remove the Substly Extension?
A: No. Forced installation of browser extensions cannot be uninstalled by users.
Q: Can users simply log out from the Substly Extension?
A: No, not if you have followed this guide and the ClientKey is set.
🤔 Troubleshooting
We are happy to help, and can resolve most issues.
Q: Why is my Devices tab in Substly not being populated?
A: This is likely due to an incomplete deployment, where Substly cannot set the ClientKey or UserKey properly. It can also indicate users are not logged into their managed browser profile.
There are two settings under your Extension tab in Substly to resolve this:
Allow login with Device ID
This allows authentication via UserKey. Otherwise, the user needs to be signed into a managed browser profile.
Allow anonymous authentication
This allows anyone to authenticate, as long as they have the ClientKey.
If you have the first setting enabled, and still do not see devices getting populated, enable anonymous authentication to confirm whether the extension is getting installed and ClientKey is being set.