Configure Browsers

Configure different settings on your Browser to prevent filter bypass.

Tech Lockdown Team

A useful feature of Mobile Device Managers is the ability to manage browsers. Ideally, you would restrict the user to only using a managed browser where you can enforce settings, block extensions used to bypass filtering and prevent deletion of browser extensions that block content.

Consider Creating a Custom Profile Just for Browsers

You can manage other web browsers as well, but this tutorial will focus on Google chrome. The management process is the same for the other browsers and the features are similar.

As I recommended in the section about creating a profile, create a dedicated Manage Engine profile that will handle Managed Browser settings.

Also, create a dedicated iMazing config file for managed browser settings.

Ensure you follow my recommended profile creation settings (prevent users from removing the profile and make it system-wide).

Reminder

As mentioned in the Update Profile section, you'll need to restart Google Chrome each time you push an updated Managed Browser profile to the Mac device. Otherwise, you won't see the changes.

Set Chrome as the Default Browser

If you haven't already, install the Google Chrome browser on the Mac device

In iMazing, use the search bar to filter the sidebar for the word "browser" and then select Google Chrome (or whatever browser you want to manage) and select add configuration payload.

In General Settings, set Chrome as the default browser

Browser Profile Options

These are the settings you should change on your profile to prevent bypass on your Mac.

Block Images

You can choose to block images on all websites. Alternatively, you can block images on selective websites.

Select the Content Settings tab

If you want to block images on a specific website, enter [*.] followed by the domain name you want to block. For example, [*.]reddit.com will block all images on the entire reddit.com website. You can optionally specify specific page URLs, like [*.]reddit.com/r/news

If you want to block all images on all websites (other than those on your allowlist), use the Default images setting dropdown.

Disable Proxy

Disable the ability to set a proxy to avoid common filter bypass techniques.

Select the Networking tab

Select Choose how to specify proxy server settings: Never use a proxy.

Guest Mode & User Accounts

Guest mode can allow a user to bypass common blocking techniques, so it's advised to disable it entirely.

Navigate to the Misc tab

Disable Guest Mode by unchecking both of the highlighted boxes

Safesearch & Youtube Restrictions

Toggle safesearch for search engines that have a safesearch mode (including Google search).

In the Misc tab, force safesearch by enabling both of the highlighted boxes

Consider setting a Youtube restriction level

Prevent Deleting Browsing History & Incognito Mode

Add a higher level of accountability by removing the ability to delete browser history or use incognito/private browsing mode.

In the Misc tab, scroll down to the Enable Incognito and Incognito mode availability fields and disable them.

Scroll down and uncheck Enable deleting browser and download history

If You're Enforcing a Browser Extension-Based Content Filter...

If you want to maximize your content blocking options, you might want to install a browser extension in addition to the built-in features on your Mac. To make sure your extension works properly and effectively, you should check the following settings.

Prevent Browser Extension from Being Disabled

If you are using a blocking application like Cold Turkey, it will require you to install a browser extension to work properly.

Ideally, you would prevent the user from removing that browser extension. Here's how to do that.

If the extension is already installed, go to chrome://extensions/ in your address bar and click Details for that extension. Copy the letters after id=

If the extension is not installed already, you can search for it in the Chrome extension store and copy the ID from the extension's store page url.

Edit the iMazing managed browser profile you've been using and navigate to the Extensions tab in

Scroll down to the Extension/App IDs and update URLs to be silently installed and add the extension ID to the table.

If you save the config and push the changes to your Macbook (using the associated Manage Engine profile), you'll see that the extension can't be removed or disabled anymore:

Block a Specific Browser Extension

Using the same process as before, get the extension ID by searching for the extension in the Chrome Extensions store and copying the ID

Back in the Managed Browser config in iMazing, navigate to Google Chrome and select the Extensions tab. Then, paste the extension ID in the Extension ID Blocklist table.

Once you distribute the config file to your Mac device using Manage Engine, you'll see that the extension is blocked.

Block All Extensions Except Approved Extensions

The most comprehensive approach involves blocking all extensions and using an Allow list to manually approve extensions that the user can install and enable.

In the iMazing config, navigate to Google Chrome > Extensions and update the allow list to include the approved extension IDs.

Note

The allowlist does not automatically install and enforce the extensions, but the user will be able to download approved extensions themselves. Add the IDs to the silent installation table if you want to enforce the use of those extensions.

Go to the blocklist section and add an entry with a *, which blocks all extensions other than the ones in your allow list

Once you distribute the config changes using Manage Engine and restart your Chrome Browser, you'll see that all non-approved extensions are blocked: