# Install Nightfall AI Extension via Google Workspace Admin

Nightfall typically deploys the extension through common install methods, such as:

* macOS: macOS Profile
* Windows: MSI and registry key entries

However, some administrators utilize Google Workspace for extension deployment to Chrome.  Here are two methods to deploy the Nightfall extension successfully using Google Workspace:

1. [Policy Precedence](#option-1-policy-precedence-preferred) (Preferred)
2. [Policy MergeList](#option-2-policy-mergelist)

{% hint style="warning" %}
**IMPORTANT**:  Nightfall does not know your environment.  Each organization has to decide for themselves what method of deployment to utilize in their own environment.
{% endhint %}

### Option 1: Policy Precedence *(Preferred)*

*Within Google Workspace, set the Policy Precedence as **Machine Cloud**.*

This is the preferred method of installing Nightfall, due to the control of the app deployment being handled and secured by Google Workspace cloud as opposed to the individual machine.

This option will include the following changes:

* Changing Policy Precedence to **Machine Cloud**.
* Adding the **Nightfall DLP for Browsers** app to Google Workspace.
* Adjusting the Nightfall extension to **Force Install**.
* Enabling the extension when in **Incognito mode**.

{% hint style="info" %}
**NOTE**: If the Policy Precedence is NOT changed to Machine Cloud, and Google Workspace is being utilized for extension deployment, Nightfall's profile that is deployed via MDM will override any conflicts that occur with Google Workspace.  This is why it is being recommended to change Policy Precedence to Machine Cloud and control extension deployment via Google Workspace.

Only proceed if this is appropriate for your environment.
{% endhint %}

1. From within the Google Workspace Admin console, adjust the Policy Precedence.
   1. Click on **Chrome Browser** > **Settings** > Select the **OU**
   2. Navigate down to **Setting sources**
   3. Confirm Policy precedence is set to **Machine Cloud** first.
      1. If yes, leave it as-is.
      2. If not, adjust it to Machine Cloud.
         1. Click into the **Policy precedence** setting.
         2. Click on the "Configuration" flow under Inheritance.\
            It may look like this:<br>

            <figure><img src="https://3764378997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZeqNSdo8J8cLJPU3Gs5M%2Fuploads%2FZEPIn41BkCYvKZrBTtUf%2Fimage.png?alt=media&#x26;token=1941bec0-fe92-4328-8065-4e70580ae8fb" alt=""><figcaption></figcaption></figure>
         3. &#x20;Select **Machine Cloud** as the primary configuration.<br>

            <figure><img src="https://3764378997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZeqNSdo8J8cLJPU3Gs5M%2Fuploads%2FttgwfjDDWb2kYz5qxVhf%2FScreenshot%202026-03-26%20at%208.44.36%E2%80%AFPM.png?alt=media&#x26;token=bb080eee-7494-4d07-be05-fcb9c860c4ad" alt=""><figcaption></figcaption></figure>
         4. Click **Save**&#x20;
2. From within the Google Workspace Admin console, add the Nightfall DLP extension to Force Install so it automatically deploys.
   1. Navigate to **Devices** > **Chrome** > **Apps & Extensions**
   2. Select the appropriate OU.
   3. Identify the **Nightfall DLP for Browsers** app
   4. If the Nightfall DLP for Browsers app is not present, then install it from the Chrome Web Store.
      * Click the yellow circle with the + symbol at the bottom right.
      * Select "Chrome Web Store"
        * Name: Nightfall DLP for Browsers
        * ID: jgmgecncmjklkabkejnjfgfkglapfgek
   5. Once the Nightfall DLP for Browsers app is visible, select it.
   6. Change **Allow install** to **Force install**
   7. Toggle on **Extension is mandatory for Incognito**<br>

      <figure><img src="https://3764378997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZeqNSdo8J8cLJPU3Gs5M%2Fuploads%2F8FDAJEcNFND2B8adhkum%2FScreenshot%202026-03-26%20at%209.05.52%E2%80%AFPM.png?alt=media&#x26;token=fc4bc0c7-cc77-4045-ba03-70fc7bc4d6d7" alt=""><figcaption></figcaption></figure>
   8. Click **Save**

### Option 2: Policy MergeList

*Within Google Workspace, set the Policy MergeList to merge policies from both sources - Cloud and Machine.*

This is a last resort method to use if you do not want to adjust the Policy Precedence, and instead accept policies from both Google Workspace and direct from the machine (e.g., MDM Profile).

{% hint style="warning" %}
**IMPORTANT**: This takes control away from Google Workspace and allows both Cloud and Machine policies of equal importance to coexist.  It is recommended to use Option 1, instead of Option 2, in most scenarios.
{% endhint %}

1. From within the Google Workspace Admin console, navigate to **Devices** > **Chrome** > **Settings**.
2. Under **Setting sources**, select **Policy mergelist**
3. Select the specific **Organizational Unit** for your deployment scope.
4. Under **Configuration**, specify individually the two policies, `ExtensionInstallForceList` and `ExtensionSettings` (one per line).
5. Confirm the policy is applied in: **chrome://policy**
6. Check that the **Source** shows as **Merged** for the policies you want merged.