DomainGuard — Admin Console

Active Rules

—

domain policies

API Tokens

—

active tokens

Devices

—

last 30 days

Audit Events

—

last 30 days

Recent Activity

Loading...

Quick Actions

📖 Deployment guide

Domain Rules

Site Pattern	Email Domain	Priority	Status	Created	Actions
Loading...

⚠ API tokens grant full policy access. Deploy only via Group Policy or Intune — never share publicly.

API Tokens

Label	Preview	Status	Created	Last Used	Actions
Loading...

💡 Next step — deploy the extension

Once you have a token, go to Deploy Extension and paste it in to generate your deployment scripts for Registry, PowerShell, Intune, or Group Policy.

Audit Log

Loading...

🔐 Admin Activity Log

Login/logout events and console actions

Loading...

Organisations

Organisation	Admin Email	Plan	Created	Actions
Loading...

Setup Progress

0 of 4 complete

⚡ Four steps to full deployment

1

⚡ Configure your domain rules

Go to Domain Rules → click + Add Rule. Set a site pattern (e.g. *.slack.com) and add your allowed email domains (e.g. @yourcompany.com). Repeat for each site you want to enforce.

💡 Your 5 sample rules are pre-loaded — update @yourcompany.com to your real domain first

2

🔑 Generate an API token

Go to API Tokens → click Create Token. Give it a name like "Production". Copy it immediately — it's only shown once. This token links your devices to your org's policies.

3

🚀 Deploy to devices

Go to Deploy Extension → paste your token → choose your browser (Edge, Chrome or both) → choose a deployment method (Registry, PowerShell, Intune, or GPO) → download the script and run it on your machines. Restart the browser after running.

4

✅ Verify it's working

On a deployed machine, restart Edge or Chrome and visit a site with a rule. Click the email field — you should see the DomainGuard tooltip. Check Audit Log to confirm events are being logged.

📝 How to create a rule

1

Set the site pattern

Enter the URL pattern — e.g. *.slack.com to match all Slack subdomains. See the Reference tab for pattern examples.

2

Add allowed email domains

Enter each allowed domain — e.g. @yourcompany.com, @subsidiary.co.uk. Employees using any other domain will see a warning and the field clears.

3

Enable Block social logins

Toggle on to grey out and disable "Continue with Google", "Sign in with Apple" and similar buttons. Recommended for all sites.

4

Save — changes sync within 15 minutes

Rules are pushed to all deployed extensions automatically. To apply immediately see the Operations tab.

🏢 Recommended rules to set up

Site	Pattern	Notes
Slack	`*.slack.com`	All workspace subdomains
Microsoft 365	`*.microsoft.com`	Teams, Outlook, Azure login
Google Workspace	`*.google.com`	Gmail, Drive, Docs
ChatGPT	`chatgpt.com`	Exact match
OpenAI	`*.openai.com`	Platform and API login
GitHub	`github.com`	Exact match sufficient
Salesforce	`*.salesforce.com`	All instances
Notion	`*.notion.so`	Workspace and share links

📋 Deployment methods

Method	Best for	How to use
Registry File (.reg) Easiest	Single machine or quick testing	Download and double-click — 10 seconds
PowerShell (.ps1)	Small fleets, SCCM	Run as Administrator or push remotely
Intune Recommended	Cloud-managed fleets	Paste JSON into settings catalog
Group Policy	On-premise Active Directory	Add JSON to Edge Extensions policy

Extension IDs

🔵 Microsoft Edge

libdegmefidclooimlkcfmoibfjbmmkf

View in Edge Store ↗

🟢 Google Chrome

glkalfinoghechlhemghdbamejegecem

View in Chrome Store ↗

✓ After deploying, restart Edge — the extension installs automatically and appears in the toolbar within 30 seconds.

🔄 Refreshing policies on devices

The extension syncs rules automatically every 15 minutes. To apply changes immediately:

⚡ Option 1 — Instant

Click the DomainGuard icon in the Edge toolbar → click Refresh Rules

⏱ Option 2 — Automatic

Wait up to 15 minutes — the extension polls in the background automatically

🔧 Option 3 — Hard reset

Open edge://extensions, disable then re-enable DomainGuard, then reload the page

🔑 Option 4 — New token

If you replaced the API token, redeploy the .reg or PowerShell script with the new token and restart Edge

📋 Audit Log events

Event	What it means
rule_match	Policy triggered — warning shown or social login blocked
policy_sync	Extension fetched latest rules — confirms it's connected
token_refresh	Authentication event — token validated
admin_login	Admin signed in to the console

🛠 Troubleshooting

Issue	Fix
Extension not in Edge	Re-run .reg as Administrator and fully restart Edge
No tooltip on login page	Check the site pattern matches the exact URL in the browser bar
Rules not updating	Click extension icon → Refresh Rules, or wait 15 minutes
No audit events	Verify the API token in your .reg matches one in API Tokens
Google sign-in not blocked	Edit the rule and enable Block social logins

🔍 Site Pattern Reference

Pattern	Matches	Does not match
`*.slack.com`	myco.slack.com, app.slack.com	—
`slack.com`	slack.com only	myco.slack.com
`*.microsoft.com`	login.microsoft.com, teams.microsoft.com	outlook.live.com
`*.google.com`	accounts.google.com, mail.google.com	google.co.uk
`chatgpt.com`	chatgpt.com	*.openai.com
`*.openai.com`	platform.openai.com, auth.openai.com	chatgpt.com

💬 FAQ

Can employees bypass the extension?

Not if deployed via Intune or GPO — it's force-installed and can't be removed by users. With .reg only, a local admin could remove it.

Does it work offline?

Yes. Rules are cached locally and enforced even without internet access. They sync when connectivity is restored.

Can I have different rules for different departments?

Yes — create separate API tokens for each group and deploy different tokens to different machines.

Does it capture passwords or browsing data?

No. DomainGuard only checks the domain portion of email fields on matched login pages. No passwords or browsing data is ever captured.

What happens when I update a rule?

Changes apply server-side immediately. Deployed extensions pick it up within 15 minutes, or instantly via the Refresh Rules button.

💬 Need help? We'll walk you through it. Email support →

Current Plan

Starter

£29/mo

Up to 25 devices

10 domain rules

30 day audit log

Email support

Pro Popular

£79/mo

Up to 200 devices

Unlimited rules

90 day audit log

Priority support

Enterprise

£199/mo

Unlimited devices

Unlimited rules

1 year audit log

SSO + dedicated SLA

Upgrade, downgrade, view invoices and manage your payment method

PRIMARY ADMIN

Full access. Can manage team, roles, billing and all settings.

ADMIN

Full access except Billing. Can manage rules, tokens, and team.

AUDIT USER

Read-only. Can view Dashboard, Domain Rules and Audit Log.

ACCOUNTS USER

Finance access only. Can view Dashboard and Billing.

👥 Team Members

Email	Role	MFA	Joined	Actions
Loading...

📨 Pending Invites

Email	Invited By	Expires	Actions
No pending invites

🚀 Deploy the Extension

Choose your deployment method below. You'll need an API token — generate one from API Tokens first.

Your API Token

Token never leaves your browser — scripts are generated locally.

Browser

Download and double-click on each machine. Works for Microsoft Edge and Google Chrome. No IT knowledge required.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\libdegmefidclooimlkcfmoibfjbmmkf\policy]
"api_token"="PASTE_YOUR_TOKEN_ABOVE"
"api_url"="https://api.domainguard.co"

After running: restart Microsoft Edge. Extension activates automatically.

Run as Administrator on each machine. Can be deployed via SCCM or run manually.

# DomainGuard Deployment Script — Run as Administrator

$EdgeExtId = "libdegmefidclooimlkcfmoibfjbmmkf"
$ApiToken  = "PASTE_YOUR_TOKEN_ABOVE"
$ApiUrl    = "https://api.domainguard.co"

$EdgePath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\$EdgeExtId\policy"
New-Item -Path $EdgePath -Force | Out-Null
Set-ItemProperty -Path $EdgePath -Name "api_token" -Value $ApiToken
Set-ItemProperty -Path $EdgePath -Name "api_url"   -Value $ApiUrl

Write-Host "DomainGuard configured for Edge" -ForegroundColor Green
Write-Host "Restart Edge to apply." -ForegroundColor Yellow

Edge: Intune → Devices → Configuration → Settings catalog → Microsoft Edge → Extensions → Configure extension management settings

{
  "libdegmefidclooimlkcfmoibfjbmmkf": {
    "installation_mode": "force_installed",
    "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",
    "managed_configuration": {
      "api_token": "PASTE_YOUR_TOKEN_ABOVE",
      "api_url": "https://api.domainguard.co"
    }
  }
}

Also add force-install entry: libdegmefidclooimlkcfmoibfjbmmkf;https://edge.microsoft.com/extensionwebstorebase/v1/crx

Chrome: Intune → Devices → Configuration → Settings catalog → Google Chrome → Extensions → Configure extension management settings

{
  "glkalfinoghechlhemghdbamejegecem": {
    "installation_mode": "force_installed",
    "update_url": "https://clients2.google.com/service/update2/crx",
    "managed_configuration": {
      "api_token": "PASTE_YOUR_TOKEN_ABOVE",
      "api_url": "https://api.domainguard.co"
    }
  }
}

Also add force-install entry: glkalfinoghechlhemghdbamejegecem;https://clients2.google.com/service/update2/crx

⚠ Prerequisite: Browser ADMX templates must be installed on your DC. Edge ADMX ↗ · Chrome ADMX ↗

1

Open Group Policy Management (gpmc.msc)

Right-click your target OU → Create a GPO in this domain, and link it here → name it DomainGuard — Edge Extension

2

Force install the extension

Right-click GPO → Edit → Computer Config → Policies → Admin Templates → Microsoft Edge → Extensions → Configure the list of force-installed extensions → Enabled → Show → add:

libdegmefidclooimlkcfmoibfjbmmkf;https://edge.microsoft.com/extensionwebstorebase/v1/crx

3

Configure managed storage (API token)

In the same Extensions folder → Configure extension management settings → Enabled → paste this JSON:

{
  "libdegmefidclooimlkcfmoibfjbmmkf": {
    "installation_mode": "force_installed",
    "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",
    "managed_configuration": {
      "api_token": "PASTE_YOUR_TOKEN_ABOVE",
      "api_url": "https://api.domainguard.co"
    }
  }
}

4

Link GPO to your OU

Ensure the GPO is linked to the OU containing your target computers. Tick Enforced to override local policies.

5

Apply and verify

On a target machine, run as Administrator:

gpupdate /force

Then fully restart Edge. Check edge://extensions to confirm the extension is installed.

⚡ Or create the GPO via PowerShell (run on DC)

Update $TargetOU to your AD path before running.

# DomainGuard - Create GPO via PowerShell
# Run on Domain Controller as Administrator

$GpoName   = "DomainGuard - Edge Extension"
$TargetOU  = "OU=Computers,DC=yourdomain,DC=com"
$EdgeExtId = "libdegmefidclooimlkcfmoibfjbmmkf"
$ApiToken  = "PASTE_YOUR_TOKEN_ABOVE"
$ApiUrl    = "https://api.domainguard.co"

Import-Module GroupPolicy
$Gpo = New-GPO -Name $GpoName -Comment "Forces DomainGuard extension on Edge"

Set-GPRegistryValue -Name $GpoName `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist" `
  -ValueName "1" -Type String `
  -Value "$EdgeExtId;https://edge.microsoft.com/extensionwebstorebase/v1/crx"

Set-GPRegistryValue -Name $GpoName `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\$EdgeExtId\policy" `
  -ValueName "api_token" -Type String -Value $ApiToken

Set-GPRegistryValue -Name $GpoName `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\$EdgeExtId\policy" `
  -ValueName "api_url" -Type String -Value $ApiUrl

New-GPLink -Name $GpoName -Target $TargetOU -Enforced Yes
Write-Host "Done! Run gpupdate /force on target machines." -ForegroundColor Yellow

Extension IDs

🔵 MICROSOFT EDGE

libdegmefidclooimlkcfmoibfjbmmkf

View in Edge Store ↗ View in Chrome Store ↗

🟢 GOOGLE CHROME

glkalfinoghechlhemghdbamejegecem

View in Chrome Store ↗

Total Orgs

—

all clients

Active Subs

—

paying clients

On Trial

—

in trial period

Suspended

—

suspended orgs

Subscription Breakdown

Loading...

Recent Platform Activity

Loading...

All Organisations

Organisation	Plan	Status	Rules	Last Active	Actions
Loading...

Loading...

All Admins

Email	Organisation	Role	MFA	Joined	Actions
Loading...

Platform Audit Log

Loading...