Roll out Shield Web via managed policy

For org-wide coverage you don't want to rely on everyone self-installing. Chrome's enterprise policies let you force-install Shield Web, enforce monitoring as the organization, and make Incognito coverage mandatory.

Force-install the extension

Add Shield Web to Chrome's force-install list — via the Google Admin console (Devices → Chrome → Apps & extensions) or the equivalent managed configuration in your MDM (e.g. Intune):

{
  "ExtensionInstallForcelist": ["<EXTENSION_ID>;https://clients2.google.com/service/update2/crx"]
}

The extension then appears for every managed user, cannot be removed by them, and updates automatically.

Enforce monitoring (organization as controller)

Self-installed copies ask each user for consent before collecting anything. In a managed deployment your organization can consent as the data controller instead: deploy the managed configuration with collection enforced, and no in-extension consent prompt appears. Employees see the monitoring toggle on and locked, with a note that the policy is enforced by their organization — the data guarantees (no prompts, no content, no sensitive values) are unchanged.

For Intune and other MDMs, deploy the equivalent 3rdparty.extensions.<EXTENSION_ID> managed configuration.

Close the Incognito gap

By default Chrome does not run extensions in Incognito, so AI usage there would stay unmonitored. Combine force-install with the mandatory-Incognito policy so users must allow Shield in Incognito before they can browse Incognito at all — the full recipe is in Enable Shield Web in Incognito windows.

Verify the rollout

Each installed seat reports in to Shield Control: Users & Roles shows per-member consent state and Incognito coverage, and Discovery starts filling as the team browses. That is your rollout dashboard — no spreadsheet needed.