Enable Shield Web in Incognito windows

Shield only protects what it can see. By default Chrome does not run extensions in Incognito windows, so AI usage in Incognito stays unmonitored until Shield Web is allowed there. Once allowed, your existing session, policies, and enforcement extend into Incognito automatically — no separate sign-in.

Allow it yourself

1. Open chrome://extensions in Chrome.
2. Select Details on the Shield Web card.
3. Turn on Allow in Incognito.

That's it. Shield Web shares one session across normal and Incognito windows, so protection in Incognito starts immediately.

For admins: make coverage mandatory

Chrome cannot silently enable an extension in Incognito — the user has to allow it once. For guaranteed org-wide coverage, combine force-install with Chrome's mandatory-Incognito policy: until a user allows Shield in Incognito, Chrome blocks Incognito browsing for them entirely. Either way, there is no unmonitored gap.

{
  "ExtensionInstallForcelist": ["<EXTENSION_ID>;https://clients2.google.com/service/update2/crx"],
  "MandatoryExtensionsForIncognitoNavigation": ["<EXTENSION_ID>"]
}

In the Google Admin console: Devices → Chrome → Settings → Users & browsers → search for Mandatory extensions for Incognito navigation and add the Shield Web extension ID. Other MDMs deploy the equivalent managed configuration.

Note: MandatoryExtensionsForIncognitoNavigation is a recent Chrome enterprise policy — confirm it appears in your management console's policy list before relying on it.

Check who is covered

Each seat reports its Incognito coverage state to Shield Control, so admins can see at a glance which users are protected in Incognito and which still have the gap.