FIX-1820: Install AitM Blocker browser extension via Intune

• Access to Microsoft Intune admin center
• Global Administrator or Intune Administrator role
• Users must be running Chrome or Edge browsers

Step 1: Navigate to Device Configuration Profiles

1. Open the Microsoft Intune admin center: https://intune.microsoft.com
2. In the left navigation, select Devices
3. Select Configuration profiles
4. Click + New Policy

Step 2: Create Configuration Profile

1. In the Platform dropdown, select Windows 10 and later
2. In the Profile type dropdown, select Settings Catalog
3. Click Create

Step 3: Configure Basic Settings

1. Name: Enter "Attic AitM Blocker Extension"
2. Description: Enter "Deploys Attic AitM Blocker browser extension to protect against phishing"
3. Click Next

Step 4: Configure Extension Settings

For Microsoft Edge:

1. Click Add Settings
2. In the configuration settings, search for "extension"
3. Navigate to: Microsoft Edge\Extensions
4. Find and configure: Control which extensions are installed silently
5. Set to Enabled
6. Add the Attic AitM Blocker extension ID: ioelelfnpappeljacbaiedmfkgkiafeg
7. Click OK

For Google Chrome:

1. Click Add Settings
2. In the configuration settings, search for "extension"
3. Navigate to: Google Google Chrome Extensions
4. Find and configure: **Configure the list of force-installed apps and extensions**
5. Set to Enabled
6. Add: ogkdpcgpikhdlbnpmikodokfdbheajgm
7. Click OK

1. Click Next to proceed to Assignments tab (skip Scope tags)
2. Under Included groups, click + Add groups
3. Select the groups that should receive the extension (e.g., "All Users" or specific security groups)
4. Click Select
5. Click Next

Step 6: Review and Create

1. Review all settings
2. Click Create to deploy the policy

Step 7: Verify Deployment

1. Navigate to Devices > Configuration profiles
2. Find your "Attic AitM Blocker Extension" policy
3. Click on the policy to view deployment status
4. Monitor the deployment status under Device status and User status

Notes

• The extension will be automatically installed on user devices
• Users cannot disable or remove the extension
• The extension runs silently in the background and only activates when AitM threats are detected
• No user interaction is required after deployment

User Communication:

It is recommended to inform users about this security enhancement before deployment:

• Explain that the extension protects against sophisticated phishing attacks
• Inform them that they may see security warnings on suspicious websites
• Provide a helpdesk contact for questions or concerns
• Share that this is part of the organization's security improvement initiatives