The two parts of any deployment
However you deploy, you're always doing two things:
Install the extension — force-install the extension so it lands on the device and stays enabled.
Configure the deployment key — link the installed extension to your organization's Nudge Security instance.
Both are required. Install without the key and the extension runs but stays unlinked from your Nudge Security instance, so it reports nothing.
In Endpoint Central, you deliver both parts with PowerShell scripts: an install script and a configure script for each browser, deployed as Windows custom script configurations. The install script must run before the configure script.
Before you begin
In Nudge Security, go to Settings → Browser Extension → Enroll New Users → Managed Deployment → Device Management, select your browser(s), and download the install and configure PowerShell scripts for each browser you support (Chrome, Edge, Firefox).
Targeting is by endpoint, not by user. Endpoint Central custom script configurations target computers. This gives you precise control over which machines get the extension — useful for excluding sensitive systems (build machines, Citrix hosts, kiosks) that need to stay pristine.
Step 1: Add the scripts to the Script Repository
In Endpoint Central, go to Configurations → Script Repository.
Add each of the Nudge PowerShell scripts — the install and configure script for every browser you're deploying to.
Step 2: Deploy the install script
Go to Configurations → Windows → Custom Script and create a Computer configuration.
Name the configuration following your naming convention (e.g., Nudge – Chrome Install).
In the script name field, click Search and select from Script Repository and pick the install script (e.g., the Chrome install script).
Leave Script Arguments and Dependency Files empty. (Dependency files must be uploaded from your local device rather than the Script Repository, so don't use them to chain the configure script — deploy it separately in Step 3.)
Set the Frequency: use Once for a pilot on a test device, but Recurring (every refresh cycle) for your org-wide rollout — see the callout below.
Define the target: select Domain and choose your domain, then filter by Computer and select your test endpoint(s). For the org-wide rollout, target the appropriate devices, groups, or OUs instead.
Choose Deploy immediately and deploy.
Watch Execution Status and refresh until the target shows Succeeded.
Set the frequency to Recurring for your org-wide rollout. A configuration set to run once won't cover browsers installed later. With Recurring, if a user installs (say) Firefox ten days after your rollout, the next refresh cycle force-installs the extension into it automatically. Once is only appropriate for a one-off test — and if you test with Once, you may need to redeploy to that device later.
Step 3: Deploy the configure script
Once the install script shows Succeeded, repeat the same process for the matching configure script:
Configurations → Windows → Custom Script → Computer configuration.
Name it (e.g., Nudge – Chrome Configure).
Select the configure script from the Script Repository. No script arguments or dependency files.
Same frequency and targets as the install configuration.
Deploy immediately and wait for Succeeded.
Step 4: Repeat for each browser
Create the same install + configure pair for every browser you support (e.g., Edge and Firefox). The scripts run safely on devices that don't have the browser installed — they still write the policy entries, so the extension appears automatically if the browser is installed later (provided the frequency is Recurring).
Verify the installation
Once installed and configured, users start showing as Connected on the Browser Extension settings page in Nudge Security (Settings → Browser Extension, then select the browser). Discovery can take up to 72 hours. To check a single device manually:
Chrome and Edge
Is it installed? Go to chrome://extensions (or edge://extensions) and look for the Nudge Security extension. It may take a moment and a browser restart to appear. You can also check chrome://policy / edge://policy, click Reload policies, and confirm the Nudge extension appears in ExtensionInstallForcelist.
Is the deployment key applied? Click the three dots on the Nudge extension and open Options. If a deployment key is shown and the status is Configured, the device is fully set up. Waiting for User means it's still in discovery; NO_DEPLOYMENT_KEY means the configure script didn't apply.
Firefox
Is it installed? Go to about:addons and look for the Nudge Security browser extension. Restarting Firefox is often needed before it picks up the new policy.
Is the deployment key applied? In about:addons, open the extension's Preferences and check for the same three states as above.
Finally, have the user sign in to a work app or their email in the deployed browser — the extension registers their session to your Nudge Security instance, and they'll appear under Settings → Browser Extension for that browser.
Troubleshooting
The configuration succeeded but the extension isn't in the browser. Restart the browser, then check chrome://policy (or edge://policy) and click Reload policies. If the Nudge entry is missing from ExtensionInstallForcelist, confirm the install configuration targeted this computer and shows Succeeded.
The extension is installed but shows NO_DEPLOYMENT_KEY. The configure script didn't run or ran before the install script. Redeploy the configure configuration to the device and confirm it shows Succeeded.
Succeeded on a device without the browser. That's expected — the script writes the policy entries regardless. The extension appears when the browser is installed, on the next refresh cycle if your frequency is Recurring.
Need Help?
Still stuck after working through this guide? Reach out through the Intercom chat in the bottom-right of your screen and we can assist.