Set up AI Account Guard

Answer a few questions and download a ready-to-deploy file for Jamf, Microsoft Intune or the Google Admin console. It takes about five minutes.

Everything here runs in your browser. Nothing you enter is sent to StratIT. Details

1 Your organization

Only accounts on your email domains will be able to sign in to AI services.

Work email domain

The part after the @ in your staff's email addresses.

Other email domains (optional)

Alias or subsidiary domains, one per line. Use *.example.org to include subdomains.

Organization name

Shown to staff when a sign-in is blocked.

Support message

Also shown when a sign-in is blocked.

Company sign-in page (optional)

Where the "Go to company sign-in" button sends people.

2 Sign in with Microsoft or Google

Personal Apple, GitHub, X and phone sign-ins are always blocked. Microsoft and Google sign-in can be allowed for your organization's accounts only.

Allow "Sign in with Microsoft" for our Microsoft 365 accounts Microsoft refuses accounts from other organizations. Personal Microsoft accounts (Outlook.com, Hotmail) are always blocked.

Microsoft tenant ID

Filled in by Look up. Also in the Entra admin center under Overview.

Allow "Sign in with Google" for our Google Workspace accounts Google refuses personal Gmail accounts and accounts from other organizations.

More options

Sign people out of AI services when the extension is installed Ends personal sessions that were already open before rollout. Recommended for a first rollout.

Apply the Microsoft and Google account limits to

The second option also stops staff signing in to customer or vendor accounts anywhere in Chrome.

3 AI services

Work accounts only lets staff use the service with an account on your domains. Block stops the site from loading.

4 Download and deploy

Choose how you manage your computers.

Device management

Jamf ProMacs Microsoft IntuneWindows PCs Google Admin consoleChromebooks and managed Chrome

Browsers

Google Chrome

Microsoft Edge Edge installs AI Account Guard from the Chrome Web Store too, and keeps its own settings.

Turn off private browsing and guest mode Extensions don't run in incognito, InPrivate or guest windows, so staff could sign in there unchecked. Recommended.

Jamf already installs AI Account Guard For example from its Chrome Web Store link. You'll get the settings only.

In Jamf Pro, go to Computers → Configuration Profiles → Upload and choose the downloaded .mobileconfig file.
Scope it to your computers and save. The profile installs the extension and its settings in each browser you chose, and turns off private browsing and guest mode.

In Jamf Pro, open the configuration profile that installs AI Account Guard (or create one with the same scope).
Add Application & Custom Settings → Upload.
Preference Domain: com.google.Chrome.extensions.jhhgomolhbopcedgcnilbggglnfikmfd
Upload the downloaded .plist file and save.
For Edge, add a second Application & Custom Settings → Upload with the same file and Preference Domain com.microsoft.Edge.extensions.jhhgomolhbopcedgcnilbggglnfikmfd. If Jamf doesn't install the extension in Edge yet, untick "Jamf already installs" to get a profile that does.
To turn off private browsing, add Application & Custom Settings for com.google.Chrome with IncognitoModeAvailability = 1 and BrowserGuestModeEnabled = false, and for com.microsoft.Edge with InPrivateModeAvailability = 1 and BrowserGuestModeEnabled = false.

In the Intune admin center, go to Devices → Scripts and remediations → Platform scripts → Add → Windows 10 and later.
Upload the downloaded .ps1 script. Set Run this script using the logged on credentials to No and Run script in 64 bit PowerShell Host to Yes.
Assign it to your device group. The script installs the extension and writes its settings in each browser you chose, turns off private browsing and guest mode, and is safe to run again after changes. Other force-installed extensions are left alone.

First: make sure the Admin console reaches your computers' Chrome

Chromebooks are covered automatically. On Windows PCs and Macs, the Admin console only manages Chrome that is enrolled in Chrome Enterprise Core, which is free with Google Workspace. Enrolled Chrome gets your settings in every profile, so staff can't get around them with a personal profile.

In the Admin console, go to Chrome browser → Managed browsers and click Enroll (the + button) to get an enrollment token for the org unit your staff are in.
Paste the enrollment token here to fill in the commands below (stays in your browser)
Put the token on each computer, then quit and reopen Chrome. Use your device management or a login script for more than a few machines.
Windows (Command Prompt as administrator):
Mac (Terminal):
Check it worked: chrome://management says the browser is managed by your organization, and the computer appears under Managed browsers in the Admin console.

Without enrollment, the settings below reach Chrome only for staff who sign in to Chrome with their work Google account, and only in that profile. A personal Chrome profile on the same computer isn't covered.

In the Admin console, go to Chrome browser → Apps & extensions → Managed browsers (or Users & browsers if you aren't enrolling browsers) and select the org unit.
Click + → Add Chrome app or extension by ID, enter jhhgomolhbopcedgcnilbggglnfikmfd, and set Installation policy to Force install.
Paste the copied settings into the extension's Policy for extensions box and save.
To turn off private browsing, go to Chrome browser → Settings for the same org unit and set Incognito mode to Disallow incognito mode and Browser guest mode to Prevent guest browser logins.
The Admin console manages Chrome only. For Microsoft Edge, use Intune or Jamf.

Show the file

5 Check it worked

On one managed computer, after the settings have had a few minutes to arrive:

Open chrome://policy (in Edge, edge://policy) and click Reload policies. There should be a section for jhhgomolhbopcedgcnilbggglnfikmfd with your settings and no errors.
Open AI Account Guard's settings (its icon in the toolbar). Its Status section should show Settings "From your organization", Installed by "Your organization", and no problems. If something's wrong, it says how to fix it.
Go to chatgpt.com and try to log in with a personal address such as someone@gmail.com. It should be blocked. Your work address should go through.

If the settings page still lets people make changes, or says your IT team hasn't sent its settings yet, the extension was installed without its settings. Repeat step 4.

What this page sends: when you click Look up, your domain is sent to Cloudflare's public DNS service to see who handles your email, and to Microsoft to find your tenant ID. Nothing you enter is sent to StratIT, and the file is made in your browser. AI Account Guard privacy policy · Source on GitHub