Configuring the Browser Extension Sensor

SailPoint Browser Agent Security (SBAS) provides visibility and supports GenAI governance processes across both managed and unmanaged SaaS environments. It operates in users' browsers to detect, correlate, and enhance the governance of GenAI-related activities, without requiring any end-user configuration or interaction.

The browser extension can be deployed in the following browsers:

• Chromium-based browsers (Google Chrome, Microsoft Edge, Brave, Opera, and others)
• Enterprise browsers
• AI browsers

Configuring the Browser Extension in Agentic Fabric

1. Go to the Deploy Sensors step of the Agentic Fabric onboarding experience.
2. Select Browser Extension from the left pane.

3. In the Configure Identity Provider section, configure your identity provider.

4. Select Test Connection to ensure the connection is successful.

5. In the Browser Extension section, select your MDM provider from the Installation Methods dropdown list. The guides for the deployment will automatically populate.

6. Select Go to documentation for the browser and operating system your organization uses.

7. Follow the steps to deploy the browser extension.

8. Select Continue to continue setting up Agentic Fabric.

Supported Identity Providers

Agentic Fabric can integrate with external IdPs to provide the browser extension visibility into SaaS usage and risk throughout your organization. Once integrated with your chosen IdP, the browser extension might be able to:

• Allow the browser extension and Shadow AI Remediation administrators to authenticate against the IdP.

• Read the list of SaaS business apps that have been installed in your organization and parse SSO logs to continuously detect accounts using SSO.

• Review the IdP configurations.

Available IdP integrations include:

• Microsoft Entra ID - Use for integration with Microsoft Entra ID IdP.

• Okta - Use for integration with Okta IdP.

Deployment and Operation

Deployment is supported by any MDM solution, including Intune, Jamf, and Workspace ONE. Once deployed, the browser extension installs and begins operation.

Supported MDM Solutions
Intune	Chrome for Windows	Edge for Windows	Chrome for Mac
Microsoft SCCM	Chrome for Windows	Edge for Windows
Group Policy (GPO)	Chrome for Windows	Edge for Windows
Jumpcloud	Chrome for Windows		Chrome for Mac
Jamf Pro			Chrome for Mac	Edge for Mac
Chrome Enterprise					Chrome Enterprise
Workspace ONE UEM			Chrome for Mac
Powershell template	Chrome	Edge

SailPoint recommends deploying the browser extension in a locked state to prevent users from disabling it. For cases requiring flexibility, the browser extension supports temporary pause functionality, governed by role-based policy controls.

If disabled or temporarily suspended, the browser extension will not operate as described.

The browser extension automatically authenticates using the logged-in user’s corporate identity, ensuring continuous correlation to the employee’s IdP account.

Intelligent Sign-In Detection

Using a generic sign-in detection algorithm, the browser extension recognizes authentication events across any web application. This includes commercial business applications such as Salesforce and Workday, applications accessed for personal (non-work) purposes, applications developed in house, and unsanctioned applications.

For each login event, the browser extension:

• Detects the username used during authentication.
• Evaluates password complexity.
• Checks whether the password has appeared in any known breach databases.

Correlation and Identity Context

Because users are authenticated against the enterprise IdP, the browser extension correlates all discovered accounts and credentials back to the verified corporate identity. This enables Agent Fabric to map the full relationship between a user’s primary identity and every account they access across the SaaS environment.

Activity and Metadata Logging

The browser extension records detailed activity logs with contextual metadata. Logged events include:

• Browsing session initiation.
• File uploads and downloads.
• Credential submissions and sign-ins.
• Clipboard paste and print operations.

This telemetry can be aggregated and analyzed at the browsing-session level, providing security and compliance insights without capturing private content.

Privacy and Control

Admins can define allowlists and bypass rules for specific websites to preserve user privacy.

Password complexity and keyword checks are performed entirely on the client side, while compromised and reused passwords are validated using a cryptographically hashed version of the password that is designed to ensure that no plaintext credentials are exposed.

Important

The browser extension does not differentiate between personal applications and business applications, or between a user’s personal activities and business activities. It will capture the same details for personal activities conducted using any browser in which the extension is deployed. Customers are responsible for ensuring that the collection and use of personal activity data complies with applicable law and contract terms, which may include obtaining consent and/or notifying users about potential personal data collection and processing. Contact your legal department with any questions.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.