Brave Browser: 1.90.128 to 1.92.134

This policy provides a list of sites that users can quickly search using shortcuts in the address bar. Users can initiate a search by typing the shortcut or @shortcut (e.g. @work), followed by Space or Tab, in the address bar. The following fields are required for each site: name, shortcut, url. The name field corresponds to the site or search engine name to be shown to the user in the address bar. The shortcut can include plain words and characters, but cannot include spaces or start with the @ symbol. Shortcuts must also be unique. For each entry, the url field specifies the URL of the search engine used during a search with the corresponding keyword. The URL must include the string '{searchTerms}', replaced in the query by the user's search terms. Invalid entries and entries with duplicate shortcuts are ignored. Site search entries configured as featured are displayed in the address bar when the user types "@". Up to three entries can be selected as featured. For a site search entry where allow_user_override is true, users have the ability to edit or disable that entry. However, featured engines (beginning with "@") can only be disabled. If a user modifies an entry that was initially created by this policy, it will no longer be managed by policy and will be treated like a user-created shortcut. When allow_user_override is false or unspecified for a site search entry, users cannot edit or disable that entry. The setting to allow user override is only supported on M139 and later; earlier versions will default to disabling user override. Users cannot create new site search entries with a shortcut previously created via this policy unless allow_user_override is set to true for the site search entry. In case of a conflict with a shortcut previously created by the user, the user setting takes precedence. However, users can still trigger the option created by the policy by typing "@" in the search bar. For example, if the user already defined "work" as a shortcut to URL1 and the policy defines "work" as a shortcut to URL2, then typing "work" in the search bar will trigger a search to URL1, but typing "@work" in the search bar will trigger a search to URL2. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=SiteSearchSettings for more information about schema and formatting. Example value: [ { "featured": true, "name": "Google Wikipedia", "shortcut": "wikipedia", "url": "https://www.google.com/search?q=site%3Awikipedia.com+%s" }, { "name": "YouTube", "shortcut": "youtube", "url": "https://www.youtube.com/results?search_query=%s" }, { "name": "Google Drive", "shortcut": "drive", "url": "https://drive.google.com/?q=%s", "allow_user_override": true } ]

Setting the policy specifies a list of web apps that install silently, without user interaction, and which users can't uninstall or turn off. Each list item of the policy is an object with a mandatory member: url (the URL of the web app to install) and 6 optional members: - default_launch_container (for how the web app opens—a new tab is the default) - create_desktop_shortcut (True if you want to create Linux and Microsoft® Windows® desktop shortcuts). - fallback_app_name (Starting with Brave version 90, allows you to override the app name if it is not a Progressive Web App (PWA), or the app name that is temporarily installed if it is a PWA but authentication is required before the installation can be completed. If both custom_name and fallback_app_name are provided, the latter will be ignored.) - custom_name (Starting with Google Chrome OS version 99, and version 112 on all other desktop operating systems, allows you to permanently override the app name for all web apps and PWAs.) - custom_icon (Starting with Google Chrome OS version 99, and version 112 on all other desktop operating systems, allows you to override the app icon of installed apps. The icons have to be square, maximal 1 MB in size, and in one of the following formats: jpeg, png, gif, webp, ico. The hash value has to be the SHA256 hash of the icon file. The url should be accessible without authentication to ensure the icon can be used upon app installation.) - install_as_shortcut (Starting with Brave version 107). If enabled the given url will be installed as a shortcut, as if done via the "Create Shortcut..." option in the desktop browser GUI. Note that when installed as a shortcut it won't be updated if the manifest in url changes. If disabled or unset, the web app at the given url will be installed normally. See PinnedLauncherApps for pinning apps to the Google Chrome OS shelf. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=WebAppInstallForceList for more information about schema and formatting. Example value: [ { "create_desktop_shortcut": true, "default_launch_container": "window", "url": "https://www.google.com/maps" }, { "default_launch_container": "tab", "url": "https://docs.google.com" }, { "default_launch_container": "window", "fallback_app_name": "Editor", "url": "https://docs.google.com/editor" }, { "custom_name": "My important document", "default_launch_container": "window", "install_as_shortcut": true, "url": "https://docs.google.com/document/d/ds187akjqih89" }, { "custom_icon": { "hash": "c28f469c450e9ab2b86ea47038d2b324c6ad3b1e9a4bd8960da13214afd0ca38", "url": "https://mydomain.example.com/sunny_icon.png" }, "url": "https://weather.example.com" } ]

This policy allows an admin to specify settings for installed web apps. This policy maps a Web App ID to its specific setting. A default configuration can be set using the special ID *, which applies to all web apps without a custom configuration in this policy. The manifest_id field is the Manifest ID for the Web App. See https://developer.chrome.com/blog/pwa-manifest-id/ for instructions on how to determine the Manifest ID for an installed web app. The run_on_os_login field specifies if a web app can be run during OS login. If this field is set to blocked, the web app will not run during OS login and the user will not be able to enable this later. If this field is set to run_windowed, the web app will run during OS login and the user will not be able to disable this later. If this field is set to allowed, the user will be able to configure the web app to run at OS login. The default configuration only allows the allowed and blocked values. (Since version 117) The prevent_close_after_run_on_os_login field specifies if a web app shall be prevented from closing in any way (e.g. by the user, task manager, web APIs). This behavior can only be enabled if run_on_os_login is set to run_windowed. If the app were already running, this property will only come into effect after the app is restarted. If this field is not defined, apps will be closable by users. (Since version 118) The force_unregister_os_integration field specifies if all OS integration for a web app, i.e. shortcuts, file handlers, protocol handlers etc will be removed or not. If an app is already running, this property will come into effect after the app has restarted. This should be used with caution, since this can override any OS integration that is set automatically during the startup of the web applications system. Currently only works on Windows, Mac and Linux platforms. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=WebAppSettings for more information about schema and formatting. Example value: [ { "manifest_id": "https://foo.example/index.html", "run_on_os_login": "allowed" }, { "manifest_id": "https://bar.example/index.html", "run_on_os_login": "allowed" }, { "manifest_id": "https://foobar.example/index.html", "run_on_os_login": "run_windowed", "prevent_close_after_run_on_os_login": true }, { "manifest_id": "*", "run_on_os_login": "blocked" }, { "manifest_id": "https://foo.example/index.html", "force_unregister_os_integration": true } ]

A list of origins of remote desktop client apps that may execute WebAuthn API requests that originate from a browsing session on a remote host. Any origin configured in this policy can make WebAuthn requests for Relying Party IDs (RP IDs) that it would normally not allowed to be able to claim. Only valid HTTPS origins are allowed. Wildcards are not supported. Any invalid entries are ignored. [added: This policy only applies to affiliated users. ]Example value: https://remotedesktop.google.com https://vdi.corp.example https://server:8080/

Setting the policy lets you list the URLs that specify which sites are automatically granted permission to access a HID device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the item to be valid, otherwise the item is ignored. Each item in the devices field must have a vendor_id and may have a product_id field. Omitting the product_id field will create a policy matching any device with the specified vendor ID. An item which has a product_id field without a vendor_id field is invalid and is ignored. Leaving the policy unset means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies. URLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=WebHidAllowDevicesForUrls for more information about schema and formatting. Example value: [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://chromium.org" ] } ]

Setting the policy lets you list the URLs that specify which sites are automatically granted permission to access a HID device containing a top-level collection with the given HID usage. Each item in the list requires both usages and urls fields for the policy to be valid. Each item in the usages field must have a usage_page and may have a usage field. Omitting the usage field will create a policy matching any device containing a top-level collection with a usage from the specified usage page. An item which has a usage field without a usage_page field is invalid and is ignored. Leaving the policy unset means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies. URLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=WebHidAllowDevicesWithHidUsagesForUrls for more information about schema and formatting. Example value: [ { "urls": [ "https://google.com", "https://chromium.org" ], "usages": [ { "usage": 5678, "usage_page": 1234 } ] } ]

This policy allows restricting which IP addresses and interfaces WebRTC uses when attempting to find the best available connection for each specific URL pattern. It accepts a list of URL patterns and handling type pairs. The URL patterns are checked in order and the first match will configure which handling is used by WebRTC for the domain. When the URL of the current document is not matched against any entry, it uses the configuration set by the policy WebRtcIPHandling. For detailed information on valid input patterns, please see https://chromeenterprise.google/policies/url-patterns/. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. Valid handling values: * default - WebRTC uses all network interfaces. * default_public_and_private_interfaces - WebRTC uses all public and private interfaces. * default_public_interface_only - WebRTC uses all public interfaces, but not private ones. * disable_non_proxied_udp - WebRTC uses either UDP SOCKS proxying or will fallback to TCP proxying. See RFC 8828 section 5.2 (https://tools.ietf.org/html/rfc8828.html#section-5.2) for a detailed description of all the handling values. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=WebRtcIPHandlingUrl for more information about schema and formatting. Example value: [ { "url": "https://www.example.com", "handling": "default_public_and_private_interfaces" }, { "url": "https://[*.]example.edu", "handling": "default_public_interface_only" }, { "url": "*", "handling": "disable_non_proxied_udp" } ]

Setting the policy lets you list the URL patterns that specify which sites are automatically granted permission to access a USB device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the policy to be valid. Each item in the devices field can have a vendor_id and product_id field. Omitting the vendor_id field will create a policy matching any device. Omitting the product_id field will create a policy matching any device with the given vendor ID. A policy which has a product_id field without a vendor_id field is invalid. The USB permission model will grant the specified URL permission to access the USB device as a top-level origin. If embedded frames need to access USB devices, the 'usb' feature-policy header should be used to grant access. The URL must be valid, otherwise the policy is ignored. Deprecated: The USB permission model used to support specifying both the requesting and embedding URLs. This is deprecated and only supported for backwards compatibility in this manner: if both a requesting and embedding URL is specified, then the embedding URL will be granted the permission as top-level origin and the requesting URL will be ignored entirely. This policy overrides DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls and the user's preferences. This policy only affects access to USB devices through the WebUSB API. To grant access to USB devices through the Web Serial API see the SerialAllowUsbDevicesForUrls policy. See https://c[removed: loud.google.com/docs/chrome-enterpris][added: hromeenterprise.googl]e/policies/?policy=WebUsbAllowDevicesForUrls for more information about schema and formatting. Example value: [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com" ] } ]