CG3 - Configure Browser Defender protections

This guide explains how to configure the protection preferences of Browser Defender: enterprise modes, group overrides, custom downloads policy, and advanced detection features.

• Requires Browser Defender active for the company and the Platform Administrator role.
• Group override requires that the group already exists in the synchronized company directory.

1. Configure protections at company level

Open Browser Defender > Setup, then the Preferences tab. The availability of Monitoring mode, below, depends on the version/generation of the distributed extension, visible in the information card on the page.

In the Company level settings section, click the pencil icon to edit, then choose a mode independently for each of the three following controls:

• Password Protection — with "Prevent with bypass" the user can manage their own list of trusted domains.
• Downloads Protection — with "Prevent with bypass" the user can still proceed with the download; from the Policy menu you can also assign a custom policy (step 3) instead of the default one.
• Browsing Protection — covers pages blocked by company policy or the knowledge base; AI detection and ClickFix have their own switches (step 4).
• User can disable extension — enable to allow end users to disable their own protection.
• Authorized login domain(s) — one or more domains, separated by comma (e.g. accounts.google.com, login.microsoftonline.com): the company identity provider domain, so the extension recognizes the legitimate login page instead of reporting it as password reuse.

Click Save configuration to save.

2. Create an override for a group

In the Group level settings section, click Add group settings, select the group, then set its three protection modes (same options as step 1). The User can disable extension toggle is optional: if not set it remains Off.

Click Save configuration: the group settings take priority over company settings for its members. The pencil on the row edits the override; the delete icon removes it and reverts the group to default company values.

NOTE: group override covers only the three basic protection modes and the "User can disable extension" toggle — the Advanced features from step 4 remain always at company level, with no group override.

3. Configure a custom downloads policy

In the Downloads protection policies section, click Add policy and assign a name to the policy.

Select entire file type categories to block — 8 categories available (e.g. "Executables & scripting", "Documents & data"):

Alternatively, expand a category to choose individual extensions instead of the entire category:

Optionally set a maximum file size in MB (0 = no limit) and blocked domains. Save: the policy becomes selectable both at company level (step 1) and for a group (step 2).

NOTE: the default policy is read-only (cannot be modified or duplicated); for different rules you need to create a new custom policy.

4. Adjust Advanced features

In the Advanced settings section, enable the desired Email Alerts (Phishing, Password reuse, Dangerous downloads, Unsafe navigation) to notify all administrators by email, and the Monthly digest email for a monthly summary:

The Advanced features controls are a separate group of settings from the modes in step 1 (different names and options).

Then set, independently, the three Advanced features controls — at company level, with no group override:

• AI Browsing Protection (default: Alert mode) — analyzes pages with artificial intelligence to detect dangerous content; other options: Disabled, Monitoring mode;
• LLM DLP (default: Disabled) — detects sensitive data pasted into large language models (LLM, e.g. Claude, Gemini, ChatGPT) through data loss prevention (DLP); includes a Protection level slider (Minimal / Recommended / Strict);
• ClickFix Protection (default: Monitoring mode) — detects attempts to paste a malicious command in Windows Run, a terminal, or PowerShell; unique exception among the three: only two modes, no Alert mode.

At this point, every toggle, dropdown menu, or slider on this page saves individually and is visible immediately on the Preferences page; the Company level settings and Group level settings windows save instead in bulk, with their own Save configuration button.

A change to protection modes, or a new downloads policy, reaches users' extensions only at the next synchronization cycle: confirmation that it is already active in the browser is found in the user's direct experience or on the corresponding alert page, not on this screen.