Enroll devices

Enrollment ties one browser to your organization. Until a browser is enrolled, shim blocks prompts and file attachments in recognized ChatGPT, Claude and Gemini composers and asks the employee to finish setup.

Create a one-time code

1. In the console, open Devices and choose Add browser. When no browser is enrolled yet, the steps are on the page itself.
2. Under Joins team, choose the team the browser should join, or No team. When a team is open in Devices, it is preselected.
3. Choose Create enrollment code.
4. Copy the code and the platform URL shown beside it.

Each code enrolls one browser, works once and expires after 10 minutes. An organization can hold up to 100 unused codes at a time. Only administrators can create codes.

An organization can enroll up to 500 browsers. Revoked browsers, and browsers that were reset and enrolled again, still count toward this limit, so plan pilot resets with it in mind.

Enroll the browser

1. Open the shim extension from the browser toolbar and choose Open settings.
2. Under Enroll this browser, enter the Platform URL, paste the One-time enrollment code and give the browser a Device name of up to 80 characters.
3. Choose Grant platform access and enroll and allow access to the console origin when the browser asks.

The browser receives its own device credential and the policy of its team, or the default policy. It appears in Devices as soon as enrollment completes and updates with each sync.

Check a browser

The extension’s settings show the state of This browser:

Field	Meaning
Policy	The name and version of the policy cached on this browser
Pending events	Reports waiting to be uploaded
Composer	What the last observed AI composer looked like: Ready, Empty draft, Degraded or Unsupported

Sync policy and audit events fetches the current policy and uploads pending reports immediately. The extension also syncs every minute on its own.

In the console, Devices groups browsers by team. Choose All devices, a team or No team, then search or filter by status. Each browser shows its team, its policy and whether it runs the current version, its status and when it was last active.

Status	Meaning
Active	Reported in the last 7 days. Online now means a report in the last 5 minutes
Needs attention	Its last report said its policy is missing or expired, reports can’t upload, or Send was unavailable
Inactive	No report for more than 7 days. The browser may be unused, or shim may have been removed
Revoked	Access was revoked; the browser can no longer sync

Updating next to a policy means the browser hasn’t synced its current version yet. Online browsers update within about a minute.

Select a browser to open its details: its status, its policy and where it comes from, its recent detected requests, the AI apps it used and the ChatGPT, Claude and Gemini accounts seen in its requests (both for administrators only) and its device ID. Administrators can move it to another team, give it its own policy, rename it or revoke it there. Use J and K to step through the list.

Teams

Teams group browsers, for example by department, and give them a policy together. Choose New team under Devices, name it and choose its policy, or keep Default policy. Open a team to change its policy, edit it or delete it. Deleting a team moves its browsers to No team; they then use the default policy unless they have their own.

Revoke a browser

Open the device under Devices and choose Revoke access, then confirm. The device stays in the list as revoked and still counts toward the 500-browser limit.

To enroll a browser again after a reset, create a new code. See Upgrade and reset.