Workforce Setup Guide

This guide provides instructions on how to set up and deploy the Workforce browser extension, which helps IT teams understand and optimize the usage of internal software applications.

What is Workforce?

Workforce is a browser extension and web application that measures the utilization of internal software applications. The Workforce extension logs page structure and user activity for selected apps when accessed from a browser logged into a company profile. This data helps IT teams manage spend effectively and improve the user experience of internal applications.

Supported browsers

• Google Chrome
• Microsoft Edge Enterprise
• Some other Chromium-based browsers

Not all use cases, platforms, sites, applications, or Fullstory features are supported. Please contact your account manager or sales representative for details.

Configuration and deployment overview

There are two steps to getting Workforce set up: configuration and deployment.

Configuration and local testing

All deployment methods require configuration of the extension and local testing is recommended:

• Workforce extension configuration
• Local deployment (for testing)

Organizational deployment methods

The following deployment methods are supported for distributing the Workforce extension throughout your organization:

• Microsoft Edge Enterprise
• Google Chrome (Google Workspace)
• Endpoint management (Intune, SCCM, etc.)
• Email invitation

Configuring and downloading the extension

Before deploying the Workforce extension, you need to configure it on the Workforce settings page. You may also wish to test the extension locally before deploying more broadly.

Workforce extension configuration

1. Sign in to your Workforce account by going to app.fullstory.com.
2. Once you are signed in, click on the dropdown in the upper left of the Workforce interface and click “Settings”.
   
3. On this page, you’ll configure your Workforce extension settings:
   
   
   
   • Extension Name: Give the extension a custom name. This will be the name that employees see when viewing the extension once it is installed on their browser.
   • Fullstory Relay: Configure Fullstory Relay if applicable (recommended if users frequently use ad blockers).
   • Help Text: Add custom help or support text for your users.
   • Help URL: This is the documentation that explains Workforce to employees who have the extension installed. The default URL will point to the Workforce Employee Guide. You may wish to write your own internal documentation for your employees and can provide the URL to that documentation here.
4. Once your settings are configured, click the Download [version] button
5. A .zip file containing the extension and all resources will be downloaded. 

Local deployment

You may to deploy the Workforce extension on your local machine for testing purposes.

1. Obtain the Extension File: Download the.zip file from your Fullstory Workforce settings.
2. Install the Extension:
   1. Unzip: Unzip the downloaded file to extract the extension file.
   2. Load Unpacked Extension: In your browser's extensions settings ( chrome://extensions for Chrome, edge://extensions for Edge), enable "Developer mode" and then click "Load unpacked extension" to load the extension from your local machine.

Organization deployment

Once you've configured Workforce and tested it locally, you'll use one of the following deployment methods to distribute the Workforce extension to your broader organization.

• Microsoft Edge Enterprise
• Google Chrome (Google Workspace)
• Endpoint management (Intune, SCCM, etc.)
• Email invitation

Microsoft Edge Enterprise

Prerequisites

Deployment of Workforce to Microsoft Edge Enterprise browsers requires the following prerequisites to be in place:

• Target systems joined a Microsoft Windows Domain
• Microsoft Edge Enterprise installed

• Microsoft Edge Enterprise group policy templates ( msedge.admx ) installed in group policy management console - policy templates are available for download from Microsoft

Hosting the extension

You will need to host the Workforce extension within your environment in a location that your endpoints can access in order for them to install it. Fullstory recommends self-hosting the Workforce extension following Microsoft’s guidance for Edge Enterprise. Detailed instructions on self-hosting the extension are available at https://learn.microsoft.com/en-us/deployedge/microsoft-edge-manage-extensions-webstore 

Use Group Policy to ForceInstall Workforce

Once the prerequisites have been met and your extension is available to your endpoints, we will use Group Policy to apply a “ExtensionInstallForcelist” policy object to in-scope domain computers. 

1. In the Group Policy Editor, go to Administrative Templates> Microsoft Edge > Extensions > and then select Control which extensions are installed silently.
2. Select Enabled.
3. Click Show.
4. Enter the app ID or IDs of the extension or extensions you want to force-install.
   
   
   You must use the full syntax, which includes both the extension ID and the “Update URL” separated by a semicolon. The “Update URL” should be the URL that points to the extension manifest XML file in your environment. See https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#extensioninstallforcelist for details.

The extension is installed silently without user interaction. The user won't be able to uninstall or disable the extension. This setting overwrites any blocklist policy that's enabled.

Additional resources

• Microsoft Edge extension documentation

Google Chrome (Google Workspace)

Prerequisites

Deployment of Workforce to Google Chrome at scale requires the following pre-requisites to be in place:

• Google Workspace (Business Plus or higher license tier required)
• Workspace Configured to allow private deployment of Chrome Extensions (More information from Google available here and instructions for configuration available immediately below)

• Google Chrome installed on target endpoints
• Google Workspace account signed in to Chrome with Chrome Sync turned on
• Active Chrome Developer Account using your Google Workspace Account.
  
  
  Create a Chrome Developer Account here. There’s a one-time, $5 fee for creating an account.

Publishing the extension

In order to distribute the Workforce extension to your endpoints, you will first need to publish your custom Workforce extension package to the private Google Chrome Web Store for your Google Workspace domain. 

1. Download the custom packed extension from your Workforce dashboard 
   1. Click “Workforce” in the top right of your dashboard and choose “Settings”. 
   2. Click the “Download Extension” button to start the download.
2. Access your Chrome Developer Dashboard and create your own extension deployment.
   1. Login to https://chrome.google.com/webstore/devconsole
   2. Click “New Item” in the top right corner of the Developer Dashboard
   3. Upload the extension package you downloaded in step 1b
   4. Populate the required fields as appropriate for your environment
   5. Icon and Screenshots of appropriate size are required and provided here
      • 
      • 
   6. On the “Privacy” tab you will be required to enter a justification for the permissions the Workforce extension leverages. You can enter “Private SaaS analytics within our Google Workspace domain. Not for general distribution.” for the justification fields and select the checkboxes as shown in the screenshot below.
      
   7. IMPORTANT: On the “Distribution” tab it is essential that you select “Private” under  the “Visibility” section and then select “Everyone at {Your Workspace Domain}” as in the screenshot below. This setting is critical for ensuring that your extension remains private to your organization, and that the review by Google will go as quickly as possible.
      
      
      Note: If you're unable to see the outlined Visibility settings, please verify that:
      

      • You are using an account that is within your Google Workspace domain
      • that you've configured your Google Workspace to Allow Private Extension Deployment, as outlined here .
      
   8. Once all required fields have been filled in, press the “Submit for Review” button and select the “Publish ‘Workforce’ automatically after it has passed review” option in the pop up dialog. Finally, click on the “Submit for review” in the pop up.
   9. Keep an eye on your Chrome Developer Dashboard for the status of your submission to change from “Pending Review” to “Published” before proceeding.
   10. Note the extension ID for your Workforce extension on the Chrome Developer Dashboard, you will need this value to define your extension policy in the following steps. 

Define your Workspace extension policy

In order to install the extension you have published in Chrome on your endpoints, you will need to define an Extension Policy within the Google Workspace Admin Console. 

1. Access your Google Workspace Admin Console at https://admin.google.com
2. Navigate to the “Chrome Browser” heading in the left nav menu and select “Apps & Extensions”
3. Select the desired scoping for the extension. For maximum flexibility, we recommend scoping the extension policy to one or more groups within your Google Workspace domain
4. Press the yellow “+” button in the bottom right corner of the page and select “Add Chrome app or extension by ID”
5. Enter the extension ID for your Workforce extension noted above and click “Save”
6. Select the desired policy parameters for your organization. We recommend the “Force install + pin to browser toolbar” option for most environments.

All in-scope Chrome browsers will automatically begin installing the extension. This process can take a few minutes. You can force a browser to update its extension policies by accessing chrome://policy/ from the Chrome address bar and clicking “Reload Policies”.

Additional resources

• Google Chrome extension documentation

Endpoint Management Deployment (Intune, SCCM, and similar solutions)

This section outlines how to deploy the Workforce extension using endpoint management tools like Microsoft Intune, System Center Configuration Manager (SCCM), and other similar solutions. This method is particularly relevant for organizations that do not centrally manage their users' browsers.

Prerequisites

• Access to your organization's endpoint management platform (e.g., Intune, SCCM).
• The Workforce extension package (downloaded from your Fullstory account). See Workforce extension configuration steps above.

Deployment steps

1. Package the Extension: Package the Workforce extension for deployment through your endpoint management system. Consult your platform's documentation for specific instructions on how to create and deploy software packages.
2. Deploy the Package: Deploy the Workforce extension package to the target devices or user groups using your endpoint management platform.

Employee identification

Solution: Okta/EntraID SSO Integration

If your organization uses Okta or EntraID for Single Sign-On (SSO), Workforce can leverage these services to reliably identify employees using their business email addresses. To enable this integration:

1. Contact Fullstory Support: A Fullstory admin should inform Fullstory Support that you are deploying Workforce via endpoint management and using Okta or EntraID SSO.
   
   When you reach out to Fullstory Support, please provide us with the following details about your SSO configuration:

   • If you're using Okta, provide the Okta Identity Domain (e.g. http://fullstory.okta.com)
   • If you're using Entra, provide any Entra email domains you're utilizing.
2. Fullstory Configuration: Fullstory will configure your Workforce instance to prioritize employee identification from Okta or EntraID.

Email invitation

This method simplifies the Workforce extension installation process by inviting users via email. This approach is particularly useful for smaller to medium-sized deployments, providing a streamlined experience for end-users. It is especially relevant for unmanaged devices, as it does not require administrator privileges or centralized management tools.

Process

1. Contact Fullstory Support: A Fullstory admin should inform Fullstory Support that you are deploying Workforce via email to have this feature enabled. 
2. Initiate Invitations: Within the Workforce administration interface in Fullstory, navigate to the user management or deployment section. You'll find an option to invite users via email via csv upload or manual entry.  Enter the email addresses of the users you wish to invite to install Workforce.
3. Send Invitations: The system will generate personalized invitation emails containing a unique link for each user. 
4. User Activation:
   • Download and Install: Users receive the email invitation and click the provided link. This will usually take them to a webpage with instructions to download and install the Workforce extension.
   • Activate: Once the extension is installed, the same webpage will detect this and prompt the user to click an "Activate" button. Both the installation and activation steps are required for Workforce to function correctly.

Important considerations

Because deployment by email invitation requires adoption by each individual end-user, keep in mind the following considerations when going through these steps:

• Email Deliverability: Ensure that the invitation emails are delivered successfully to users' inboxes. Check for any spam filters or delivery issues.
• User Adoption: Encourage users to promptly install the extension after receiving the invitation. Follow-up communication may be helpful.
• Browser Compatibility: While the invitation process itself is browser-agnostic, users will still need to be using a supported browser (Chrome, Edge, or other Chromium-based browsers) to install and use the extension.
• Updates: The update mechanism for extensions installed via email invitation depends on how the extension is hosted. Clarify how updates will be handled with your Fullstory representative.
• Case Sensitivity: Email addresses are case-sensitive. Name@business.com and name@business.com will be treated as separate users in the system. Ensure consistency in capitalization when entering email addresses.
• Pre-Communication: It is highly recommended to inform recipients beforehand that they will be receiving an email invitation to install the Workforce extension. This helps prevent confusion and avoids the emails being mistaken for phishing attempts or spam.
• Unique Links: The invitation links are unique to each user and should not be forwarded or reused.
• Admin Monitoring: The Workforce Users Admin interface provides information on the status of each invitation, including whether the link has been sent, whether the user has activated the extension, and the activation timestamp.