Using JSON to deploy accounts from Google workspace admin panel

[supermounter]

Hello.
Can we use the backup file plain text to add a rule policy JSON to push the saved accounts from the admin console of Google workspace ?

I can force the plugin installation to chrome but i'm looking for a way to push the accounts list in the same time.
The admin console from Google Workspace can use JSON file to setup particular plugin settings but I don't know whath will be the exat content from this JSON script to import the accounts list with the secret keys.

the backup file use plein text format like:
otpauth://totp/example.com?secret=FLIQ7AABIXF2DBUYE7VYAV2T7232KVYB

can i just use this sentence format into JSON querry tu push the example.com account ?

Any help with this will be much appreciate.

[Sneezry]

At the moment, we do not currently support importing accounts by a domain administrator. This is because the extension settings pushed by a domain administrator are stored in the Windows Registry without encryption, which poses a security risk. Another possible approach is to use managed storage (it's readonly for users), but there may still be encryption issues with this method.

To better assist you, could you please provide more details about your specific use case? Are you being blocked by the lack of this feature, and if so, why do you believe that pushing accounts from the console is a feature worth implementing?

[supermounter]

We got team space/users that share web accounts together for work into differents projects.
Some web account force the 2step with authenticator without possibility to add more than 1 device authenticator and no other way 2step.
We tried the usage of 1 dedicated chrome entreprise profile shared to each team's user but this way compromise the security as some unknow user can take controle of this shared chrome profile or some authorized user can delete the accounts from the plugin.

Seems our request will be the same needs of a centralizes manager password....with authenticator possibilities.
We seen some plugin interessant proposing this feature but for individual usage, not managed.

the idea to give a JSON command deployement can be a sort of external accounts security management.

When you said "extension settings pushed by a domain administrator are stored in the Windows Registry without encryption", is this the same for the accounts manually added into authenticator plugin ?
Also we are essentialy with chrome inside MAC OS here, then I suppose that pushing or import accounts from Google domain will not be into a registery from the OS but inside the Chrome crypted profile data ?

[Sneezry]

Thank you for explaining that. I would like to clarify that 2FA is not designed to be shared among multiple users. It is recommended to create separate accounts for each user and manage their permissions using group policy. Therefore, this extension may not be suitable for this particular use case.

However, the extension does support exporting accounts. You can add the 2FA codes in one browser, then export the backup and share it with users in your organization. Please note that this is not the best practice for 2FA, as each user should ideally have their own account.

It's important to mention that the extension encrypts the data if a master password is set. However, the extension's enterprise settings are not encrypted and are stored without encryption. Deploying the TOTP accounts along with the settings could pose a high risk, regardless of the operating system being used (Windows, Linux, or macOS).