Browser Extension CoverageNew

Deploying the Airia browser extension is only half the job. You also need to know it's still there: installed on every managed device, running, and reporting to your tenant. Coverage answers three questions:

• Where is the extension installed, and is it healthy? Each install checks in with Airia, and the inventory lists every install with its status.
• Which devices don't have it? Airia compares installs against the devices it knows about and shows the devices with no extension.
• Has an extension gone quiet? When an install that had been reporting stops, Airia raises an alert, fires a runbook event and writes a SIEM record.

At a glance

How the check-in works

Each install sends a small check-in to your Airia tenant:

• when the browser starts
• when the extension is installed or updated
• when a user signs in to the extension
• every hour while the browser is running

A check-in contains:

A check-in carries no browsing activity. It only tells Airia the extension is there and running.

The extension can check in only when it can reach your tenant: a user must be signed in, or the extension must be deployed with the provisioningApiKey MDM key. An extension with neither doesn't check in and doesn't appear in the inventory.

Who a check-in is trusted to be

When a user is signed in, Airia takes the user from the sign-in, not from anything the extension reports. Check-ins sent with the provisioningApiKey MDM key are different: the key is shared by your whole fleet, so the device name and managedUserEmail in those check-ins are self-reported by the device. Treat them as labels, not proof of identity, and protect the key as a secret.

The inventory

Go to Discover → Inventory and open the Browser extensions tab.

Each row is one install, with these columns: Status, Device, User, Browser, Version, Auth, Features and Last seen. Open a row's actions and choose View details to see the full check-in, including Install ID, First seen, Policy revision, Policy loaded, Configured through MDM and Newest version for this browser.

Statuses

Outdated isn't a status: it's a badge next to the version, so an install can be both Stale and Outdated. An install is outdated when at least three installs of the same browser reported a newer version in the last 7 days. Each browser is compared separately, and versions reported by fewer than three installs are ignored, so a store that ships an update later than the others, or a single test build, doesn't mark the whole fleet outdated. Hover the badge to see the newest version for that browser.

If the extension is reinstalled on the same device for the same user and browser, it gets a new install ID. The new install replaces the old one, which is hidden from the list. While the old install is part of an open stopped-reporting alert, it appears under the Stopped reporting filter.

Filter and export

Filter with Status (All statuses, Active, Stale, Stopped reporting, Never seen), Browser and Version (All versions, Up to date or Outdated), or type in the inventory's search box to match a device name or user. To download the filtered list, click Export and choose Export as CSV or Export as JSON.

To remove an install for a device you've retired, open its row actions and choose Delete. If the extension on that device is still running, it is added back the next time it checks in. Deleting needs the Security Admin, Platform Admin or Admin role, or a custom role that can manage the inventory.

Retention

Airia cleans up installs that no longer matter:

• A replaced install is removed after it has been silent for 30 days, or longer if your quiet window is long.
• Any install that hasn't checked in for 180 days is removed.

Coverage gaps

The inventory only shows browsers that check in. To find devices with no extension at all, Airia compares installs against the devices it knows about. The top of the Browser extensions tab shows a summary such as The extension runs on 812 of 840 known devices. Click Show 28 devices where it was never seen (or pick Never seen in the Status filter) to list the gaps.

The summary counts only known devices: those from the endpoint agent, CrowdStrike and your device list. An install on any other device still appears in the inventory but doesn't change the count. To count it, set its managedDeviceName and either add that name to your device list, or use the name your other sources already report for the device.

The gaps view has these columns: Device; Listed by, the sources that list the device; Expected user; and Last reported, when a source last reported the device, or Device list only if it comes only from your device list. Filter it by source, search it, and export it as CSV or JSON.

Coverage figures can take up to about 30 seconds to reflect new check-ins.

Known devices

Airia builds the list of known devices from:

A device that appears in more than one source is listed once, with each source shown. A device is Never seen when no extension install has checked in from it in the last 30 days.

Manage the device list

With the Security Admin, Platform Admin or Admin role, or a custom role that can manage the inventory, click Manage device list to open the Coverage device list dialog. From there you can:

• Upload a CSV file of devices with Choose CSV file.
• Add one device: enter its Device name and, if you like, an Expected user email (optional), then click Add device.
• Remove a device with its remove button, then confirm with Remove. A removed device stays in the fleet if the endpoint agent or CrowdStrike still reports it.

Upload a device list

The file needs a header row and a device name column. A user email column is optional. Headers are matched ignoring case, spaces and punctuation, so Device name, device_name and deviceName are the same:

When a file has more than one accepted column, the one earliest in the list is used. Other columns are ignored, so you can upload a device export from Intune, Entra ID or NinjaOne as it is.

deviceName,userEmail
LAPTOP-0142,[email protected]
LAPTOP-0187,
DESKTOP-FIN-07.corp.contoso.com,[email protected]

How an upload behaves:

• Uploading adds new devices and updates ones already on the list. It never removes devices that aren't in the file; remove those one at a time.
• A device listed twice in the file takes the later row.
• A row with no device name is skipped. A row with an invalid email keeps the device, without the email, and the result lists it as a warning with its line number.
• Files must be .csv, at most 25 MB and at most 50,000 device rows, and the device list holds at most 50,000 devices. Split larger lists and upload the parts one at a time.

After the upload, the dialog shows how many devices were added, updated and skipped, with the lines that had problems.

Export a device list from your tools

How names are matched

An install matches a known device when its device name (the managedDeviceName MDM key) matches the device's name:

• Matching ignores case and surrounding spaces.
• A DNS suffix is ignored: LAPTOP-0142.corp.contoso.com matches LAPTOP-0142.
• Names that are IP addresses are compared whole, with no suffix removed.
• Group Policy's %ComputerName% gives the Windows NetBIOS name, which is cut to 15 characters, while Intune and the endpoint agent report the full host name. A 15-character name such as FINANCE-WORKSTA matches FINANCE-WORKSTATION-07 only when that is unambiguous: exactly one longer known name starts with it, no device is named exactly FINANCE-WORKSTA, and the host isn't reported as running a non-Windows OS. A host that the endpoint agent or CrowdStrike reports with a 15-character name is taken as its full name, never as a truncated one.

An install with no device name can't match any device, so the devices it runs on show as Never seen. Set managedDeviceName to each machine's real computer name through your MDM. See Device name on Shadow AI events.

Alerts when an extension stops reporting

Every hour, Airia looks for installs that had been checking in and have now been silent for longer than your quiet window. For each one it:

• marks it Stopped reporting in the inventory
• fires the Browser Extension Stopped Reporting runbook event
• writes an extension_stopped_reporting record to your SIEM

It also sends one notification per run for the whole tenant, titled Browser extensions stopped reporting: count, naming a sample of the devices. Its View installs link opens the inventory filtered to Stopped reporting.

Each outage alerts once: an install that stays quiet doesn't alert again. When it checks in again, the alert closes, Airia writes an extension_recovered SIEM record, and the install can alert again if it goes quiet later.

A replaced install (the extension was reinstalled on the same device for the same user and browser) doesn't alert while its replacement is checking in. Once the replacement has been checking in for at least one quiet window, the replaced install no longer alerts; only the replacement does if it goes quiet. If the replacement goes quiet sooner than that, both alert.

Who gets the alert

The notification goes to users with the Security Admin, Platform Admin or Admin role (see User Roles and Permissions). It appears in the Policy Violations category of Alerts and Notifications.

Set the quiet window

The Stopped-reporting alert card at the top of the Browser extensions tab holds the Quiet window (hours): any whole number from 1 to 720 hours (30 days), 72 by default. The card is shown only to users with the Security Admin, Platform Admin or Admin role, or a custom role that can manage the inventory; click Save to apply.

A short window catches problems sooner but also alerts on laptops that are simply switched off over a weekend. 72 hours covers a normal weekend.

Changing the window doesn't close alerts that are already open. They close the next time each install checks in.

Automate the response

Limits

• Alerts are sent at most once per outage. If sending fails, it isn't retried.
• Anyone who holds your fleet's provisioningApiKey can send check-ins that look like they come from your devices. Treat the key as a secret and rotate it if it leaks.

Troubleshooting

Related

• Browser Extension — deploy the extension and set Shadow AI policy.
• Browser Extension MDM Deployment Guide — managed configuration keys, including managedDeviceName.
• Endpoint Agent Overview — the endpoint agent whose devices count as known devices.