IT Deployment Guide

Deploy the Content Filter to student devices

You've turned on the Content Filter in TSNC — this guide is the device side that makes it actually enforce, and closes the obvious ways a student could get around it. It takes about 15 minutes in Google Admin Console.

How the Content Filter works (30 seconds)

The filter is enforced by the TSNC browser extension using Chrome's built-in network blocking (declarativeNetRequest). When a student opens a blocked site, the extension redirects them to a “Site blocked” page. Blocking happens locally on the device — no browsing is sent to TSNC. It keeps working even when the browser's background process is asleep.

For it to apply to a student, three things have to be true: the extension is installed, it's allowed in incognito (or incognito is disabled), and the student is signed in with their school account so TSNC knows they're a student. This guide sets up all three.

First, turn it on (if you haven't): in the TSNC admin app go to Admin → Org Security → Content Filter, accept the Content Filter Addendum, choose the categories to block for students and/or staff, and save. The filter stays off until you do this. Then come back here to deploy it to devices.

Step 1 — Force-install the extension on student devices

Force-installing means the extension appears automatically on every student device and the student can't remove it. Do this against your student organizational unit (OU).

Get the extension ID

cpnepnmopionnobdffmnoikbjgnnfkpf

(Verify on our Chrome Web Store listing.)

Add & force-install it

Sign in to admin.google.com as a super admin.
Go to Devices → Chrome → Apps & extensions → Users & browsers.
Select your student OU (so this targets students, not staff).
Click + → Add Chrome app or extension by ID and paste the ID above.
Set the installation policy to Force install (or Force install + pin to browser toolbar — see Step 2).
Click Save.

Within ~6 hours every managed student Chrome browser in that OU has the extension.

Step 2 — Pin it (optional, but handy)

Yes — pinning is supported. On the extension entry, set the pinning option to Force pinned (in newer Admin Console layouts this is the Installation policy choice “Force install + pin to browser toolbar”; in older ones it's a separate Allow user to pin → Force pinned setting).

Important: pinning is not required for the filter to work — blocking happens at the network layer whether or not the icon is visible. Pinning mainly helps admins: it keeps the TSNC icon and its right-click “Allow / Block this site for the org” menu within reach while browsing. Many schools force-pin for staff and leave it unpinned for students.

Step 3 — Close the incognito bypass (the #1 way around it)

By default, Chrome extensions are disabled in Incognito — so a student could open an Incognito window and the filter wouldn't apply. Close this gap one of two ways:

Allow the extension in Incognito — in the same extension policy, set Allow in incognito = Enabled.
Or (cleanest) disable Incognito for students entirely — Devices → Chrome → Settings → Users & browsers → Incognito mode → Disallow incognito mode.

Either one closes the gap. Disabling Incognito for student OUs is the simplest and most robust.

Step 4 — Enforce school sign-in

The filter decides who's a student from their signed-in account: staff = someone with a TSNC org role; student = on the school's email domain but not staff. So the student must be signed in with their school Google account.

Use enrolled / managed Chromebooks so students sign in with the school account.
Set Restrict sign-in to pattern to your domain so personal Google accounts can't be used to dodge the policy.
Make sure your student email domains are registered for the org in TSNC — that's how “student” is recognized.

Other bypasses to know about

Personal device / personal account → not managed, not signed in as a school user, so the filter doesn't apply. Content filtering is for managed devices.
VPNs / proxies → enable the Proxies & VPNs category to block common circumvention tools, and add specific ones to your deny list as you find them.
Other browsers (Firefox/Edge/Safari) → the extension is Chrome/Chromium only. On managed Chromebooks, restrict students to Chrome.
DNS-level escape → the extension blocks at the browser; pair with your school's DNS filtering for defense in depth.

What students, staff, and admins see

Student → a TSNC “Site blocked” page. No way to proceed.
Staff (if you set staff mode to Warn) → a notice they may Proceed anyway; the visit is recorded.
Admins → an “Allow this site for the org” button on the block page, plus a right-click Allow / Block this site menu — no copy-pasting URLs into a form.

Privacy & compliance

Enforcement is local — no browsing is sent to TSNC to make a block decision. The extension records policy events only (attempts to reach blocked sites + staff bypasses), shown to your admins as aggregate counts by default. The school is the data controller under FERPA and is responsible for any parental notice/consent required before deploying to students. See the Content Filter Addendum and our Privacy Policy.

Want a hand with the rollout?

Email us with your setup (Google Admin OU structure, Chromebooks or mixed devices) and we'll walk you through force-install, incognito lockdown, and sign-in enforcement on a screenshare.

Email us about deployment