Keep company data out of
personal SaaS accounts

DomainGuard is deployed silently using your existing MDM solution — Microsoft Intune or Group Policy (GPO). You generate an API token in the admin console, include it in your MDM configuration, and the extension installs automatically on all managed devices. Employees never see a prompt.

Yes. The extension caches your policy rules locally. If a device temporarily loses internet access, the cached rules continue to be enforced. Policies sync automatically every 15 minutes when connectivity is restored.

Yes. You can create individual rules for any site — each rule has its own site pattern and list of approved email domains. For example, Slack might allow @company.com while Salesforce allows both @company.com and @subsidiary.com.

No. The extension uses Chrome's Manifest V3 which runs as a service worker — it only activates when a login form is detected on a page. It has no impact on general browsing speed or performance.

Yes — the same extension works on both Chrome and Edge since both support the WebExtensions API and Manifest V3. You can deploy to both browsers from a single admin console.

DomainGuard logs rule match events (which site, which rule was triggered, and a hashed machine identifier) to your audit log. No personal browsing data, passwords, or email content is ever collected. All data is stored in your organisation's isolated database partition.

Proxy-based tenant restriction solutions work by routing all outbound traffic through a proxy that inspects and rewrites HTTP headers — meaning every web request must be SSL-decrypted and re-encrypted. This adds infrastructure and performance overhead, and can break certificate pinning on some SaaS apps. DomainGuard enforces policy directly inside the browser, so no network traffic is inspected at all. Only the login form interaction is affected — everything else browses normally with no overhead.

They solve different parts of the problem. Tenant Restrictions v2 controls access to Microsoft tenants (Microsoft 365, Azure). DomainGuard enforces approved email domains on any SaaS login page you define — Slack, Salesforce, Atlassian, Zoom and more — and blocks social sign-in buttons on those sites. The two are designed to run together.

No. DomainGuard blocks new “Continue with Google / Apple” sign-ins on matched sites. Sessions a user already has open are not terminated — revoke those in the SaaS app’s own admin console if needed.

Yes. Cancel anytime from the billing portal — no lock-in, no cancellation fees. Your subscription continues until the end of the current billing period.