How does the Push browser extension work?

The Push browser extension provides real-time detection and response, policy enforcement, and telemetry collection inside the browser session, helping you protect employees from attacks that target workforce account and device compromise.

The extension also provides a full inventory of your workplace apps, accounts, OAuth integrations, and browser extensions, surfacing vulnerabilities associated with insecure accounts or untrusted or malicious integrations and extensions.

The extension also enforces your security policies with point-in-time guidance delivered to employees on appropriate app usage, AI data sharing, and other browser-based work activities.

The Push extension analyzes the security of an account by performing checks for stolen, leaked, shared, reused or weak passwords; MFA usage and MFA method; capturing the login method (password, SAML, or OIDC); and others.

For more details about how the Push extension securely analyzes passwords, refer to this related help article.

Once installed, the extension sits in the background of your employees’ browsers, only intervening when a security control is triggered, based on your configuration. Learn more about the data that the Push extension collects in this related help article.

The browser extension can monitor logins to commonly used work apps based on your company email domain(s) or it can monitor all email domains an employee might use. Configure your preferred domains on the Settings page of the Push admin console.

The extension can also detect company domain logins to apps that Push may not recognize as work apps. These apps will appear in a separate list called "Other apps" in the admin console.