Overview
Supported platforms
Google Workspace distributes the proxy auto-configuration (PAC) file URL to these platforms:
Chrome browser on Windows, Mac, Linux, and Android
ChromeOS devices such as Chromebooks
Chrome browser on iOS isn't supported.
Google Workspace distributes the root certificate authority (CA) certificate to these platforms:
ChromeOS devices such as Chromebooks
Android and iOS (requires advanced mobile management licensing from Google)
On other platforms such as Windows or macOS, Google Workspace doesn't control the root certificate store. You must use another mobile device management (MDM) solution to distribute the root CA certificate.
About this document
This document doesn't cover how to enroll devices in Google Workspace. It covers how to create the policy that distributes the proxy configuration and the root CA certificate.
Proxy auto-configuration file
F5 Workforce AI Security distributes its proxy information in a PAC file. The PAC file has all the information needed to send only generative AI traffic to the Workforce AI Security proxy service. The device sends other traffic by its typical route.
Workforce AI Security uses the PAC file to update the list of generative AI domains. Most operating systems and browsers request the PAC file every 1 through 2 hours. If a device can't get a new file, the device keeps using the current file.
Root certificate
Workforce AI Security needs certificate trust to intercept connections and apply policy. Other network security and secure access service edge (SASE) vendors work the same way. This policy applies to connections to generative AI websites. All devices that Workforce AI Security governs must trust the Workforce AI Security root CA certificate.
Configure Google Workspace
All configuration in this section takes place in the Google Workspace admin portal at https://admin.google.com. Unless otherwise stated, all instructions start from this URL.
Important note
The PAC file URL policy applies in Google Workspace at the user level, not the device level. Apply the policy in the directory structure where the targeted users exist. To cover multiple organizational units (OUs), replicate the policy for each OU.
Prerequisites
Get the URL of the proxy auto-configuration file
Log in to https://admin.surepath.ai.
In CONFIGURE, go to Connectors.
Select ADD CONNECTOR.
Enter a descriptive name for the connector, such as
PAC File - Active Directory.Select Proxy as the connector type.
Select SAVE to generate the unique PAC file URL.
Copy the PAC file URL from the connector details page.
Download the root certificate
Log in to https://admin.surepath.ai.
In CONFIGURE, go to Organization.
Select the Integrations tab.
In the File Downloads section, download the SurePath AI Root CA Certificate.
Create the policy that distributes the proxy auto-configuration file URL
Go to Devices > Chrome > Settings.
Select the OU for the policy.
Under the default tab, User & browser settings, select Search or add a filter.
Type
proxy.Select the Proxy Mode search result.
In the Configuration list, select Always use the proxy auto-config specified below.
Enter the PAC file URL from the prerequisites section.
Select SAVE.
Create the policy that distributes the root certificate on ChromeOS
Go to Devices > Networks.
Select the OU for the policy.
Under Certificates, select UPLOAD CERTIFICATE.
In the Add certificate window, enter a name for the certificate, such as
Workforce AI Security root CA certificate.Select UPLOAD.
Select the root certificate that you downloaded in the prerequisites section.
Select the platforms to receive the certificate, such as Chromebook.
Select ADD.
Verify the integration
After you complete the deployment, verify that the endpoint is integrated correctly. Use the Workforce AI Security Ready tool.