Postman v10 Desktop Agent native messaging host deployment under managed browser policies

Answer to the Core Questions

Deployment Mechanism
Postman currently does not ship an MSI, Intune Win32 package, or a signed enterprise‑distributable installer for the PostmanNativeMessagingHost.exe. The supported deployment path is to install the full Postman desktop application through your existing software‑distribution channel (e.g., Microsoft Endpoint Manager, SCCM, or a scripted MSI that wraps the bundled installer). The native host is installed into the Postman application folder during that user‑level install, and the host is launched only by the Desktop Agent extension.

Browser Policy Configuration
To enable the Desktop Agent in Chrome/Edge under Group Policy or Intune, perform the following:

1. Identify the exact extension ID that ships with the current Postman Desktop Agent (e.g., gkdbkhnkefgkefgk – replace with the value from your installed agent).
2. Add that ID to ExtensionInstallAllowlist (or ExtensionInstallForcelist if you prefer a forced install).
3. Configure NativeMessagingAllowlist so that the host name PostmanDesktopAgent is mapped to the extension origin. Example policy JSON:

   {"chrome://extensions/AllowedExtensions":[""]}
   {"chrome://extensions/NativeMessagingAllowlist":{"PostmanDesktopAgent":{"allowed_origins":["chrome-extension:///"]}}}
   

4. Ensure the policy is applied to all managed Chrome/Edge profiles that need the Desktop Agent.

Application‑Control Baselines
Do not weaken your baseline by allowing all user‑profile executables. Instead, use the most restrictive rule type that still permits the host:

• If the host is signed by a trusted publisher, add a publisher rule for that publisher.
• If signing is not available, add an exact hash rule for PostmanNativeMessagingHost.exe or a path rule that points to the installation directory, but only if that directory is not writable by standard users.
• Maintain change control: any update to the host requires re‑generation of the hash or review of the path rule.

Firefox Support
Firefox remains experimental; manual manifest placement is required and cannot be automated under locked‑down profiles. Treat Firefox as out of scope unless you can bundle both the host and the manifest under your distribution controls.

Timeline for Signed Enterprise Package
There is no publicly confirmed release date for an officially signed, enterprise‑distributable package of the native host. Verify the current Postman release notes or reach out to Postman support before planning a rollout that depends on such a package.

Next Diagnostic Step

To refine the recommendation, please let us know which application‑control engine you are enforcing (AppLocker, WDAC, etc.) and whether the Postman installation directory is writable by standard users. This will determine whether a publisher rule, hash rule, or path rule is the safest approach.