# Enterprise Rollout

The Enterprise plan adds centralized security, compliance, and rollout features for larger organizations. Workspace Owners and Admins manage these features, while IT admins deploy the browser extension and access across the organization. This page covers both areas.

## Enterprise administration

On Enterprise, Owners and Workspace Admins manage the workspace's security and compliance features:

- **Manage billing.** On Enterprise, only Owners manage billing.
- **Read the audit log.** A timestamped record of who did what in the workspace.
- **Export the workspace.** Create a complete export of shortcuts, members, and audit-log data for compliance reviews or a provider change.
- **Approve OAuth apps.** Review third-party apps before they receive workspace access.
- **Change security settings.** Enforce two-factor authentication, restrict sign-ins with an IP allowlist, or disable invitations completely.

On every plan, the Owner is also the only role that can delete the workspace.

Before rollout, review the current Owners and Admins. [Adjust ownership](/docs/workspaces#managing-ownership) so billing and ownership-only actions sit with the right people.

After a downgrade to Business, Enterprise features such as audit logs, exports, OAuth approvals, and advanced security settings are no longer available. Existing data is retained and becomes available again after a future upgrade.

## Deploying Lora at scale

The rest of this page is for IT admins rolling Lora out across an organization. Choose the deployment method that fits your policies and infrastructure. The browser extension is the recommended starting point. DNS-based methods suit organizations that integrate Lora with their network infrastructure.

## Chrome and Edge rollout (recommended)

The recommended way to roll out Lora is by deploying the [browser extension](/docs/get-the-app) to all employees through Chrome Enterprise or Microsoft Edge.

- **Chrome**: Use the [Chrome Enterprise policy](https://support.google.com/chrome/a/answer/6306504?hl=en) to force-install the Lora extension across your organization.
- **Edge**: Use [Microsoft Endpoint Manager (Intune)](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-manage-extensions-policies) or Group Policy to deploy the extension in Edge.

When the browser policy is assigned successfully, managed users receive the Lora extension without installing it themselves. They still need a Lora account and workspace membership.

## Custom search engine

If your company prefers not to install extensions, you can configure Lora as a **custom search engine** in Chrome, Edge, or Firefox.

### Steps (Chrome)

1. Open **Settings → Search engine → Manage search engines and site search**.
2. Under **Site search**, click **Add**.
3. Enter:
   - **Name:** Lora
   - **Shortcut:** `short`
   - **URL:** `https://app.uselora.com/short/%s`
4. Save.

Now type `short`, press Space, and enter `handbook` to search directly in Lora.

> **Note:** The same values (Name: Lora, Shortcut: `short`, URL: `https://app.uselora.com/short/%s`) work for Edge. Lora's in-app extension setup page provides current browser-specific instructions, including Firefox.

## Domain search

> **Search domain:** Use `lora-searchdomain.com` for this setup.

Domain search allows users to type shortcuts without a prefix. With the search domain `lora-searchdomain.com` configured, typing `handbook` in the browser bar will resolve to `handbook.lora-searchdomain.com` and redirect through your Lora workspace.

### Steps

- **macOS:** Configure the search domain under **System Settings → Network → DNS → Search Domains** → add `lora-searchdomain.com`.
- **Windows:** Add the DNS suffix under **Network Adapter Properties → IPv4 → Advanced → DNS** → add `lora-searchdomain.com`.
- **Managed devices:** Push the setting with MDM (JAMF or Intune).

## Internal DNS entry

> **Infrastructure requirement:** Confirm the routing target with Lora before setup. Do not use an example or inferred IP address, and test TLS, authentication, and routing first.

An internal DNS entry allows employees to type shortcuts like `http://short/handbook` directly into their browser and resolve them through your company’s network — no browser extension required.

### How it works

By creating the record supplied for your deployment in internal DNS, you point a short hostname (commonly `short`) at the validated Lora routing target. When employees type `http://short/slug`, DNS resolves it through that customer-specific configuration.

### Steps

1. Open your internal DNS settings.
2. Create the DNS record supplied for your deployment:
   - **Name:** `short`
   - **Type:** A for an IPv4 address, AAAA for an IPv6 address, or CNAME for a hostname
   - **Target:** the hostname or address explicitly supplied for your deployment
3. Save the record and apply changes to your DNS server.
4. Have employees type `http://short/` in their browser once to initialize resolution.
5. After that, shortcuts like `http://short/handbook` will resolve automatically on your network.

### Do I still need the extension?

- With an internal DNS entry, shortcuts work seamlessly **inside your corporate network**.
- We still recommend installing the Lora extension, because it enables:
  - Using shortcuts **outside the corporate network** (remote, mobile, travel).
  - Features like autocomplete, quick create, and advanced shortcut options.

## Tailscale VPN

> This is a customer-managed DNS/VPN configuration, not an option in Lora. Publish the Lora search domain `lora-searchdomain.com` through your tailnet.

If your organization uses [Tailscale](https://tailscale.com/), you can route shortcut resolution through your VPN.

- Enable [MagicDNS in Tailscale](https://tailscale.com/kb/1081/magicdns/).
- Configure it to resolve `lora-searchdomain.com`.
- Push the settings to all devices connected to your tailnet.

## Domain push via MDM (JAMF / Intune)

> Extension policies, the Lora search domain, and managed-search settings can be deployed together or separately.

JAMF and Intune can deploy the Lora browser extension, the `lora-searchdomain.com` DNS suffix, and managed browser search configuration.

### Benefits

- Consistent browser configuration across managed devices
- Less manual extension setup for employees
- Central policy assignment and removal
- Optional managed site search using the current Lora URL pattern

### Considerations

- If a user accesses shortcuts in incognito mode, they may be prompted to sign in before continuing.
- Device enrollment in JAMF or Intune is required for configuration to apply.

### JAMF (macOS)

With JAMF, you can push configuration profiles to all managed macOS devices.

- **Search domain**: Add `lora-searchdomain.com` to DNS Search Domains.
- **Browser extension**: Push the Lora Chrome/Edge extension via the ExtensionInstallForcelist payload. Use extension IDs: Chrome: `cacmbfiiigpjpiflidcnoclhlmonanoj` ([Chrome Web Store](https://chromewebstore.google.com/detail/lora-shortcuts/cacmbfiiigpjpiflidcnoclhlmonanoj)) or Edge: `hkdichcogemmndpjbjchlbfacedihefc` ([Edge Add-ons](https://microsoftedge.microsoft.com/addons/detail/lora-shortcuts/hkdichcogemmndpjbjchlbfacedihefc)).
- **Custom search engine** (optional): Deploy a managed search engine configuration with keyword `short` and URL `https://app.uselora.com/short/%s`.

### Steps

1. Open **JAMF Pro** → **Configuration Profiles** → **New**.
2. Select **Wi-Fi** or **Network** payload and add **DNS Search Domains** → `lora-searchdomain.com`.
3. Add an **Application & Custom Settings** payload for Chrome or Edge to install the Lora extension.
4. Save and assign the profile to your target devices or groups.

### Intune (Windows)

With Microsoft Intune, you can push device configuration policies to all managed Windows clients.

- **Search domain**: Add `lora-searchdomain.com` as a DNS suffix in device configuration.
- **Browser extension**: Force-install the Lora extension in Chrome or Edge via settings catalog. Use extension IDs: Chrome: `cacmbfiiigpjpiflidcnoclhlmonanoj` ([Chrome Web Store](https://chromewebstore.google.com/detail/lora-shortcuts/cacmbfiiigpjpiflidcnoclhlmonanoj)) or Edge: `hkdichcogemmndpjbjchlbfacedihefc` ([Edge Add-ons](https://microsoftedge.microsoft.com/addons/detail/lora-shortcuts/hkdichcogemmndpjbjchlbfacedihefc)).
- **Custom search engine** (optional): Configure managed search engines with keyword `short` and URL `https://app.uselora.com/short/%s`.

### Steps

1. Open **Intune admin center** → **Devices** → **Configuration profiles** → **Create profile**.
2. Select **Windows 10/11** → **Settings catalog**.
3. Add settings for:
   - **DNS suffix** → `lora-searchdomain.com`
   - **Microsoft Edge / Chrome Extensions** → Add the Lora extension ID: Chrome: `cacmbfiiigpjpiflidcnoclhlmonanoj` ([Chrome Web Store](https://chromewebstore.google.com/detail/lora-shortcuts/cacmbfiiigpjpiflidcnoclhlmonanoj)) or Edge: `hkdichcogemmndpjbjchlbfacedihefc` ([Edge Add-ons](https://microsoftedge.microsoft.com/addons/detail/lora-shortcuts/hkdichcogemmndpjbjchlbfacedihefc))
   - **Managed search engine** (optional)
4. Assign the profile to device/user groups.
5. Save and sync policy to apply.