Skip to main content
grant_bem
grant_bem
Level 1.6: Donut
June 8, 2026
Solved

End Point Verification Helper App

  • June 8, 2026
  • 2 replies
  • 151 views

So I have been going round and round in circles trying to understand how the Helper App works and triggers for End Point Verification and official documentation aswell as Gemini seem to say that in order for the Helper App to trigger a prompt for an end user to install it, you first need a rule in place that requires the visibility of signals only the helper app can see. 

I have been trying AV requirements in  rules etc but nothing seems to trigger the Helper installation. 

For context, this is required for BYOD extensions and so deploying the app is not possible. 

Best answer by Lynda

Hi ​@grant_bem 

We completely understand how going in circles with the Endpoint Verification (EV) Helper App prompts can be frustrating, especially when managing a BYOD environment where forced deployment isn’t an option.

To help get you un-stuck, we did some deep-diving with our engineering team on your exact scenario. Here is a clear breakdown of why you are running into this, an immediate alternative you can test right now, and what the long-term solution looks like.

1. The Root Cause & Immediate Workaround

You are entirely correct that the Helper App is only triggered when a Custom Access Level (CEL) rule requires signals that Chrome cannot natively see. Your current CEL rule is looking for a specific Windows Registry key to verify the firewall:

device.clients["bce"].data["registry_config"]["WindowsFirewall"]["presence"] == PresenceValue.VALUE_FOUND && device.clients["bce"].data["registry_config"]["WindowsFirewall"]["value"] == 1

Because registry checks inherently require the EV Helper App, this rule is hitting a wall on BYOD devices.

The Solution: If you are trying to satisfy Cyber Essentials Accreditation or general security baseline requirements, you can bypass the registry entirely. Chrome can actually detect the OS Firewall state natively without needing the Helper App at all.

Instead of querying the registry, try updating your CEL rule to use the native browser signal:

Code snippet (more info here)

device.clients["bce"].data["is_os_native_firewall_enabled"] == true

Why this helps you right now:

  • No Helper App Required: Because Chrome reads this signal natively, it will evaluate successfully on BYOD devices without needing the helper app installed.

  • Cross-Platform: This single rule works seamlessly across Windows, macOS, ChromeOS, and Linux, meaning you don't have to maintain separate registry queries for different operating systems.

2. The Future Roadmap for BYOD

Our engineering team's long-term vision aligns exactly with your goal: to eliminate the need for the EV Helper App entirely by surfacing more security signals natively within the Chrome browser. This will massively streamline posture checking for BYOD.

To that end, native Anti-Virus (AV) detection is coming soon (estimated within the next couple of months). Once this capability lands, Chrome will be able to verify AV presence natively, completely removing the Helper App requirement for AV rules.

Next Steps

  1. Try swapping your firewall CEL rule to the native is_os_native_firewall_enabled attribute and let us know if that successfully unblocks your current compliance checks.

  2. We will keep a close eye on the upcoming native AV detection feature. As soon as it enters the Trusted Tester phase, we would love to get you enrolled so you can begin testing it in your BYOD environment.

Let us know how the native firewall rule works out for you!

2 replies

Rafa
RafaCommunity Manager
Community Manager
June 11, 2026

Hi ​@grant_bem, thanks for bringing it up here in the community!

I’ve raised your query internally and will get back to you here as soon as have more info to share. 

Community Manager
grant_bem
grant_bemAuthor
Level 1.6: Donut
June 16, 2026

Hi ​@Rafa, has anything come back on this?

Rafa
RafaCommunity Manager
Community Manager
June 16, 2026

Nothing yet ​@grant_bem, but I’ve chased it internally again - as soon as I have an update I will let you know. Thanks for your understanding.

Community Manager
Lynda
LyndaCommunity ManagerAnswer
Community Manager
July 15, 2026

Hi ​@grant_bem 

We completely understand how going in circles with the Endpoint Verification (EV) Helper App prompts can be frustrating, especially when managing a BYOD environment where forced deployment isn’t an option.

To help get you un-stuck, we did some deep-diving with our engineering team on your exact scenario. Here is a clear breakdown of why you are running into this, an immediate alternative you can test right now, and what the long-term solution looks like.

1. The Root Cause & Immediate Workaround

You are entirely correct that the Helper App is only triggered when a Custom Access Level (CEL) rule requires signals that Chrome cannot natively see. Your current CEL rule is looking for a specific Windows Registry key to verify the firewall:

device.clients["bce"].data["registry_config"]["WindowsFirewall"]["presence"] == PresenceValue.VALUE_FOUND && device.clients["bce"].data["registry_config"]["WindowsFirewall"]["value"] == 1

Because registry checks inherently require the EV Helper App, this rule is hitting a wall on BYOD devices.

The Solution: If you are trying to satisfy Cyber Essentials Accreditation or general security baseline requirements, you can bypass the registry entirely. Chrome can actually detect the OS Firewall state natively without needing the Helper App at all.

Instead of querying the registry, try updating your CEL rule to use the native browser signal:

Code snippet (more info here)

device.clients["bce"].data["is_os_native_firewall_enabled"] == true

Why this helps you right now:

  • No Helper App Required: Because Chrome reads this signal natively, it will evaluate successfully on BYOD devices without needing the helper app installed.

  • Cross-Platform: This single rule works seamlessly across Windows, macOS, ChromeOS, and Linux, meaning you don't have to maintain separate registry queries for different operating systems.

2. The Future Roadmap for BYOD

Our engineering team's long-term vision aligns exactly with your goal: to eliminate the need for the EV Helper App entirely by surfacing more security signals natively within the Chrome browser. This will massively streamline posture checking for BYOD.

To that end, native Anti-Virus (AV) detection is coming soon (estimated within the next couple of months). Once this capability lands, Chrome will be able to verify AV presence natively, completely removing the Helper App requirement for AV rules.

Next Steps

  1. Try swapping your firewall CEL rule to the native is_os_native_firewall_enabled attribute and let us know if that successfully unblocks your current compliance checks.

  2. We will keep a close eye on the upcoming native AV detection feature. As soon as it enters the Trusted Tester phase, we would love to get you enrolled so you can begin testing it in your BYOD environment.

Let us know how the native firewall rule works out for you!

    Terms & ConditionsAccessibility statement